VOL. I  ·  EST. 2026  ·  "WE READ THE FINE PRINT SO YOU DON'T HAVE TO"
D+
Verdict
EXHIBIT A

Reddit.

"your posts are the product — literally, we license them."

Reddit built its empire on user-generated content, and now it's selling that content to AI companies for over $200 million in licensing deals with Google, OpenAI, and others §1. The FTC opened an inquiry into these deals in March 2024 §2, but Reddit pressed ahead — data licensing generated $130 million in 2024 alone, roughly 10% of total revenue §1. In September 2023, Reddit removed the ability to opt out of ad personalization based on your activity §3, consolidating two separate toggles into one and eliminating user choice for most of the world. The policy claims "we don't sell your personal data to third parties," but your posts, comments, and votes are being packaged and sold to train AI models that will regurgitate your words without credit or compensation. On the positive side, Reddit doesn't require a real name, deletes IP addresses after 100 days §4, and lets you browse without an account. But the UK's ICO hit Reddit with a £14.47 million fine in February 2026 for failing to protect children's data — they had no age verification until July 2025 and never ran a data protection impact assessment §5. The 2023 phishing breach exposed 80GB of internal data to the BlackCat ransomware gang §6. Reddit says "privacy is a right," but when your 20-year archive becomes the most-cited source in AI models §1, that right starts looking more like a revenue stream.

Social media / online forums
Analyzed: 2026-06-14
§2 · The short version

TL;DR — 8 answers.

The eight things you actually want to know, at a glance.

TL;DR — 8 answers D+
YES Do they sell your data?
YES Are they tracking you on other sites?
YES Can your data train their AI?
~ Who can see what you do?
NO Can you delete everything?
~ Do they honor your opt-out?
~ Special handling for minors?
YES Been fined for this before?
§3 · The details

The questions, answered.

No legalese. Every answer the way your most cynical friend would put it.

YES
§1

Do they sell your data?

Reddit says it doesn't "sell personal data to third parties, including data brokers." But it licenses your public content — posts, comments, votes — to Google ($60M/yr) and OpenAI (~$70M/yr) for AI training, generating $130 million in 2024 [[S1]]. Whether you call that "selling" or "licensing," your words are the product.

YES
§7

Are they tracking you on other sites?

Reddit receives data from third-party integrations and advertisers, including via Reddit Embeds on other sites, its advertising SDK, and audience measurement partners. If an advertiser uses Reddit's ad technology, Reddit gets information about what you do on the advertiser's site or app [[S7]].

YES
§1

Can your data train their AI?

Absolutely, and they're getting paid for it. Reddit has signed licensing deals worth $203 million with Google and OpenAI to let them train AI models on Reddit's 20-year archive of user content [[S1]]. Reddit is now the most-cited source in AI models — three times more than Wikipedia. There is no opt-out for having your public posts used this way.

COND.
§4

Who can see what you do?

Public posts and comments: everyone, including search engines, AI chatbots like ChatGPT, and anyone with API access [[S4]]. Private messages and chats are not public. Your profile, karma, communities, and activity are all visible. Reddit also shares data with LLM providers to compile and summarize public content.

NO
§4

Can you delete everything?

You can delete your account, but posts and comments remain visible unless you individually delete each one first [[S4]]. And content already licensed to AI companies? Already in the training data — deletion doesn't unwind that. Reddit also retains some data after deletion for legal and security purposes.

COND.
§3

Do they honor your opt-out?

In September 2023, Reddit removed the ability to opt out of ad personalization based on your on-platform activity for most users [[S3]]. Opt-out controls remain in "select countries" (likely EU/GDPR regions). GPC is honored only in some jurisdictions — the policy says "if you have an account and visit our site with an opt-out preference signal, we will treat that as an opt-out request" but only in some jurisdictions [[S4]]. DNT is explicitly ignored.

COND.
§5

Special handling for minors?

