Privacy & Security

The Netherlands' data-protection authority opened a GDPR investigation into Reddit's licensing of user content to AI developers; after Reddit allegedly stopped cooperating, it lost a court challenge in The Hague in early 2026 over the regulator's handling of privileged material.

Alan Bill, a Slovakian national, admitted helping run the Kingdom Market darknet marketplace and creating its promotional forum pages on sites including Reddit and Dread; charged in 2023, he pleaded guilty in 2026 and was sentenced to 200 months in prison.

A January 2026 Reddit post by a supposed food-delivery 'whistleblower' — complete with a fake 18-page document and AI-generated employee badge — drew tens of thousands of upvotes and tens of millions of views before being exposed as AI-fabricated.

On 24 February 2026 the UK Information Commissioner's Office fined Reddit £14.47 million, finding it had processed children's data without effective age assurance and without a data-protection impact assessment for years.

From 10 December 2025 Australia required Reddit and nine other platforms to take reasonable steps to prevent under-16s from holding accounts, backed by penalties up to A$49.5 million and overseen by the eSafety Commissioner.

In September 2025 Reddit joined other publishers backing 'Really Simple Licensing', a standard meant to make AI crawlers pay for content — extending Reddit's effort to monetize user-generated posts as AI training data, and its enforcement war against unpaid scrapers.

Reddit was knocked offline by two major 2025 internet-infrastructure failures: a roughly 15-hour outage on October 20, 2025 caused by an AWS US-East-1 failure, and the November 18, 2025 Cloudflare outage that triggered widespread errors across the web.

In August 2025 Reddit moved to block the Internet Archive's Wayback Machine from archiving anything beyond its homepage, citing AI scrapers exploiting the archive — a step critics warned damages the public record to protect Reddit's data-licensing revenue.

At Cannes Lions in June 2025, Reddit launched AI advertising tools under the 'Reddit Community Intelligence' brand, including features that surface users' own posts beneath brand ads and mine community conversations for marketers, reviving debate over monetizing user-generated content.

On 25 July 2025 Reddit began requiring UK users to verify their age with government ID or a face scan to view adult and other 'mature' content, triggering a backlash over privacy and over-blocking of support communities.

Reddit's own transparency reports document persistent spam and inauthentic-account activity. The problem moved from anonymous spammers to credentialed academics in 2025, when University of Zurich researchers secretly ran AI bots posing as real people in r/changemyview to test machine persuasion without users' consent.

Reddit sued Anthropic in California state court, alleging the AI company scraped Reddit content without a license to train its Claude models despite publicly claiming it had blocked its bots, with crawlers said to have accessed Reddit more than 100,000 times.

In June 2025 Reddit sued Anthropic, alleging it scraped Reddit content over 100,000 times to train Claude without a licence; in 2026 a court remanded the state-law claims back to California state court.

Reddit sued Perplexity AI and three data-scraping intermediaries in federal court, alleging an industrial-scale scheme to harvest Reddit content from Google search results to feed AI products in violation of the DMCA.

In October 2025 Reddit sued Perplexity AI alongside scraping companies Oxylabs, AWMProxy, and SerpApi, alleging an 'industrial-scale' operation to harvest Reddit content from Google results and sell or use it.

A fabricated sexually explicit video of podcast host Bobbi Althoff that went viral on X in February 2024 also spread to Reddit, in an incident driven partly by engagement-farming accounts promising 'leaks.'

Around Taiwan's January 2024 election, Google's threat researchers reported that the pro-Beijing Dragonbridge network flooded platforms — Reddit among them — with pro-PRC and anti-US narratives, including AI-generated material.

Reddit's 'delete' is a soft delete: removed posts and comments vanish from public view but persist in Reddit's systems, in third-party archives that captured them at posting time, and in users' own GDPR data exports — a gap between user expectation and reality that became a documented privacy concern.

A recurring Reddit-specific scam sees criminals impersonate moderators or the 'admin team' via private messages and chat, sending fake 'verification' or 'suspension appeal' links to phishing pages that harvest credentials and 2FA codes for account takeover — and sometimes payment.

