Grindr Shares HIV Status of Users with Other Companies

Just a days after Grindr, a queer mobile social network, released a new feature allowing users to opt-in to automatic HIV testing reminders, a data analysis conducted by SINTEF, a Norwegian outside research firm, exposed Grindr sharing sensitive information about its users’ HIV status with 2 other companies.

The app, which has more than 3.6 million daily active users throughout the world, has been providing information users choose to include in their profiles like their HIV status and ‘lasted tested date’ to Apptimize and Localytics — 2 companies that help optimize apps.

Grindr has long promoted HIV awareness, offering information about free testing sites and opt-in reminders for semiannual testing. In the app, users can choose to display HIV status ranging from positive to positive and in treatment to negative or negative and on PrEP, an option Grindr intended to help foster open dialogue among users. The app also links to a sexual health FAQ about HIV and how to begin treatment.

Because developers are sending HIV information with users’ GPS data, phone ID and email, this could identify specific users and their HIV status, which calls into question the company’s users’ privacy policy.

The disclosure of HIV status raises concerns about the privacy policy warning customers that the information put in a profile may be revealed. Experts argue that the app should be more specific in its user agreements about how it’s using their data. The company’s policy states: “You may also have the option to provide information concerning health characteristics, such as your HIV status or Last Tested Date. Remember that if you choose to include information in your profile, and make your profile public, that information will also become public.”

Whenever you give data to another entity, any data, for any reason, you lose control of that data. Terms of service change, breaches happen. Before giving up any data, I try to evaluate the absolute worst case of that data being leaked/abused. I recommend you do the same. https://t.co/53dBlAX5Sp

— Jake Williams (@MalwareJake) April 2, 2018

SINTEF’s data, which was confirmed by cybersecurity experts, disclosed that Grindr shared its users’ precise GPS position, gay subculture, sexuality, relationship status, ethnicity and phone ID to other third-party advertising companies, which unlike HIV data, was shared via plain text — a method that can easily be hacked.

“The HIV status is linked to all the other information. That’s the main issue,” Antoine Pultier, a researcher at Norwegian nonprofit SINTEF, told BuzzFeed News. “I think this is the incompetence of some developers that just send everything, including HIV status.”

According to the analysis, the third-parties are not necessarily certified to host medical data.

Grindr insists its sole purpose for sharing highly sensitive health information is an effort to better the app. While it’s not selling data for marketing purposes, it’s offering other companies intimate user information.

“No Grindr user information is sold to third parties,” Scott Chen, chief technology officer, Grindr, told BuzzFeed News. “We pay these software vendors to utilize their services. The limited information shared with these platforms is done under strict contractual terms that provide for the highest level of confidentiality, data security and user privacy.”

The company claims the contracts with the 2 companies are both standard practice and secure.

“Grindr is a relatively unique place for openness about HIV status,” James Krellenstein, member of AIDS advocacy group ACT UP New York, told BuzzFeed News. “To then have that data shared with third parties that you weren’t explicitly notified about, and having that possibly threaten your health or safety — that is an extremely egregious breach of basic standards that we wouldn’t expect from a company that likes to brand itself as a supporter of the queer community.”