Reddit's terms require users to be 13+, but until July 2025 there was no age verification at all — just a self-declaration [[S5]]. The UK ICO fined them £14.47 million in February 2026 for processing children's data without a lawful basis. Reddit says it doesn't knowingly sell/share data of users under 16, but the enforcement history suggests the protections came too late.

YES
§5

Been fined for this before?

£14.47 million (UK ICO, February 2026) for unlawfully processing children's personal data and failing to implement age verification [[S5]]. The FTC also opened an inquiry in March 2024 into Reddit's AI data licensing practices [[S2]]. In 2023, the BlackCat ransomware gang stole 80GB of data after a phishing attack and demanded $4.5 million [[S6]].

§3 · The privacy card

At a glance, honestly.

Eight signals, color-coded. Like a model card for a machine — except the machine is reading your data.

Privacy Card · Reddit · Analyzed 2026-06-14
D+
Data sold / shared YES BAD
Cross-site tracking YES BAD
AI training YES opt-out: unavailable
Deletion right LIMIT. MIXED
GPC honored NO BAD
Keeps forever? YES BAD
Child protections COND. MIXED
Automated decisions YES human review: no
Collects
Account data, Public content, Non-public content, Activity & behavior, Device & network +3 more
Shares with
Google (AI training license, $60M/yr), OpenAI (AI training license, ~$70M/yr), Advertisers and ad-tech partners, Audience measurement providers (Nielsen, Quantcast) +2 more
§5 · The label they should have shown you

The Privacy Label, honestly.

An Apple-style label for what's collected and a Cranor-style back-of-pack for what they do with it. Every cell links to the exact line in their policy.

REDDIT — DATA COLLECTED
PER APPLE PRIVACY-LABEL TAXONOMY ↗
USED TO TRACK YOU
Data shared with third parties for cross-property tracking.
Public content §4
Posts · Comments · Chat messages · Images · Videos · Audio · Links
Activity & behavior §4
Votes (up/down) · Saves · Hides · Reports · Following · Blocking · Community subscriptions · Search terms · Pages visited
Device & network §4
IP address · User-agent string · Browser type · OS · Device IDs · Mobile carrier · Referral URLs
Cookies & tracking §7
First-party cookies · Third-party cookies · Advertising pixels · Audience measurement
Inferred data §4
Age range · Gender · Preferred language · Interests
Third-party data §4
Demographic info from advertisers · Hashed email from ad partners · App store age range (iOS/Android)
◐ LINKED TO YOU
Tied to your identity and stored against your account.
Account data §4
Username · Email address · Phone number · Password · Interests · Bio · Gender · Birthday · Location · Profile picture
Non-public content §4
Private messages · Private chats · Modmail · Drafts · Reports · Survey responses
○ NOT LINKED TO YOU
Aggregated, supposedly anonymous.
Other Data
— none claimed —
↓ BACK OF LABEL · WHAT THEY DO WITH IT (CRANOR FRAMEWORK)
Purposes
Providing and improving the platform, Personalized advertising (activity-based, opt-out removed for most users), Licensing user content to AI companies (Google, OpenAI) for model training, Audience measurement and ad effectiveness tracking, Age-appropriate content and safety enforcement, Research and developing new services. §4
6+ stated purposes. The interesting ones are buried in §7.
Sold or shared?
Yes. Google (AI training license, $60M/yr), OpenAI (AI training license, ~$70M/yr), Advertisers and ad-tech partners, Audience measurement providers (Nielsen, Quantcast), Service providers (Stripe, cloud, LLM providers), Law enforcement (with legal process). §1
"We don't sell data" is technically true and substantively false.
Retention
Indefinite, with caveats. §4
Data stored 'as long as necessary for the purpose.' IP addresses deleted after 100 days (except the one used to create account). Account deletion removes profile but posts/comments remain visible unless individually deleted first. Some data retained after deletion for legal, security, and anti-abuse purposes.
User controls
Deletion: Limited · Opt-out: Limited §4
Delete works. Opting out of inference does not exist.
Honors GPC?
No. §4
Global Privacy Control browser signal: ignored.
Automated decisions
Yes. No human review. §4
Feed ranking and content recommendations · Ad personalization and targeting · Spam detection and content moderation · Age-range inference · Interest inference for ad targeting. All algorithmic.
AI training on your data
Yes. No opt-out. §1
Your public posts/photos train commercial models.
Children's data
Under 13 blocked · 13–17 limited §8
Ad targeting paused for teens, but content profile still kept.
Breach disclosure
"As required by law." §15.3
Translation: the bare minimum legal window in your jurisdiction.
§5 · The receipts

The receipts, translated.

