Researchers find that in four dating apps, including Grindr, any user's location can be determined using the apps' public APIs, if the username is known
Four popular dating apps that together can claim 10 million users have been found to leak precise locations of their members.
Context & Ripple Effects
This finding slots into a decade-long pattern rather than arriving cold: researchers had already shown in 2017 that Tinder, OkCupid and other dating apps exposed real names, locations and login details to attackers (researchers exploited Tinder and OkCupid), and a year later a European website demonstrated that a free third-party app was pulling exact locations for Grindr's 3.6M+ active users off its private API (the 2018 Grindr location exposure).
What changes here is the attack surface: the leak runs through the apps' own public APIs, so no unauthorized access is needed — knowing a username is enough. With roughly 10 million users across the four affected apps, the same class of flaw keeps resurfacing at Grindr specifically, which makes its API design choices a recurring safety question for an LGBTQ user base.
First-order effects
- Any user of the four apps whose username is known can be physically located by anyone using the public APIs — for Grindr's user base in particular, precise location disclosure is a personal-safety exposure, not just a privacy nuisance.
- The four app operators face immediate pressure to rate-limit or obscure what their public endpoints return, since the fix cannot rely on policing third-party clients the way the 2018 private-API incident did.
Second-order effects
- Rival dating platforms get pulled into the same remediation cycle: the pattern culminated when Badoo, Bumble, happn, Hinge and Hily were all found vulnerable to two-meter location pinpointing before fixing it (the 2024 multi-app location vulnerabilities), so every operator now audits distance-sharing defaults.
- Location data flowing out of these apps feeds the broader broker economy documented in the related coverage, where Grindr, OkCupid, Tinder and period-tracking apps were shown sharing intimate user data with data brokers (the data-broker sharing study) — each API leak widens that supply.
Third-order effects
- If the pattern holds, coarse or fuzzed location becomes the industry default for dating apps, with exact proximity treated as a privileged signal behind authentication and consent gates rather than something any API caller can compute.
- Repeated disclosures across Grindr, Tinder, OkCupid and peers point toward location-in-dating-apps being treated as a regulated sensitive-data category, on the same track as the intimate-data sharing already flagged by consumer researchers.
The trend: Dating apps are being forced to treat user location as a hardened, consent-gated asset rather than a default API output, after a decade of research showing it can be reconstructed from usernames alone.