I hacked a dating app (and how not to treat a security researcher)

There's no penalty for failing at privacy and security so companies would rather play the odds that they will be fine than invest in proper practices. Alex says Cerca is being misleading when it comes to encryption but it seems to me they are outright lying and will likely face no consequences for it. In a more just world, this would trigger so many regulatory and compliance audits.

> There's no penalty for failing at privacy and security

I wouldn't say there's no penalty (they might have to pay for a year of identity theft protection or a fine).

I agree that the consequences are not in line with the damage to the public or customer base.

The GDPR allows for huge fines, so for companies operating in Europe there is an incentive to take privacy and security seriously.

> Alex says Cerca is being misleading when it comes to encryption but it seems to me they are outright lying and will likely face no consequences for it.

Trasmitting information via HTTPS is usually enough to say your app uses "encryption and other industry-standard measures to protect your data."

Namely, up to 20 million EUR or 4% of the previous year's revenue, whichever is larger.