Jeff Cassman

In a complaint filed Wednesday, the Electronic Privacy Information Center (EPIC) called on the Federal Trade Commission (FTC) to investigate the popular LGBTQ+ dating app Grindr for its potentially unlawful retention and disclosure of users’ sensitive personal data.

EPIC’s complaint highlights Grindr, LLC’s checkered history of protecting the privacy and safety of its users and troubling allegations made by Grindr’s former Chief Privacy Officer Ronald De Jesus in his recent wrongful termination lawsuit against Grindr.

Grindr appears to have retained and disclosed sensitive user data—including users’ account information, messages, and photos sent via the platform—after users deleted their Grindr accounts. Grindr also apparently failed to implement adequate data security practices and to control employee access to user data. And Grindr appears to have retained and disclosed sensitive health information—including users’ HIV status, last tested date, and vaccination status—in violation of commitments made in Grindr’s privacy policies. As EPIC writes:

“Grindr’s apparent personal data practices have caused or are likely to cause substantial injury to its users and former users because they expose users to security breaches of highly sensitive data, including health information like HIV status and vaccination status; other information users include on their profiles like sexual preference and age; users’ app usage; and location data.”

EPIC’s complaint calls on the FTC to investigate Grindr for unfair and deceptive practices in violation of Section 5 of the FTC Act and for violations of the Health Breach Notification Rule. EPIC further urges the FTC to enjoin any unlawful data practices confirmed in its investigation and to impose penalties against Grindr for any violations of the Health Breach Notification Rule.

“There’s good reason to believe that Grindr has betrayed the trust and violated the privacy of its users,” EPIC Director of Litigation John Davisson said. “It’s critical that the Federal Trade Commission step in and conduct a thorough investigation of Grindr’s personal data practices. Grindr users deserve peace of mind that their sensitive personal data will be protected from mishandling and misuse.”

EPIC has played a leading role in developing the authority of regulators to safeguard the rights of consumers, ensure the protection of personal data, and address privacy violations. EPIC previously called attention to Grindr’s failure to protect users from harassment and abuse by filing an amicus brief in Herrick v. Grindr.

###

About EPIC
EPIC is a public interest research center in Washington, D.C., established in 1994 to focus public attention on emerging privacy and civil liberties issues and to secure the fundamental right to privacy in the digital age for all people through advocacy, research, and litigation. EPIC pursues a wide range of program activities including policy research, public education, conferences, litigation, publications, and advocacy. EPIC routinely files amicus briefs in federal courts, pursues open government cases, defends consumer privacy, organizes conferences for NGOs, and speaks before Congress and judicial organizations about emerging privacy and civil liberties issues. EPIC works closely with a distinguished advisory board, with expertise in law, technology and public policy.

As many as half of US consumers have been affected by data breaches because a company holding their personal information was hacked. That is significantly higher than the global average of just 33 percent of consumers. Although it can be difficult to remedy the harms of identity theft, preventing the underlying breach is in many cases neither difficult nor expensive. The Department of Homeland Security has estimated that 85 percent of data breaches were preventable, and more recently the Internet Society has estimated 95 percent of breaches could have been prevented. Companies must be incentivized to invest in safeguards to protect consumer data with which they have been entrusted—or else multiple breaches each impacting tens or hundreds of millions of Americans will continue to occur every year.

In March 2023, the White House unveiled a National Cybersecurity Strategy that includes a five-pillar plan to work towards a more secure and reliable digital ecosystem. In July 2023, the White House released its Implementation Plan for this strategy. In addition to covering a range of cybersecurity-focused issues, such as disrupting malicious actors online and investing in secure infrastructure, the strategy also makes clear that it is essential to reduce harmful data practices in the marketplace. Many governmental and non-governmental groups have begun to focus on building and supporting the cybersecurity workforce and infrastructure, but EPIC believes that the privacy and data security components of the strategy demand closer attention. In particular, it is important for civil society to have a coordinated action plan to promote better legislative and regulatory standards.

That is why EPIC is launching a new project on Strengthening Privacy and Cybersecurity Standards, with the support of craig newmark philanthropies’ Cyber Civil Defense Initiative. Our goal is to partner with other members of the Cyber Civil Defense to advance important elements of the National Cybersecurity Strategy including:

1. Establishing cybersecurity minimum requirements in critical sectors (Strategy Pillar One- Defend Critical Infrastructure); and
2. Improving privacy and data security practices in all sectors (Strategy Pillar Three- Shape Market Forces to Drive Security and Resilience).

By advocating in support of stronger minimum cybersecurity requirements to defend critical infrastructure and in support of comprehensive privacy and data security practices that shape market forces to drive security and resilience, EPIC will raise public awareness of threats to online security and will spur the creation of tools to promote privacy and defend our nation’s networks.

