Parent company of Jack'd, a gay dating app with 6M+ users, settles complaint over flaw that had exposed private user photos on a public server for over a year
New York's attorney general has settled a complaint over gay, bisexual, and queer dating app Jack'd, whose parent company left …
Context & Ripple Effects
In February 2019, researchers found that Jack'd had stored photos users posted as private in chat sessions on an unsecured AWS server, leaving them publicly accessible for over a year while the app counted more than a million Play Store downloads. New York's attorney general has now converted that disclosure into a settled complaint against the app's parent company.
The settlement lands inside a widening enforcement arc for dating apps: Grindr was hit with a ~$11.7M Norwegian DPA fine for disclosing location data and tagging users as LGBTQ without consent, UK users sued Grindr over ad-sharing of sensitive personal data, and Match Group agreed to settle FTC claims over OkCupid data shared with Clarifai.
First-order effects
- Jack'd's parent company must answer to New York's attorney general under the settlement terms, covering a flaw that exposed private chat photos of its 6M+ user base on a public server for over a year.
- Users whose private images sat on the open server are the direct victims; the settlement formalizes state-level accountability for a breach first surfaced by outside researchers rather than the company itself.
Second-order effects
- Rivals like Grindr and Match Group's portfolio already face parallel actions across Norway, the UK, and the US FTC, so every new settlement raises the compliance bar — and legal exposure — for the entire dating-app category's data practices.
- Enforcement is converging from multiple jurisdictions on the same behavior pattern (sensitive user data shared or exposed without meaningful consent), pushing dating platforms toward costly audits of cloud storage configurations and third-party data sharing.
Third-order effects
- If the pattern holds, LGBTQ-focused apps become a standing regulatory priority precisely because their data carries outting risk — shifting the industry from self-set privacy defaults toward externally enforced consent standards for sexual-orientation-adjacent data.
- State attorneys general joining the FTC and European regulators creates layered jurisdictional pressure that small operators like Jack'd's parent are least equipped to absorb, favoring consolidation around players who can fund compliance.
The trend: Dating apps are moving from self-policed data practices to multi-jurisdiction enforcement, with LGBTQ-oriented platforms facing the sharpest scrutiny because exposed data carries outting risk.