Common Sense Privacy Evaluation for Reddit
privacy.commonsense.org
Warning Full evaluation: Applications and services with a Warning rating do not meet our recommendations for privacy and security practices. Applications and services with a Warning rating have issues narrowly focused around data use related to creating profiles that are not associated with any educational purpose, selling data, and/or using data to target advertisements.

For comparison

Facebook’s evaluation
Tiktok’s
Snapchat’s
Instagram

Evaluation contents for Reddit:

Score: 52% Warning
Methodology

Overview

Reddit is a popular platform that enables users to post, ask questions, and discuss anything. The terms provide that information posted by users is generally publicly accessible by anyone, even those without a Reddit account. The Privacy Policy clearly discloses the categories of personal information collected, including email addresses, IP addresses, and cookie information. While the Privacy Policy states that Reddit shares personal information with third parties, it does not state what information is shared. The terms clearly state that personalized advertisements are displayed to Reddit’s users. The Privacy Policy fails to address whether third parties are required to provide the same level of security protections as Reddit when processing and storing users’ personal information. The terms state that no one under the age of 13 is allowed to use Reddit’s services.

Reddit can be accessed through its website, and is available for download at the iOS App Store, and the Google Play Store. The Privacy Policy and User Agreement used for this evaluation can be found on Reddit’s website, iOS App Store, and the Google Play Store. Additionally, other policies used for this evaluation include: Content Policy. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Safety

The terms provide that “much of the information on the Services is public and accessible to everyone, even without an account. By using the Services, you are directing us to share this information publicly and freely.” While, the terms further state that Reddit has no obligation to screen, edit, or monitor user content, the User Agreements allows “Moderators” to voluntarily monitor user posts of specific groups. Likewise, Reddit provides the Moderator Guidelines for Healthy Communities as a recommended list of objectives to follow as a Moderator. The terms do not clearly state whether users can control how their personal information is displayed to others. Privacy

The Privacy Policy discloses that Reddit collects personal information including names, email addresses, IP addresses, and location. Furthermore, the Privacy Policy states that Reddit automatically collects usage and behavioral activity. The terms do not clearly indicate whether the company limits the collection to only information that is specifically required for Reddit’s Services. The Privacy Policy includes a clear section disclosing the personal information collected by third parties, including information collected by Embedded Third Party content, Advertisers and Potential Advertisers, and Linked services. The Privacy Policy fails to disclose what personal information is shared with third parties but states that Reddit does not sell personal information to third parties. The Privacy Policy clearly indicates Reddit’s purpose for sharing users’ personal information with third parties. The Privacy Policy discloses that third party cookies may use information collected from cookies to build a profile of users’ interests and deliver advertising to the user on other sites.

The Privacy Policy states that a user can manage and control certain choices with regard to third party advertising and analytics, and further discloses that the user can generally opt out of receiving personalized advertisements from certain third-party advertisers and ad networks.

Security

The Privacy Policy provides that Reddit implements reasonable security measures to protect users’ confidentiality. The Privacy Policy provides users a method for enabling two-factor authentication. The Privacy Policy fails to address whether Reddit encrypts all user data while in storage. The terms state that before Reddit processes a privacy rights request concerning a users’ personal information, that Reddit must verify the request with access to the users’ Reddit account or to a verified email address associated with the Reddit Account.

Compliance

The terms state that the users can create and upload content to Reddit. The Privacy Policy provides that users may designate an authorized agent to exercise privacy rights on behalf of the user. The Privacy Policy provides users with the privacy rights of: accessing and changing personal information, delete personal information, and delete the user’s account. The Privacy Policy does not address whether users can download or export their personal information. While the terms state that no one under the age of 13 may use Reddit’s services, the terms fail to provide whether Reddit knows it collects information from children under the age of 13, or whether Reddit deletes personal information from children under the age of 13 if collected without parental consent.

  • pizzaboi@lemm.eeEnglish
    5·
    1 year ago

    I use the DuckDuckGo app’s app tracker blocker feature, and the Reddit app (yes, I used it for a while) was almost always at the top of the list. I’m talking thousands of tracking attempts per day when I used the app for less than an hour a day.

  • RandomDude@lemmy.caEnglish
    3·
    1 year ago

    My adblocker keeps tabs of how many trackers it blocked and Reddit was always the highest culprit of trackers. This doesn’t surprise me, but I do not have/use facebook,snapchat,tiktok or instagram to compare it to.

  • JoeKrogan@lemmy.worldEnglish
    3·
    1 year ago

    And there are people on r/privacy saying here is bad for privacy. They don’t understand. There are no trackers, ads or analytics here… We can verify this, look at brave shields, adguard home or pihole or ublock.

    You can look at the network requests and the source code. It is user run vs corporate run. There is no board or shareholders to answer to.

    The network is more resilient to shutdowns and a server going down won’t take the whole network offline as the content can be distributed across instances.

    You also have FOSS apps to access the service too.

    You can be as anonymous as you want. Don’t post real info and use tor or a VPN if desired but personally I trust the instance operators far more than I trust reddit, conde nast and whoever else they are in bed with.

    On reddit they equate the federating of your posts here as anti privacy. When you post to reddit its shared with the internet and uneddit, google and whoever is training LLMs on the reddit data.

    It goes back to the old days of don’t put out what you don’t want people to know.

    Sure it has its own problems but we will figure them out in time. Its early days