Minimum Cybersecurity Requirements to Defend Critical Infrastructure

As part of its work to support the National Cybersecurity Strategy, EPIC will advocate for federal policies that mandate stronger cybersecurity standards to defend critical infrastructure and improve public safety. Where sensitive information such as precise geolocation, communications, health, and/or financial information is at risk the stakes are especially high. Preventing bad actors from harvesting personal data from repositories containing this information is both a cybersecurity and privacy priority, and federal policy must reflect this reality through sensible minimum cybersecurity requirements. These requirements should include annual audits and…

A recent Privacy Impact Assessment (PIA) published by the DHS in 2022 details ICE Homeland Security and Investigations’ use of several categories of surveillance technologies. The PIA outlines ICE’s narrow conception of a “reasonable expectation of privacy” that allows the agency to conduct broad surveillance without judicial oversight. Although the PIA describes a warrant requirement for certain surveillance activities, the assessment fails to address ICE’s ability to purchase the same data without a warrant from commercial entities. Additionally, the PIA ignores the deceptive tactics ICE has used to obtain consent for certain surveillance activities covered by this PIA. The shortcomings of the PIA are exacerbated by ICE’s history of abuse of its authority and the broad surveillance dragnet the agency has created, which leaves little doubt that ICE will not abide by the minimal requirements described in the PIA and guarantees that ICE will bypass warrant requirements by obtaining surveillance data from commercial entities.

Homeland Security Investigations

Homeland Security and Investigations (HSI) is a directorate under ICE and is the principal investigative component of the DHS. HSI has the “legal authority” to investigate, disrupt, and dismantle transnational crime. HSI’s legal mandate has come with a track record of questionable use of its authority.

HSI’s Abuse of Its Authority

 Just this year, a review by the DHS Office of Inspector General determined that ICE HSI did not obtain necessary warrants when using cell-site simulators, violating both departmental and federal privacy requirements in the process. HSI’s practice of using administrative subpoenas to collect sweeping financial records from Western Union in several states since 2019 was exposed just last year. Senator Ron Wyden’s response to this issue pointed out the questionable authority and interpretations that HSI used to access these records, circumventing approval from the DHS Office of the General Council and Office for Civil Rights and Civil Liberties on several occasions to access bulk personal information.

From 2017 to mid-August 2022, HSI issued more than 170,000 custom summons for data, all without judicial oversight. Among these summonses, HSI sought records from a youth soccer league in Texas, surveillance footage from a major abortion provider in Illinois, state university health records services, student elementary school records in Georgia, and data from a Lutheran humanitarian aid organization supporting refugees. These summonses have also been used to target journalists. Despite the fact that HSI is required to tailor its subpoenas to current investigations only, HSI’s practices reveal that these powers have been used indiscriminately to amass bulk domestic surveillance databases. HSI uses its authority beyond its own stated mission.

Despite HSI and Enforcement and Removal Operations (ERO) being completely separate components of DHS, HSI uses its authority to conduct criminal investigations as a pretext for conducting deportations and family separation operations that ordinarily fall within ERO’s mandate. HSI has often enlisted its staff to aid in CBP and ERO deportation operations. This sort of cross-pollination leaves HSI’s expansive investigative powers accessible for use cases they were not intended to serve. HSI’s abuse of its authority is exacerbated by its ability to access…

The Consumer Financial Protection Bureau took a major step last week toward establishing stronger guardrails for data brokers and better protections for consumers. On September 21, the CFPB released a document outlining proposals and alternatives under consideration for the Bureau’s upcoming Fair Credit Reporting Act (FCRA) Rulemaking. The FCRA regulates the consumer reporting market by permitting certain specified uses of consumer reporting data and prohibiting others, imposing accuracy requirements onto credit reporting agencies, and providing consumers a right to dispute inaccurate or incomplete information in their credit reporting files. The CFPB has the authority to issue rules under the FCRA and shares enforcement power with the Federal Trade Commission.

If the rules the CFPB is considering come to fruition, consumers will be better protected from the harmful practices of the data broker industry. Data brokers use the millions of data points they collect about American consumers to predict and influence consumer behavior, combining the personal data they collect with other datasets, mining that data for insights (often using AI tools), and selling personal data to third parties. In EPIC’s recent comments and coalition letter to the CFPB, we emphasized the widespread harm caused by data brokers. Because of the types and volume of personal information they collect, data brokers have a deeply invasive reach into the lives of American consumers.

In addition to the privacy harms caused by industry practices, data brokers also inflict economic and broader social harms. For example, consumers may suffer privacy, economic, and reputational harms, as well as severe anxiety, when their data collected by a broker is subject to a security breach. Further, considering certain kinds of data when making determinations related to a person’s eligibility for credit, employment, or housing can exacerbate existing inequalities and perpetuate racial bias.

Even as data brokers profit off the intimate details of consumers’ lives, consumers generally lack the ability to know how their information is being collected, used, and shared, while the brokers themselves operate largely with impunity. The data broker industry has exploded as technology has advanced, and it is time for regulators to catch up to protect consumers from harm. The CFPB’s FCRA rulemaking offers the Bureau an opportunity to do that.

In EPIC’s comments to the CFPB in July 2023, we urged the CFPB to presumptively recognize all data brokers as consumer reporting agencies (CRAs) unless data brokers demonstrate that they undertake reasonable measures to prevent the data they collect and sell from being used for any of the enumerated purposes under the FCRA. Data brokers’ business models are built on the mass collection, transfer, and combination of consumer data. It is important to ensure that consumer reports are not combined with other datasets and then used for purposes that harm consumers. Presumptively subjecting all data brokers to the FCRA would mitigate these harms and go a long way towards reining in the data broker industry.

Proposals and Alternatives Under Consideration by the CFPB

Acknowledging the rapid…