Written by: Kacper Osiewalski, Lead Backend Engineer, Digital Colliers
Grindr just paid £26 million to settle a UK lawsuit alleging it shared users' HIV status with advertising firms in breach of data protection law. The settlement landed in February 2025 and it highlights a gap most iGaming operators haven't closed: you probably don't know what data your programmatic ad partners are actually using.
The Grindr Case
The lawsuit claimed Grindr shared sensitive user attributes with ad tech vendors without proper consent. The attributes included HIV status, ethnicity, and location data. The case turned on whether Grindr's privacy disclosures met the GDPR standard for informed consent. The £26 million figure is a class action settlement, not a regulatory fine, but the mechanism is the same. If your vendor processes customer data in ways you can't defend, you own the liability.
GDPR fines reach up to €20 million or 4% of global turnover. For a mid-sized operator running programmatic campaigns across the UK and EU, that's a seven-figure floor even before you factor in legal costs and brand damage.
Why iGaming Operators Face the Same Risk
Programmatic ad networks work by packaging user signals into bid requests. The network sends those requests to dozens or hundreds of demand-side platforms in real time. Each DSP decides whether to bid based on the data in the request. The operator configures what goes into the bid request, but most teams set it once during integration and never revisit it.
The problem compounds because the network's terms usually allow it to share bid request data with any buyer in the exchange. You might think you're only sharing device type and geography, but the bid request spec supports hundreds of fields. Cookie syncs, device IDs, IP addresses, and behavioural segments all flow through unless you explicitly strip them.
Kindred Group publicly reported £14 million in compliance-team costs in 2023. Most operators don't have Kindred's budget. If you're running compliance lean, the ad network audit tends to fall off the roadmap. The vendors promise they're GDPR-compliant, you assume the contracts are watertight, and the audit never happens.
The Three-Part Audit
The audit doesn't require legal review every time. You need three things: an enumeration of what you're sending, a map of who receives it, and a flag for any buyer with a compliance history.
Part one: enumerate the data fields. Pull the bid request spec from your ad network's documentation. Cross-reference it with your ad server configuration. List every field you're populating. Device ID, geolocation precision, cookie pools, segment IDs, referrer URLs. If you're using a customer data platform to enrich the bid request, add those fields too. The list is usually 15 to 30 fields for a standard programmatic setup.
Part two: map the buyers. Ask your account manager for the list of DSPs and bidders who receive your inventory. Most networks will share this if you frame it as a compliance requirement. Note which buyers operate in jurisdictions with weaker data protection regimes. Note which ones have sub-processors outside the EU. You're building a risk map, not a blocklist.
Part three: check for compliance flags. Run each buyer's name through the ICO enforcement database and the EDPB case tracker. If a buyer has been fined or publicly warned in the past 24 months, flag them. You don't need to drop them immediately, but you need a documented reason for continuing to work with them.
The first audit takes about four hours if you do it manually. After that, it's a one-hour quarterly refresh.
Building the Quarterly Review
Schedule the audit as a recurring calendar item. Assign it to whoever owns the ad ops relationship. The checklist fits on one page:
- Export the current bid request configuration from your ad server.
- Diff it against last quarter's snapshot. Flag any new fields.
- Pull the updated buyer list from your network contact.
- Cross-check new buyers against the ICO and EDPB databases.
- Document any changes in a compliance log.
- If you added new data fields or new high-risk buyers, loop in legal for a 15-minute review.
The review doesn't prevent every scenario. A buyer could start misusing data tomorrow and you won't know until the regulator publishes a case. But the quarterly cadence gives you a defence if the ICO or a plaintiff's lawyer comes knocking. You can show you were actively monitoring vendor behaviour. You can show you removed high-risk buyers when flags appeared. That's the difference between a £26 million settlement and a manageable fine.
Most operators skip this because the immediate ROI is invisible. The Grindr case shows what the cost looks like when you wait for the lawsuit to arrive.