European website finds that a free app is exposing the exact locations of Grindr's 3.6M+ active users via unauthorized access to Grindr's private API
Nicole Nguyen / BuzzFeed News :
Context & Ripple Effects
This lands five months after BuzzFeed reported that Grindr was sharing users' HIV status and last-tested dates with two outside firms — a second privacy failure at the same company within half a year, this time via a free app tapping Grindr's private API to pinpoint where any of its 3.6M+ active users physically are.
The pattern only deepened afterward: researchers later showed that four dating apps including Grindr leaked location through their public APIs given just a username, sources described years of Grindr location data flowing out through an ad network and being sold, and Norway's regulator ultimately fined the company for disclosing location data without consent.
First-order effects
- Every one of Grindr's 3.6M+ active users is exposed right now: the app reveals exact physical locations through unauthorized private-API access, a acute risk for an LGBTQ user base in hostile jurisdictions.
- Grindr must immediately cut off the third-party app's API credentials and audit what else its private endpoints expose beyond coordinates.
Second-order effects
- European regulators now have a documented trail of Grindr location disclosures — the same conduct the Norwegian Data Protection Authority later penalized with an ~$11.7M fine for tagging users as LGBTQ without consent.
- Security researchers treat Grindr's APIs as a standing target: the following year they demonstrated location extraction from four dating apps' public APIs using only usernames, forcing the whole category to harden location sharing.
Third-order effects
- Dating apps face a structural conflict between proximity-based matching and privacy law: if the enforcement pattern holds, precise location becomes regulated data requiring explicit consent, reshaping how every location-aware social product is built.
- Grindr's repeated disclosures — HIV status, sold location data, and now this — push LGBTQ platforms toward litigation and regulatory scrutiny as a permanent cost of doing business, as the later UK user suit over ad-company data sharing shows.
The trend: Location data is becoming the defining liability of dating apps, with European regulators converting each disclosure scandal into consent-and-fines enforcement.