Five of the worst clauses, lifted verbatim. Strikethroughs are theirs. Marginalia is ours.

REDDIT PRIVACY POLICY · INTRODUCTION / TL;DR §4
We don't sell your personal data to third parties, including data brokers. ↑ but they license your public posts to Google and OpenAI for $200M+. whether that counts as 'selling' is left as an exercise for the reader.
TECHNICALLY TRUE™
REDDIT PRIVACY POLICY · HOW WE SHARE YOUR INFORMATION §4
LLM providers who help us compile and summarize public content for relevant search results on Reddit. ↑ this is the disclosure for AI training. it's buried in a list of 'service providers.'
BURIED
REDDIT PRIVACY POLICY · REDDIT IS A PUBLIC PLATFORM §4
That content and information may also be available in search results on internet search engines like Google or in responses provided by an AI chatbot like OpenAI's ChatGPT as well as reshared by others without permission or where Reddit has no control. ↑ your posts are training data for ChatGPT and they're telling you it's your problem.
YOUR PROBLEM
TECHCRUNCH · SEPTEMBER 28, 2023 §3
Reddit is removing the ability to opt out of ad personalization based on your activity on the platform. ↑ not making it harder. removing it entirely.
OPT-OUT DELETED
UK ICO · 24 FEBRUARY 2026 §5
Reddit did not have measures in place to check the age of users accessing its platform until July 2025. Reddit had not carried out a data protection impact assessment to evaluate and mitigate risks to children's data protection rights prior to January 2025. ↑ £14.47M fine. 18 years of operation with no age checks.
£14.47M
§6 · The deceptive design

Dark patterns spotted.

Tricks the policy and surrounding UX use to make you "consent" without really consenting.

01
Opt-out elimination (not buried — deleted)
§3
In September 2023, Reddit removed the ability to opt out of ad personalization based on on-platform activity for most users worldwide. Rather than making the opt-out harder to find, they eliminated the option entirely, keeping it only in 'select countries' (likely EU/GDPR regions).
"Reddit is removing the ability to opt out of ad personalization based on your activity on the platform.
02
Content licensing without user consent or compensation
§1
Reddit licenses 20 years of user-generated content to AI companies for $200M+ without obtaining consent from the users who created that content, and without offering any compensation. The policy buries the disclosure as 'LLM providers who help us compile and summarize public content.'
"LLM providers who help us compile and summarize public content for relevant search results on Reddit.
03
Redefining 'sell' to exclude AI licensing
§4
The policy prominently states 'We don't sell your personal data to third parties' while simultaneously licensing public user content (posts, comments, votes) to Google and OpenAI for over $200 million. The word 'personal' is used to technically distinguish between 'personal data' and 'public content you submitted' — content that only exists because users created it.
"We don't sell your personal data to third parties, including data brokers.
04
Account deletion doesn't delete content
§4
Deleting your Reddit account disassociates your profile but leaves all your posts, comments, and messages visible. You must individually delete each piece of content before deleting your account — there is no bulk-delete option through the standard interface.
"The posts, comments, and messages you submitted prior to deleting your account will still be visible to others unless you first delete the specific content.
05
Do Not Track explicitly ignored
§4
The policy explicitly states that Reddit does not respond to the Do Not Track browser signal, despite it being a widely recognized privacy preference.
"There is no accepted standard for how a site should respond to this signal, and we do not take any action in response to this signal.
§7 · What you can actually do

Your rights, by where you live.

Same company, wildly different rights depending on your jurisdiction. Direct links to the specific opt-out / delete / access flows.

