Dating Apps Can Leak Your Location. Researchers Showed How

Most location-based dating apps use your phone’s GPS to work out exactly where you are. They have to: it is how they find people nearby. What they show those people is meant to be vague — a distance, a city, an area.

In August 2024, researchers from KU Leuven in Belgium showed at the USENIX Security Symposium how thin that vagueness can be. Six of the 15 popular apps they tested could be made to reveal a user’s near-exact location — down to 2 metres on apps including Bumble and Hinge, TechCrunch reported. Most say they have closed the gap. But it was not the first leak of its kind, and your photos can give you away in a way no app setting fixes.

The privacy policies are plain about the first half. Tinder and Hinge collect your latitude and longitude if you allow it; Bumble says it can also use nearby Wi-Fi access points. What other people see is much vaguer:

The grid and the hidden distances come from KU Leuven’s tests of January 2023 app versions. Only one app, Tantan, still sent another user’s exact coordinates, and only to a new match at the moment of matching. Everything else ran on distances, which sounds safe until you recall how GPS works: distances from three known points fix a position.

Trilateration leaks in dating apps have been described for about a decade, so most apps now protect the distances they show. The KU Leuven paper, “Swipe Left for Identity Theft”, tested three ways around those defences. One uses a precise distance. One recovers the precise figure from the point where a rounded number changes. The third, which the researchers call oracle trilateration, uses the distance filter that limits your matches to a chosen radius: if the filter checks exact positions, its yes-or-no answer gives away an exact distance, even when the app never displays one.

Two details matter. Hiding your distance was not a reliable shield: Hinge and Hily hid distances on screen while their filters leaked them, and on Grindr the researchers could infer a hidden distance. And no servers were hacked. The team says it used only the apps’ built-in functions and profiles it had created itself.

Ten of the 15 vendors acknowledged the report straight away, and two more after five months. KU Leuven’s summary says most apps “quickly made the necessary adaptations to stop these leaks, including the leak of exact user locations.” Grindr is the exception worth knowing: it rounds coordinates to three decimal places, which the researchers judged too precise for rural or suburban areas, where few people share one 111-metre square.

Robert Heaton, who reported the 2021 Bumble flaw, and the KU Leuven team recommend the same cure, the one Tinder’s grid applies: blur a location before calculating any distance from it.

Metadata is the easy part. When the KU Leuven team uploaded a photo carrying EXIF data to each app, 14 of the 15 stripped it. MeetMe was the exception: its photos kept the original metadata, which can show when and where a picture was taken. That fits the rule that publishing platforms usually strip metadata, but a rule is not a promise, and metadata that survives can expose a home.

Stripping metadata does nothing about what the camera saw. Location can be recovered from the picture itself, and reading a place from its clues is a skill with a checklist. Bumble’s safety advice puts it plainly: leave out photos “that show you in a specific location you frequent”, such as your go-to dog park or local bar. Before you upload, check each photo for:

• The view from home. A skyline, a landmark or the building opposite can place a window or balcony.
• Your street. House numbers, street signs, shopfronts and your car’s number plate.
• Your workplace. Logos, uniforms and name badges. Bumble suggests listing a job as “account manager” at “tech company” rather than naming the firm.
• Your routine. The gym, café or park you visit every week — the kind of detail Tinder says to keep from people you don’t know.
• Your children. Tinder advises parents against sharing images of their children or where they go to school.
• Photos you use elsewhere. A picture that is also on your Instagram or LinkedIn can be matched by reverse image search, linking the profile to your name.

AI geolocation now reads clues like these automatically, which also means you can check your own photos first. GeoSpy estimates the city and country from what is visible in the frame and does not store uploaded photos. On the web, photo analysis comes with a GeoSpy Premium subscription: 7.99 US dollars a week or 29.99 US dollars a year, renewing until you cancel. The result is a city-level estimate, never an address, but a photo that reveals your city to a model reveals more to someone who knows your streets.

• Tinder: never share your home or work address or your daily routine with people you don’t know, and keep chats on Tinder at first. On the date, meet in public, tell a friend your plans, consider sharing your location with someone you trust, and control your transport.
• Bumble: keep profile details general, leave out photos of places you go regularly, ask a match to verify their photo and try an in-app video call first. Meet somewhere public, such as a coffee shop, and tell someone close to you who you are meeting, where and when.
• Hinge: hold the first few meet-ups in an active public place, never at either person’s home. Tell friends and family your plans, control your transport and trust your gut: a bartender or server can help.

1. Step 1Share an approximate locationOn iPhone, go to Settings → Privacy & Security → Location Services, tap the app and turn off Precise Location. On Android, go to Settings → Location → App location permissions, tap the app and turn off Use precise location, which leaves an area of about 3 square kilometres. If the app still works, even a leak can only reveal that rough area.
2. Step 2Allow location only while you use the appChoose While Using the App or Ask Next Time Or When I Share on iPhone, and Allow only while using the app or Ask every time on Android. The KU Leuven researchers suggest making a dating app ask for your location each time you open it.
3. Step 3Hide your distance, but don’t rely on itSwitch it on where offered, such as Tinder’s “Don’t show my distance” for subscribers. Treat it as a curtain, not a lock: in the 2023 tests, Hinge and Hily hid distances on screen while their filters leaked them.
4. Step 4Choose photos that don’t place youSkip photos taken at home, at work or at places you visit every week, and check backgrounds for street names, signs and number plates. Use pictures that are not on your other public accounts, and strip the metadata from photos you share elsewhere.
5. Step 5Keep profile details generalName your job, not your employer. As the KU Leuven researchers put it, what you can see on other users’ profiles is what they can see on yours.
6. Step 6Meet on your own termsVideo call first, meet in a busy public place, tell someone your plans and get yourself there and back, so your date never needs your address. If the call moves to WhatsApp, turn on Protect IP address in calls first: a direct call can show your match your IP address and, with it, your rough location. If a match seems to know where you live and you never told them, block and report them in the app, and contact the police if you feel unsafe.