Grindr pays £26 million to settle UK HIV data claims

Grindr Inc. disclosed that it has resolved a UK group action in the High Court of England and Wales. The disclosure is a Form 8-K filed with the SEC on 4 September 2026 (Item 8.01 Other Events, commission file 001-39714), signed by CFO John North. The earliest event reported is 2 September 2026.

This is a current report on a civil settlement. It is not a criminal plea, not an ICO fine, and not a finding of liability. The settlement includes no findings or admission of liability.

In April 2025, Grindr Inc. and Grindr LLC were served with High Court proceedings originally issued in April 2024 on behalf of UK users from a period up to early 2020, alleging UK privacy law violations. On 2 September 2026 the company resolved that action. The 8-K ties it to historical data practices before 2020, when Grindr was owned and controlled by Chinese conglomerate Kunlun.

The cash timetable is the part most headlines flatten. Grindr agreed to pay £13.0 million by 31 December 2026 and another £13.0 million by 31 March 2027. Using the 3 September 2026 exchange rate in the 8-K, each payment is about $17.6 million, for a total of about $35.2 million.

Grindr disputes the allegations. It acknowledges distress and loss of trust among some UK users for that pre-2020 period. The 8-K notes a sale to new owners six years ago, a NYSE listing two years later, and a privacy program overhaul since 2020.

The 8-K itself does not mention HIV status. The Guardian (Julia Kollewe, 7 September 2026) reports claimant allegations that highly sensitive personal information, including HIV status, was shared with advertising companies. Austen Hays represented about 12,000 people, and the Guardian's arithmetic is about £2,167 each if the £26 million were split equally. That is claimant and press framing, not a court finding that HIV data was shared.

A health-data settlement years after the fact sits next to the Aesto Health notice covering 9.5 million patient records and the Thomson Reuters C-Track court-records incident. It is a different class of event from inbox evasion such as Microsoft's ASCII-smuggling phishing write-up or a fake-installer Mac campaign.

If you process health or sexual-orientation data for ads or analytics, treat this as a reminder that UK group actions can still cash out years later. Budget for historic data-sharing risk, not just today's consent banners.