The British users who sued Grindr, a dating app for the LGBTQ+ community, claim it shared their highly sensitive personal information with advertisers without consent. The lawsuit was settled this week, with Grindr agreeing to pay 26 million pounds ($35 million) to the approximately 12,000 claimants, although the company maintains that this is not an admission of liability. According to digital policy expert Jan Penfrat, big tech companies often obscure what data they collect and for what purpose, making it difficult for users and regulatory authorities to understand their practices. The lawsuit is one of many cases raising questions about what happens to personal data entrusted to apps.
Written by the local model on 2026-09-11,
using this article's own text rather than the other coverage of the
same event (that is the story summary below).
Everyone has secrets.
asserted
Everyone → have → secrets
Things they wouldn't tell just anyone – except, perhaps, their dating app.
asserted
they → tell → app
What sort of partner they're looking for.
asserted
they → look → partner
Where they go to look for them.
asserted
they → go → them
Their sexual preferences, maybe, or details about their health.
This information is meant to help the app find suitable matches.
asserted
app → mean → matches
Selling the details on to other companies is not in the users' interest.
asserted
Selling → sell → interest
But this is what allegedly happened with Grindr, a dating app explicitly aimed at the LGBTQ+ community.
uncertain
what → happen → community
Around 12,000 app users in Britain sued the company, which they said had shared highly sensitive personal information with advertisers — even, in some cases, a user's HIV status.
asserted
they → sue → cases
The lawsuit, filed in 2024, was settled earlier this week.
asserted
lawsuit → file → 2024
Grindr has agreed to pay the claimants a total of 26 million pounds (€30 million; $35 million) – but stresses that this is not an admission of liability.
asserted
this → agree → liability
Grindr continues to dispute the allegations, there has been no legal judgement.
asserted
Grindr → continue → allegations
What happens to the data you entrust to apps?
asserted
you → happen → apps
This latest case is just one of many that raise the bigger question of what actually happens to the information we entrust to our apps on a daily basis.
asserted
we → raise → basis
But they are often supported by cloud services, analysis tools, advertising networks and other service providers.
asserted
they → support → services
They save and transfer data, link and analyse it — often contrary to our interest.
asserted
They → save → interest
Jan Penfrat, a digital policy expert, says that many of the big tech companies want to "make it as difficult as possible for users and regulatory authorities to understand what data is gathered on our devices by which players, and for what purpose."
Penfrat works for European Digital Rights (EDRi), a European network of NGOs and experts that campaigns to defend fundamental rights and freedoms in the digital realm.
We all know what it's like: An app, a messenger service, for example, is quickly installed, and when it asks if it has permission to use personal data, users will often just click "yes."
Phone numbers are stored on servers — without approval
But the devil is in the detail.
asserted
devil → say → detail
When you install WhatsApp, for example, you give it access to all the contacts in your smartphone.
asserted
you → install → smartphone
The phone numbers are transferred to the server — including those of people who don't use WhatsApp themselves, and who have not given permission for their contact details to be passed on.
asserted
details → transfer → permission
"All of this flows into an enormous profile," says Penfrat.
asserted
Penfrat → flow → profile
Companies like Google then offer so-called "targeting" products based on this data.
asserted
Companies → offer → data
"This means a car or clothes manufacturer can say: I'd like to address these target groups, and I want my advertising to appear in their Google search, Google Mail, or any of the hundreds of millions of third-party websites with integrated Google advertising," Penfrat explains.
asserted
Penfrat → mean → advertising
Selling data profiles
Google is just one of many companies that offer data profiles.
asserted
that → sell → profiles
Two types of data feed into these profiles.
asserted
types → feed → profiles
One is the data that every user voluntarily discloses when they state something in their profile, or upload private photos.
asserted
they → disclose → photos
But in addition, many big tech companies have for years now made assumptions based on the data they receive.
asserted
they → make → data
"If they have access to my location data and know where I usually am at night, they can assume that this is my home address," Penfrat says.
asserted
Penfrat → have → night
"If, for example, it's in a very expensive part of town, they can immediately make assumptions about my income.
asserted
they → make → income
If they see: Oh, he has geolocation switched on and he regularly goes to a gay club, then he's probably a member of the LGBTQ community.
asserted
he → see → community
And all this goes straight into the profile.
asserted
this → go → profile
Strict regulation in Europe
The EU already has one of the strictest data protection regulations in the world.
asserted
EU → have → world
The General Data Protection Regulation (GDPR) aims to protect people's personal data and privacy.
asserted
Regulation → aim → data
Other EU digital laws such as the Digital Markets Act or the Digital Services Act are intended to prevent big tech companies misusing their power over businesses and users.
asserted
companies → intend → businesses
US businesses also have to abide by these laws if they offer their services to people in Europe, or observe their behavior.
asserted
they → have → behavior
The EU Commission has imposed numerous fines as punishment for violations of these regulations.
asserted
Commission → impose → regulations
In 2025, it fined Apple €500 million euros ($580 million).
asserted
it → fin → euros
Meta, the company that operates Facebook, was fined another €200 million ($232 million).
asserted
that → operate → million
Google had to pay €890 million ($1.03 billion) in fines this year.
asserted
Google → have → fines
That sounds like a lot — but a look at the net profit of the Google corporation Alphabet puts it into perspective.
asserted
look → sound → perspective
"So these are sums that a company like Google or Amazon will make in just a few days," says Penfrat.
asserted
Penfrat → make → days
"They just include it in their budget."
Dependency on US digital services
As a result, it is not that easy for the EU to implement truly effective controls.
asserted
EU → include → controls
…and 5 more, not listed.
