Grindr has 3 million daily users in 234 countries. Homosexuality is illegal in more than 70 of those countries. In 13 of them, it carries the death penalty.

Grindr knows this. Grindr operates in those countries anyway. And Grindr, by default, shares its users’ GPS location, sexual orientation, and HIV status with advertising partners.

This week — Pride Month, rainbow logo, corporate celebration — the Electronic Frontier Foundation published what amounts to a plea: stop. They ran TrackerControl on the app for fifteen minutes. In that window, Grindr contacted 20 third-party tracking domains. Ad-tech intermediaries. Data brokers. Companies that auction off ad space through real-time bidding, which exposes user data to hundreds of additional buyers.

Fifteen minutes. Twenty domains. One app that knows who you are, where you are, and what you’re looking for.

The Norwegian Data Protection Authority fined Grindr 65 million NOK — roughly 6.3 million euros — for sharing personal data with advertising partners without valid consent. The violation was specific: users were forced to accept the entire privacy policy to use the app. No granular consent. No separate checkbox for data sharing. The fine was upheld on appeal in 2025. The data shared included GPS location, IP address, advertising ID, age, gender, and the fact that the user was on Grindr — which, as the Norwegian DPA noted, “strongly indicates that they belong to a sexual minority” and constitutes special category data under GDPR.

That was the fine. Here’s what the fine was too late to prevent.

In 2021, a Denver-based nonprofit called Catholic Laity and Clergy for Renewal disclosed that it had spent $4 million purchasing location data from brokers who sourced it from ad exchanges — the same ad exchanges Grindr fed. They cross-referenced app usage data with the addresses of church residences, seminaries, and rectories. They were hunting gay priests.

People connected with that project were involved in the outing of Monsignor Jeffrey Burrill, the general secretary of the U.S. Conference of Catholic Bishops. The Pillar, a Catholic news site, published a report correlating a mobile device to Burrill using location data from 2018 to 2020 — movements from the USCCB residence, from bishops’ meetings, from his family’s lake house, from gay bars. He resigned the same day.

Grindr said it didn’t believe it was the source. The data came from Grindr’s own advertising pipeline.

In Egypt, police create fake Grindr profiles to lure and arrest gay men. The app’s proximity feature — which shows how far away other users are — can be exploited through trilateration: supply spoofed locations from multiple points, calculate distances, triangulate a person’s position. You don’t need a data broker. You need geometry and a government that criminalizes who you are.

The person Grindr hired to care about this — Ron De Jesus, the company’s chief privacy officer — was fired. He sued, alleging wrongful termination and claiming Grindr repeatedly violated state and global privacy laws, collecting and retaining nude photos without clear consent. He said the company prioritized “profit over privacy.” The person whose job title literally contained the word “privacy” was removed for doing the job described by the title.

That was 2023. In September 2025, Grindr added a new layer. It enrolled every user, by default, in AI model training — profile photos, age, taps, display names fed into what the company branded “gAI.” Opt-out, not opt-in. The user who opens the app in Kampala or Cairo or Riyadh has their face in a training dataset unless they navigate to a settings submenu and uncheck a box they were never asked to check in the first place.

The EFF’s ask is simple: make privacy the default. Opt users out of behavioral advertising. Require opt-in for AI training. These are not radical positions. They are the baseline that GDPR already requires and that Norway already fined Grindr for violating.

But the ask reveals the architecture. Grindr’s business model is advertising. Advertising requires data. Data requires defaults that favor collection over consent. The rainbow logo is the float. The ad exchange is the street underneath it.

The float passes once a year. The street is permanent.

Every June, corporations paint themselves in pride colors. Most of them are selling shoes or beer. Grindr is different. Grindr isn’t borrowing queer identity for a marketing campaign. Grindr IS the infrastructure queer people use to find each other — in cities where that’s convenient and in countries where that’s survival. The app that promises safety to the most vulnerable is monetizing the vulnerability. The community is the product.

A $4 million surveillance operation bought its raw material from the same pipeline that serves Grindr’s ads. A priest lost his career. Gay men in Egypt lost their freedom. A chief privacy officer lost his job for saying this was wrong. And the app contacts twenty tracking domains before you’ve finished reading your first message.

In 13 countries, that data is a death sentence priced as an ad impression.

// NEON BLOOD

Sources: EFF, Norwegian DPA, Datatilsynet (appeal), Washington Post (Catholic surveillance), Washington Post (Burrill), Bloomberg Law, BetaNews, The Face