Sharing our Public Content Policy and a New Subreddit for Researchers

[u/traceroo]

TL;DR (this is a lengthy post, but stay with us until the end: as a lawyer, I am not allowed to be brief):

We are, unfortunately, seeing more and more commercial entities collecting public data, including Reddit content, in bulk with no regard for user rights or privacy. We believe in preserving public access to Reddit content, but in distributing Reddit content, we need to work with trusted partners that will agree in writing to reasonable protections for redditors. They should respect user decisions to delete their content as well as anything Reddit removes for violating our Content Policy, and they cannot abuse their access by using Reddit content to identify or surveil users.

In line with this, and to be more transparent about how we protect data on Reddit, today we published our Public Content Policy, which outlines how we manage access to public content on our platform at scale.

At the same time, we continue to believe in supporting public access to Reddit content for researchers and those who believe in responsible non-commercial use of public data. This is why we’re building new tools for researchers and introducing a new subreddit, r/reddit4researchers. Our goal is for this sub to evolve into a place to better support researchers and academics and improve their access to Reddit data.

Hi, redditors - I’m u/Traceroo, Reddit’s Chief Legal Officer, and today I’m sharing more about how we protect content on Reddit.

Our Public Content Policy

Reddit is an inherently public platform, and we want to keep it that way. Although we’ve shared our POV before, we’re publishing this policy to give you all (whether you are a redditor, moderator, researcher, or developer) a better sense of how we think about access to public content and the protections that should exist for users against misuse of public content.

This is distinct from our Privacy Policy, which covers how we handle the minimal private/personal information users provide to us (such as email). It’s not our Content Policy, which sets out our rules for what content and behavior is allowed on the platform.

What we consider public content on Reddit

Public content includes all of the content – like posts and comments, usernames and profiles, public karma scores, etc. (for a longer list, you can check out our public API) – that Reddit distributes and makes publicly available to redditors, visitors who use the service, and developers, e.g. to be extra clear, it doesn’t include stuff we don’t make public, such as private messages or mod mail, or non-public account information, such as email address, browsing history, IP address, etc. (this is stuff we don’t and would never license or distribute, because we believe Privacy is a Right).

Preventing the misuse and abuse of public content

Unfortunately, we see more and more commercial entities using unauthorized access or misusing authorized access to collect public data in bulk, including Reddit public content. Worse, these entities perceive they have no limitation on their usage of that data, and they do so with no regard for user rights or privacy, ignoring reasonable legal, safety, and user removal requests. While we will continue our efforts to block known bad actors, we can’t continue to assume good intentions. We need to do more to restrict access to Reddit public content at scale to trusted actors who have agreed to abide by our policies. But we also need to continue to ensure that users, mods, researchers, and other good-faith, non-commercial actors have access.

The policy, at-a-glance

Our policy outlines the information partners can access via any public-content licensing agreements. It also outlines the commitments we make to users about usage of this content, explaining how:

• We require our partners to uphold the privacy of redditors and their communities. This includes respecting users’ decisions to delete their content and any content we remove for violating our Content Policy.
• Partners are not allowed to use content to identify individuals or their personal information, including for ad targeting purposes.
• Partners cannot use Reddit content to spam or harass redditors.
• Partners are not allowed to use Reddit content to conduct background checks, facial recognition, government surveillance, or help law enforcement do any of the above.
• Partners cannot access public content that includes adult media.
• And, as always, we don’t sell the personal information of redditors.

What’s a policy without enforcement?

Anyone accessing Reddit content must abide by our policies, and we are selective about who we work with and trust with large-scale access to Reddit content. We will block access to those that don’t agree to our policies, and we will continue to enhance our capabilities to hunt down and catch bad actors. We don’t want to but, if necessary, we’ll also take legal action.

What changes for me as a user?

Nothing changes for redditors. You can continue using Reddit logged in, logged out, on mobile, etc.

What do users get out of these agreements?

Users get protections against misuse of public content. Also, commercial agreements allow us to invest more in making Reddit better as a platform and product.

Who can access public content on Reddit?

In addition to those we have agreements with, Reddit Data API access remains free for non-commercial researchers and academics under our published usage threshold. It also remains accessible for organizations like the Internet Archive.

Reddit for Research

It’s important to us that we continue to preserve public access to Reddit content for researchers and those who believe in responsible non-commercial use of public data. We believe in and recognize the value that public Reddit content provides to researchers and academics. Academics contribute meaningful and important research that helps shape our understanding of how people interact online. To continue studying the impacts of how behavioral patterns evolve online, access to public data is essential.

That’s why we’re building tools and an environment to help researchers access Reddit content. If you're an academic or researcher, and interested in learning more, head over to r/reddit4researchers and check out u/KeyserSosa’s first post.

Thank you to the users and mods who gave us feedback in developing this Public Content Policy, including u/abrownn, u/AkaashMaharaj, u/Full_Stall_Indicator, u/Georgy_K_Zhukov, u/Khyta,  u/Kindapuffy, u/lil_spazjoekp, u/Pedantichrist, u/shiruken, u/SQLwitch, and u/yellowmix, among others.

