I am a gay man who grew up alongside the internet. I have often found community online, since there was none to be found where I lived. I joined forums and discussion boards that allowed me to learn from the experiences of others and gave me a place to share mine.
I was always acutely aware that there might have been people acting in bad faith in these forums, where my conversations could have been screenshot and shared elsewhere, but as I had no private information displayed, these communities made me safer and more understood than I was in “real life.”
Earlier this week, BuzzFeed News confirmed that Grindr, a popular gay dating app with a global user base and more than 3 million daily active users, was sharing user data with third-party analytics companies, including self-reported data on HIV status and last HIV test dates.
While it is not necessarily unusual for companies to share data with analytics companies to better understand their user bases and improve their product, the industry norm is to aggregate the data and remove personally identifiable information so that users can’t be connected to individual data points. However, in Grindr’s instance, this disclosure was being bundled with other non-public information on the user, such as their email address, device ID and GPS location.
This was being done in an unencrypted fashion ― meaning that it was possible for this data transmission to be intercepted and read by potential malicious actors. Understandably, there was a big online backlash, and Grindr first stated that its practices were misunderstood and then ultimately apologized, saying that it would stop sharing HIV information with its “trusted contractors” going forward.
“If your online data can represent you more accurately than your 'IRL self,' data privacy issues become more critical and dangerous.”
Here, in our post-Cambridge Analytica cultural moment, there’s a lot of conversations about personal data usage and how the information gets packaged. One aspect that seems to be left out of the narrative is that minority communities are particularly at risk.
If your only way of forming connections is by going online, if the only way you can find partnerships or solace is by logging on, if the only way you feel like you can truly express yourself is by creating an account, the data around your online habits become a bigger part of who you are. If your online data can represent you more accurately than your “IRL self,” data privacy issues become more critical and dangerous.
Some might say that no one is forcing you to sign up for these services or that you should accept the reality that anything you reveal in a public forum can further circulate. I think these arguments miss the point: Sometimes you cannot choose not to be online. Sometimes you cannot just log off and have a fulfilling life, especially if you live in one of the 72 countries where being gay is still illegal to some degree.
Offering information contextually in the scope of an app with a particular purpose is one thing. The information you provide being de-contextualized and then bundled with non-public information is another thing.
Many of us grew up thinking that it was a privilege to be able to use the internet in the first place. However, the current reality is that the internet has quickly become a utility, like electricity. There’s a certain kind of privilege that allows one to choose to stay offline ― and not everyone has that option, especially when they know they can feel less lonely by living on the internet.
Especially for companies that cater to LGBTQ populations, there needs to be an awareness that there is a level of implicit trust that cannot be breached. There is nothing inherently wrong with analyzing self-reported user data when it’s done ethically; analyses of HIV statuses, for example, can help public health workers better understand HIV transmission rates in different regions or sub-communities within the LGBTQ population, which can then be used for more effective resourcing and education initiatives.
However, this cannot be done by putting the practice into the fine print; users should be given a chance to fully consent and opt out if they do not want to participate. The conversation around HIV status unfortunately still carries a stigma both within and outside the LGBTQ communities. A company like Grindr that works to educate its users about sexual health should know better.
It’s good that Grindr allows users to disclose their status on their profiles; any opportunity to have visibility around HIV status and the different ways people choose to experience their sexual life can only help to further normalize the conversation, and provide moments of exchange and education for others who might not know that it is indeed possible to have an equal life.
“Not everyone has the option to stay offline, especially when they know they can feel less lonely by living on the internet.”
HIV status remains an uncomfortable subject for many to bring up in person, so having the option to display it without having to explain anything or risk getting rejected mid-conversation is a helpful feature of the product.
That being said, Grindr has a responsibility to users who are opening up and being vulnerable about a part of themselves that can get them in trouble; in 32 states in the United States, people have been criminally charged for allegedly infecting others with HIV. And while the Americans With Disabilities Act protects HIV-positive people from being fired or being retaliated against for their status, it is all too common for people to be discriminated against in the workplace and experience bullying.
Even when we take the HIV status disclosure out of the picture, a leak of unencrypted user data from the service could potentially out people who are not ready or cannot openly be themselves due to the laws of where they live.
Ultimately, we need to be cognizant of the special needs of minority populations when it comes to online interactions and connectivity in the narrative around data privacy. Companies that work predominantly with LGBTQ populations should do better to not betray our trust.
For many, leakage of private data is embarrassing or an unfortunate inconvenience of living in the 21st century. For LGBTQ folk, it can become a matter of life or death.
Alp Ozcelik is a senior product support specialist at BuzzFeed. Ozcelik lives in New York and is passionate about the intersection of tech policy and its applications to LGBTQ life.