Grindr Caught Sharing Its Users' HIV Statuses with Third Party Apps

A new report from Buzzfeed News states that gay dating app Grindr has been sharing the HIV statuses of its users with two third party companies, Apptimize and Localytics. A data analysis conducted by an outside research firm, and independently verified by BuzzFeed, shows that the two companies receive some of the information Grindr users choose to share in their profiles, including their HIV status and "last tested date."

Grindr users can choose from four options when it comes to disclosing HIV status — positive, positive and on HIV treatment, negative or negative and on PrEP. Because the information is sent to the third party apps along with users' GPS data, phone ID and email, it could be used by anyone with access to the data —including hackers or governments —to identify specific individuals, according to Antoine Pultier, a researcher at the Norwegian nonprofit SINTEF, which first identified the issue.

"The HIV status is linked to all the other information. That's the main issue," Pultier told BuzzFeed. "I think this is the incompetence of some developers that just send everything, including HIV status."

Grindr says it uses the two companies to make the app experience better for its users. "Thousands of companies use these highly-regarded platforms. These are standard practices in the mobile app ecosystem," Grindr Chief Technology Officer Scott Chen told BuzzFeed News in a statement. "No Grindr user information is sold to third parties. We pay these software vendors to utilize their services."

Related | Grindr Is the Latest App to Accidentally Share Your Private Data

Grindr was targeted in a recent security breach by a third party site called C*ckblocked, which allowed users to see who had blocked them on the app by inputting their username and passwords. C*ckblocked was then able to access users' personal data, including private messages, identifying info and GPS location data, even for users who had switched off location services.

"Grindr is a relatively unique place for openness about HIV status," James Krellenstein, a member of AIDS advocacy group ACT UP New York, told BuzzFeed.

"To then have that data shared with third parties that you weren't explicitly notified about, and having that possibly threaten your health or safety — that is an extremely, extremely egregious breach of basic standards that we wouldn't expect from a company that likes to brand itself as a supporter of the queer community."

"It allows anybody who is running the network or who can monitor the network — such as a hacker or a criminal with a little bit of tech knowledge, or your ISP or your government — to see what your location is," Cooper Quintin, senior staff technologist and security researcher at the Electronic Frontier Foundation, told BuzzFeed.

"When you combine this with an app like Grindr that is primarily aimed at people who may be at risk — especially depending on the country they live in or depending on how homophobic the local populace is — this is an especially bad practice that can put their user safety at risk," Quintin said.

"Even if Grindr has a good contract with the third parties saying they can't do anything with that info, that's still another place that that highly sensitive health information is located," Quintin said. "If somebody with malicious intent wanted to get that information, now instead of there being one place for that — which is Grindr — there are three places for that information to potentially become public."

The app's privacy policy does warn users that all information they include in their profile will be public if their profile is public: "You may also have the option to provide information concerning health characteristics, such as your HIV status or Last Tested Date. Remember that if you choose to include information in your profile, and make your profile public, that information will also become public."

"What the law regards as informed consent is in almost all instances uninformed consent," Ben Wizner, director of the ACLU Speech, Privacy, and Technology Project, told BuzzFeed.

"I hope that one small silver lining here will be that users and citizens will realize that there are enormous loopholes in the privacy regime," he said, "and that personal information is bought and sold freely on a global market."