EDIT: Formatting and fighting markdown.

[u/N1ghtshade3]

Can you explain what's meant when you say partners have to respect user decisions to delete their content? Like, suppose they've bulk downloaded a bunch of info containing my posts. How would they ever know if I deleted my Reddit account later?

[u/traceroo → u/N1ghtshade3]

For those that do legitimate bulk download of Reddit content, we provide a compliance API that notifies them when content is deleted by users. See https://support.reddithelp.com/hc/en-us/articles/26417433892756-Do-Reddit-s-data-licensees-have-to-stop-using-data-deleted-from-Reddit.

[u/kerovon]

So if I am reading this right, reddit will still bundle and sell bulk user data, but there will at least be some privacy restrictions and respect for EU and California privacy laws. What is changing is that random groups that may or may not care about all of the laws will not be allowed to scrape and sell Reddit data.

I am glad that researchers will still be supported though. There actually is valid research that is done, and supporting that is valuable.

Of course, reddit bulk user data will only be valuable for another year or two, and then chatgpt bots will have so thoroughly polluted it that it becomes more or less worthless.

[u/shiruken → u/kerovon]

What is changing is that random groups that may or may not care about all of the laws will not be allowed to scrape and sell Reddit data.

The ultimate question is what will Reddit, Inc. do about these non-partner groups that are violating the policy? Should we expect Reddit to start filing lawsuits?

[u/traceroo → u/shiruken]

For those who we find are violating the privacy of redditors, we have a number of different ways to respond. Our options range from asking you nicely to knock it off to more aggressive actions. It’s always great when the former works promptly.

[u/SarahAGilbert]

Hi traceroo,

First off, I just want to say how happy I am to see a public data policy, particularly one that forefronts user privacy (unlike some other platforms *cough cough*). I know this is something you all have been thinking about for a while, but given that one of Reddit's key assets right now is its data, making those internal policies and values public is even more important now than ever.

I have a couple of questions about details:

1. Does Reddit consider moderated data public or private? On the one hand, it's not visible in the communities its moderated from, but on the other, it's still visible on users' profile pages. For what it's worth, I see pros and cons to classifying it as either/or. Some pros: moderated data is an important data source for understanding, well, lots of questions about content moderation and training AI assisted moderation tools. Some cons: it might feel more private to users/mods, it might inadvertently put mods at risk (especially in communities with small moderation teams), it be used to train shitty moderation AIs, or be used to develop bots/tools to subvert moderation.

2. Are there plans for added transparency about who's licensing Reddit data and/or who's violated the policy? Obviously the google deal is very public, but I can imagine lots of smaller deals that wouldn't make the news.

[u/traceroo → u/SarahAGilbert]

Thanks SarahAGilbert!  Great questions. 

As to (1), this is another reason we want to understand what third parties are doing with publicly-accessible content. Removed content can be particularly useful in helping create powerful tools for moderation teams. But there are nuances here that those with experience moderating communities would appreciate, and it is still paramount that the developer respect the privacy expectations of redditors.

As to (2), that is definitely something we are pondering. We prefer convincing third parties that our policies make sense, but sometimes conversation is not enough unfortunately. 

[u/Ghigs]

Tools to access deleted posts are crucial to modding.  Banning such tools will cripple us.

[u/traceroo → u/Ghigs]

We totally understand, and we are working on approaches that protect redditors’ privacy while allowing the proper investigation of bad actors.

[u/Full_Stall_Indicator]

Thanks for working to protect Redditors and for seeking out user/mod feedback as part of the process!

If you’re reading this and are interested in giving Reddit feedback on various aspects of the platform, consider joining one of Reddit’s collaborative programs. Check out the User Feedback Collective and the Mod Council. 🎉

Edit: fixed a typo

[u/traceroo → u/Full_Stall_Indicator]

Thanks for the shoutout of these great programs! We’re always looking to source and incorporate candid, constructive feedback from redditors.

[u/abrownn]

Thanks for including us in the process!

[u/traceroo → u/abrownn]

Thanks for taking the time to discuss it with us!

[u/WalkingEars]

Can I opt out of my personal stories and conversations on Reddit being sold to AI chatbot developers?

[u/Bigred2989- → u/WalkingEars]

The silence is your answer.

[u/James20k]

This is nice in theory, but lets say we have an AI being trained on reddit users' data - which we do. Our comments and content are part of that dataset. We've seen that AI models can be used to output their training data in many cases, because they encode a lot of that training data inherently in the model

So with this in mind:

We require our partners to uphold the privacy of redditors and their communities. This includes respecting users’ decisions to delete their content and any content we remove for violating our Content Policy.

If I delete content from my reddit account, are you saying that these companies will be forced to delete that content from their training data, and retrain their models?

Partners are not allowed to use Reddit content to conduct background checks, facial recognition, government surveillance, or help law enforcement do any of the above.