Reddit was one of nine companies ordered by the FTC to disclose its data practices for a sweeping 6(b) study; the 2024 staff report found pervasive surveillance of users and weak protections for children and teens across the industry.

As Reddit signed AI data-licensing deals worth over $200 million ahead of its March 2024 IPO, the FTC opened a non-public inquiry into Reddit's sale and licensing of user-generated content to train AI models, amid a broader backlash over monetizing users' posts without compensation or meaningful consent.

Weeks after Reddit's $60M/year data-licensing deal with Google, Google's new AI Overviews feature repackaged satirical and dangerous Reddit posts — telling users to glue cheese to pizza and eat rocks — as authoritative search answers.

By July 2024 Reddit's robots.txt changes had blocked Bing, DuckDuckGo, Mojeek, Qwant and other engines from indexing recent Reddit content, while Google retained access under a reported $60 million annual AI-data deal — making Google effectively the only search engine able to surface fresh Reddit results.

In February 2024, days before its IPO, Reddit signed a content-licensing deal with Google reported at roughly $60 million per year, giving Google access via Reddit's Data API to train AI models on years of user content. The deal drew user unease over consent and triggered an FTC inquiry.

In May 2024 Reddit licensed its user-generated content to OpenAI in a deal reportedly worth tens of millions annually, raising conflict-of-interest concerns because OpenAI CEO Sam Altman was Reddit's third-largest shareholder.

Reddit disclosed in 2024 that it had signed data-licensing deals worth hundreds of millions to let AI firms train on user posts — content created by users who were neither asked for consent nor offered any share of the proceeds.

Texas Attorney General Ken Paxton opened an investigation into Reddit and more than a dozen other companies over compliance with the state's SCOPE Act and data-privacy law, focusing on the collection and targeting of minors' data.

In August 2023 Meta disclosed the largest covert influence operation it had ever found — the China-origin 'Spamouflage' network — and named Reddit among more than 50 platforms where operators seeded pro-Beijing content.

On February 5, 2023, a targeted phishing attack stole an employee's credentials and 2FA token, giving intruders access to internal documents, dashboards, source code, and employee and advertiser data. In June 2023 the BlackCat/ALPHV ransomware group publicly claimed it had taken roughly 80GB of data and demanded a $4.5 million ransom.

In 2023 Reddit terminated Pushshift's bulk data access as part of its paid-API crackdown, breaking the historical archive that powered research and the tools (Reveddit, Removeddit, Unddit) used to view deleted or removed content — reshaping who controls retained Reddit data.

A 2022 BBC Panorama investigation revealed a Reddit subreddit with more than 20,000 members dedicated to trading leaked and non-consensual explicit images of South Asian women, some of whom were blackmailed and harassed.

Security researchers documented that the handwritten verification selfies users post to NSFW subreddits such as r/GoneWild were being scraped and manipulated by fraudsters to defeat identity-verification (KYC) systems and build synthetic identities.

A security researcher earned a $10,000 Reddit bug bounty for an OAuth flaw in Reddit's 'Sign in with Apple' flow that let an attacker hijack the account of any user who used Apple sign-in with a single click, by abusing the OAuth state parameter to steal the victim's authorization code.

The influencer-promoted 'Save the Kids' charity token, exposed as a pump-and-dump, was partly organized through Reddit — where YouTuber Sam Pepper promoted the project, built its moderator team, and reportedly handled the presale.

Reddit hosted active pro-eating-disorder communities such as r/proED; a peer-reviewed longitudinal study using Reddit data found measurable real-world weight loss and shrinking weight goals among participants.

During the January 2021 GameStop squeeze, members of Reddit's r/WallStreetBets directed an off-platform harassment campaign at short-seller Andrew Left of Citron Research, including hacked accounts used to contact his children.

