0 Concern3 Mixed1 Positive
C+60 / 100
In Plain English
Reddit collects your behaviour, device data, and inferences about your demographics, and shares some of it with ad-tech partners — but it explicitly doesn't sell your personal data, deletes IP addresses after 100 days, doesn't track precise location, and extends privacy rights to all users worldwide, not just those in regulated regions.
Category Breakdown
Known data breaches
No known public data breaches
Reddit does not appear in the Have I Been Pwned database of publicly disclosed data breaches.
How Reddit could earn a higher grade
Recommended changes
- Publish a specific list of advertising and analytics partners who receive behavioural data, rather than a generic 'service providers' reference.
- Stop using inferred demographic data (age, gender, interests) for ad targeting without explicit user consent.
- Extend the 100-day IP address deletion policy to all log data — many server logs are retained indefinitely.
- Provide a genuine opt-out from Reddit's 'contextual advertising' data model, not just personalised ads.
- Publish a transparency report that includes data requests from civil litigants (not just government), which are a significant source of user data exposure.