Similarly, if I train an AI model on reddit content, and that AI model is then put into the public for other people to use, someone might ask it "Does the reddit user u/james20k have any questionable information in their background I should know before I hire them for a job?". That AI model will have been trained on a dataset that contains a significant amount of information on me, and it will have an answer

Does the no-background-checks etc encompass a commitment to prevent partnered large language models trained on reddit being used by downstream third parties for these purposes, or does it only encompass the immediate third parties themselves using it directly for these purposes?

[u/semi-confusticated → u/James20k]

You make a good point here. The privacy principles in this policy sound great, but as soon as LLM's get involved, those principles fall somewhere between impractical and impossible to follow in practice. My guess is that they'll have to stretch the meaning of the policy to create loopholes for AI, or else just play dumb and ignore the ramifications of AI entirely.

[u/Halaku]

as a lawyer, I am not allowed to be brief

Yet as a lawyer, you are allowed to prepare briefs. Ironic, no?

On a more serious note, thanks for keeping us updated on Reddit's efforts to protect our privacy.

[u/InfectedBananas]

Unfortunately, we see more and more commercial entities using unauthorized access or misusing authorized access to collect public data in bulk, including Reddit public content. Worse, these entities perceive they have no limitation on their usage of that data, and they do so with no regard for user rights or privacy, ignoring reasonable legal, safety, and user removal requests.

*unless they pay us $60 million dollars. They they can have all of it.

[u/VladWard]

Partners are not allowed to use content to identify individuals or their personal information, including for ad targeting purposes.

When you say personal information here, what exactly qualifies? Are you aligned with GDPR's definition of personal information, CCPA/CPRA's, or is this section referring only to PII?

Are there limits on how partners use anonymized personal information that they collect from Reddit? For example, could Google construct a machine learning model that uses my Reddit personal information to conclude that "BIPOC men like plastic robots" without identifying me personally?

If Google then independently identifies me as a BIPOC man using its own data collection and targets ads to me accordingly outside of the Reddit platform, is this a violation of the policy?

We need to do more to restrict access to Reddit public content at scale to trusted actors who have agreed to abide by our policies. But we also need to continue to ensure that users, mods, researchers, and other good-faith, non-commercial actors have access.

Can you expand a bit on what this might look like?

[u/Watchful1]

u/traceroo two questions.

1. How can I determine when content is deleted without re-accessing it from the API each time? I'm fairly sure your commercial partners have access to a feed of deleted object ID's to remove from their data set, but that's not available to the rest of us.

2. If content is public on reddit, does that mean we can keep using it even if the author doesn't want us to (outside things like copyright)?

[u/Jakeable]

Is anything happening with the "allow my data to be used for research purposes" preference? It still shows up in preferences (at least on old.reddit), but it doesn't seem to have any effect on this

[u/Lil_SpazJoekp]

Thanks for the invite to the roundtable discussion!

[u/nerdshark]

I'm curious what implications this might have for this new policy? It looks like the judge is ruling that:

• absent any provable damages or service impairment caused by scraping, that publicly-available data (in particular, social media posts generated by users) is subject to the Copyright Act, and that

• entities with non-exclusive licensees (in particular, social media platforms like Twitter and Reddit) that enjoy Section 230 protections do not have the right to create "information monopolies" by requiring some parties to pay for access to this information that's freely and publicly available to others

• this paywalling of publicly-accessible data runs afoul of the fair use provision of the Copyright Act

The conflict seems to arise from trying to claim both Section 230 safe harbor protections and ownership and exclusive control of platform content:

The judge found that X Corp's argument exposed a tension between the platform's desire to control user data while also enjoying the safe harbor of Section 230 of the Communications Decency Act, which allows X to avoid liability for third-party content. If X owned the data, it could perhaps argue it has exclusive rights to control the data, but then it wouldn't have safe harbor.

"X Corp. wants it both ways: to keep its safe harbors yet exercise a copyright owner’s right to exclude, wresting fees from those who wish to extract and copy X users’ content," Alsup wrote.

If X got its way, Alsup warned, "X Corp. would entrench its own private copyright system that rivals, even conflicts with, the actual copyright system enacted by Congress" and "yank into its private domain and hold for sale information open to all, exercising a copyright owner’s right to exclude where it has no such right."

That "would upend the careful balance Congress struck between what copyright owners own and do not own," Alsup wrote, potentially shrinking the public domain.

"Applying general principles, this order concludes that the extent to which public data may be freely copied from social media platforms, even under the banner of scraping, should generally be governed by the Copyright Act, not by conflicting, ubiquitous terms," Alsup wrote.

So, how does this affect reddit? It seems to me like the judge is saying that platforms don't get to charge for access to public data without losing access to certain legal protections. Here's the judge's order, for anyone who's interested.

[u/shiruken]

Thanks for involving us in the process! Are there any plans to improve the "make your content non-public" process? Right now it's extremely tedious to bulk delete posts and comments on accounts with extensive histories. Many users have to rely upon (and trust) third-party scripts or websites. Would Reddit ever consider implementing an automatic content deletion setting in the user profile similar to that offered on Mastodon?