EU / EEA / UK / Switzerland (GDPR)
DIFFICULTY: MEDIUM
  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to data portability
  • Right to restrict processing
  • Right to object to processing
  • Right to withdraw consent
  • Right to lodge complaint with supervisory authority
REQUEST →

Source: §4

California (CCPA/CPRA)
DIFFICULTY: MEDIUM
  • Right to know
  • Right to delete
  • Right to correct
  • Right to opt-out of sale/sharing
  • Right to limit use of sensitive info
  • Right to non-discrimination
REQUEST →

Source: §4

Brazil (LGPD)
DIFFICULTY: MEDIUM
  • Confirmation of processing
  • Access
  • Correction
  • Anonymization/blocking/erasure
  • Deletion of consent-based data
  • Portability
  • Info on sharing
  • Withdraw consent
  • Review of automated decisions
REQUEST →

Source: §4

Default (rest of world)
DIFFICULTY: HARD
  • Access and download your data
  • Account deletion
  • Control linked services
  • Opt out of promotional emails
  • Cookie preferences (limited)
REQUEST →

Source: §4

§8 · Receipts

The actual sources.

Every claim above is anchored to a line in the policy we analyzed. Click any section ID to view it in context.

ANALYZED BY: claude-opus-4-6  ·  PROMPT VERSION: honest-policy-v1.3  ·  ANALYZED AT: 2026-06-14T00:00Z
SOURCE: https://www.reddit.com/policies/privacy-policy  ·  POLICY VERSION: 2026-05-26  ·  SNAPSHOT HASH: manual-pdf
  • §1
    Reddit AI data licensing deals (Google, OpenAI) — Columbia Journalism Review / multiple sources
    "Reddit's 20-year warehouse of user-generated content has positioned it as the most cited domain for AI training. Data licensing generated $130 million in 2024 — roughly 10% of total revenue. Reddit disclosed licensing agreements with Google and OpenAI worth $203 million."
  • §2
    FTC inquiry into Reddit's AI data licensing practices (March 2024)
    "Reddit disclosed in an SEC filing that it had received a letter from the FTC advising that the FTC's staff was conducting a non-public inquiry focused on the company's sale, licensing, or sharing of user-generated content with third parties to train AI models."
  • §3
    TechCrunch — Reddit removing ad personalization opt-out (September 28, 2023)
    "Reddit is removing the ability to opt out of ad personalization based on your activity on the platform. The company said it would still have opt-out controls in 'select countries' without specifying which ones."
  • §4
    Reddit Privacy Policy (effective July 1, 2026; last revised May 26, 2026)
    "We don't sell your personal data to third parties, including data brokers. ... LLM providers who help us compile and summarize public content for relevant search results on Reddit."
  • §5
    UK ICO — £14.47M fine against Reddit for children's privacy failures (24 February 2026)
    "The ICO fined Reddit £14.47m for unlawfully processing the personal data of under-13s and failing to implement effective age verification measures. Reddit did not have measures in place to check the age of users accessing its platform until July 2025."
  • §6
    Reddit February 2023 data breach — phishing attack / BlackCat ransomware (Huntress / TechCrunch)
    "The breach exposed internal documents, code, and limited advertiser information. The BlackCat ransomware gang demanded a ransom of $4.5 million after stealing 80GB of data through a phishing attack that compromised an employee's credentials."
  • §7
    Reddit Privacy Policy — Cookies, integrations, and audience measurement
    "If an advertiser incorporates Reddit's ad technology, Reddit may receive limited information about your activity on the advertiser's site or app, such as whether you bought something from the advertiser. We partner with service providers that perform audience measurement to learn demographic information about the population that uses Reddit."
Flag an issue

Reddit · Grade D+

Spotted an error or outdated info? Let us know — we'll review it.

How accurate is this analysis?
Report a shady policy

Know a privacy policy that deserves the treatment? Two ways to tell us:

Option A — Email us

Drop us a line with the company name and policy URL.

✉ report-shady-policies@honestprivacypolicies.org
or
Option B — Quick form