In August 2020 attackers hijacked moderator accounts to deface more than 70 subreddits — including r/space, r/NFL, and r/food — with pro-Trump messaging. Reddit confirmed that none of the compromised accounts had two-factor authentication enabled.

Canada's largest subreddit was accused, with leaked chat logs, of being run by moderators with ties to white-nationalist content — including one who placed a $250 'bounty' on a Vice journalist — while the platform's seniority rules made the implicated moderators effectively impossible to remove.

A whistleblower's October 2018 Reddit post exposed that skincare brand Sunday Riley had its employees write fake Sephora reviews under invented identities — a tip that helped trigger an FTC investigation and settlement over fake-grassroots review fraud.

In January 2019 Reddit locked a large group of accounts after detecting unusual activity it attributed to credential stuffing, forcing affected users to reset passwords. Some users disputed the explanation, suspecting a direct compromise.

Reddit banned one subreddit and 61 accounts after concluding that a cache of leaked US-UK trade documents — weaponized in the 2019 UK general election — was posted as part of a coordinated Russian influence campaign.

In 2019 BuzzFeed News reported that Reddit users were observing apparently coordinated pro-China activity, with new accounts swarming threads on Tiananmen, Huawei, and Falun Gong, amid heightened scrutiny after Tencent's investment.

A 2018 Vice investigation detailed a for-hire Reddit astroturfing operation run by a user called 'Aaron,' who orchestrated paid upvote campaigns and networks of dummy accounts — each on its own proxy IP — to artificially pump cryptocurrency projects on r/CryptoCurrency and beyond.

Between June 14–18, 2018, an attacker intercepted SMS-based two-factor authentication codes for several Reddit employees and used the access to download a complete 2007 site backup containing early users' usernames, salted-and-hashed passwords, email addresses, and all of their public and private content.

In August 2018 Reddit removed roughly 143 accounts linked to an Iran-aligned inauthentic news network exposed as 'Liberty Front Press,' which had seeded Iran-friendly content into political subreddits.

Federal prosecutors convicted four men — Ryan Collins, Edward Majerczyk, George Garofano and Emilio Herrera — for phishing schemes that compromised celebrities' iCloud and Gmail accounts; the stolen nude photos were mass-distributed on Reddit's r/TheFappening in 2014.

In May 2016 an attacker using the handle 'TehBVM' hijacked the moderator accounts behind dozens of large subreddits — including r/pics, r/gameofthrones, and r/books — and defaced them by altering CSS and banners, demonstrating how reused passwords and absent 2FA let one person seize control of major communities.

In May 2016, after the 2012 LinkedIn breach was revealed to have exposed roughly 117 million credentials, Reddit detected a surge in account takeovers driven by password reuse and forced password resets on about 100,000 accounts.

Reddit's 2015 transparency report quietly dropped its 'warrant canary' — a standing statement that it had never received a National Security Letter or other classified surveillance demand. The canary's removal signaled that Reddit had likely been served a secret government request it was legally gagged from disclosing.

Reddit became a primary hub for the 2014 'Fappening' celebrity nude-photo leaks via the r/TheFappening subreddit, removing it only under DMCA and child-imagery pressure; nearly six months later, on February 24, 2015, Reddit announced a privacy-policy change banning the posting of explicit images of anyone without their consent.

Reddit hosted a cluster of communities built around sharing images of women obtained without consent — including r/photoplunder, which scraped private photos from Photobucket, and r/CandidFashionPolice — curbed largely by outside legal pressure rather than Reddit policy.

In December 2014, after the Guardians of Peace breach of Sony Pictures, Redditors used r/SonyGOP to index and link the leaked emails, scripts, salaries, and employee data — until Reddit removed the subreddit and banned its lone moderator following DMCA pressure from Sony.

Moderators of r/technology, then a Reddit default subreddit, were exposed in April 2014 for secretly using AutoModerator to delete any submission whose title contained ~50 banned keywords including 'NSA', 'Snowden', 'Bitcoin', and 'net neutrality'. Reddit removed the subreddit from its default list in response.