How to file a CCPA complaint against Reddit

2 min read

If these conditions apply to you:

  • You are a resident of California
  • You submitted a CCPA account deletion request to Reddit
  • Reddit replied telling you to manually delete your posts/comments
  • At least one post/comment contains Personally Identifiable Information (PII)

Then I would encourage you to submit a CCPA complaint against Reddit, Inc. using the California Attorney General form:

California Attorney General Consumer Complaint Form

On this form you'll need to enter your contact information. You'll also need to enter the contact information for Reddit. As a convenience, I've reproduced this information below:

Reddit, Inc.
303 Second St
San Francisco
California
94107

You'll also need to enter a comment about the CCPA violation that Reddit has made. Of course, this will be personal to you and to the exact scenario in which you found yourself unable to delete your account and all PII that is stored on Reddit. For me, personally, I used the following comment:

This is a CCPA complaint against Reddit, Inc., a San Francisco based company with around 2,000 employees and whose namesake product, Reddit, has 52 million daily active users.

Upon submitting a CCPA account deletion request to Reddit's Legal department, they replied and told me to manually delete all of the posts and comments that I have ever created with the service. Some of these posts and comments contain PII. If I do not manually delete my posts and comments then when I delete my account the posts are "anonymized". This means they are no longer associated with an account but the PII remains public. I believe this in and of itself is a clear CCPA violation.

Furthermore, the interface provided by Reddit requires manually deleting every individual comment and post. They provide no functionality to automate this or otherwise batch delete data. There are further complexities to how Reddit works that prevents all comments and posts from being listed to the creator of said content. For example, on multiple occasions I have manually deleted all content listed to me only to more content appear at a future date.

There is no court case for this. As this affects millions of Californians I believe the California Attorney General should take action.

I'm not entirely sure what happens after this form is submitted but I'll keep this post updated. I suspect that one may need to sue Reddit in order to have anything of real consequence happen.

Thomas Hunter II Avatar

Thomas has contributed to dozens of enterprise Node.js services and has worked for a company dedicated to securing Node.js. He has spoken at several conferences on Node.js and JavaScript and is an O'Reilly published author.