Reddit (Reddit Pixel / Reddit Ads)

What Reddit does and how it appears on a website

Reddit Inc. is a publicly traded US company that operates the social platform reddit.com. For European website operators, Reddit appears mostly through the Reddit Ads advertising stack: the Reddit Pixel (a small JavaScript snippet) and the Reddit Conversion API. The pixel fires page views, signups, purchases and custom events. The Conversion API does the same from your server, enriching the event with hashed email or phone numbers. Reddit then matches the events to Reddit user profiles to build conversion reports, retargeting audiences and lookalike audiences.

Cookies and data collected by the Reddit Pixel

On the advertised website, the Reddit Pixel sets the rdt cookie (or _rdt_uuid) on the first party domain, plus third party cookies on .reddit.com such as reddit_session, token_v2 and edgebucket. On reddit.com itself, the pixel may read existing session cookies to match a visitor to a logged in Reddit account. Collected data includes IP address, User-Agent, click identifiers, URL, referrer, time stamps and any custom parameters added by the operator (value, currency, content_id).

GDPR and ePrivacy implications

The Reddit Pixel is an advertising and profiling tool, which means Article 5(3) ePrivacy requires informed, freely given prior consent before any cookie or local identifier is written. Under the GDPR, the website operator and Reddit Inc. are joint controllers for the pixel events, as confirmed by the CJEU rulings Fashion ID and Wirtschaftsakademie. Both parties must define their responsibilities in a joint controllership arrangement, which Reddit provides as part of its advertising terms.

International data transfers

Reddit Inc. is certified under the EU-US Data Privacy Framework, providing an adequacy basis for transfers to the United States. The Reddit Data Processing Addendum includes the European Commission Standard Contractual Clauses for jurisdictions outside the framework. Reddit relies on AWS infrastructure, mostly in US regions. Following Schrems II, a transfer impact assessment is recommended documenting the scope of US government access risk and the data minimisation measures applied.

Consent and legal basis

Consent under Article 6(1)(a) GDPR is the only realistic legal basis for the Reddit Pixel. Legitimate interest does not apply because the purpose is advertising and profiling, which falls outside the typical legitimate interest test. The consent must be specific to advertising and clearly named Reddit as the recipient. The pixel must only fire after opt-in, controlled through a Consent Management Platform.

Practical compliance steps

Sign the Reddit Data Processing Addendum, configure the pixel through Google Tag Manager (or another tag manager) so it only fires after the advertising consent group is granted, hash email addresses and phone numbers client side before sending to the Conversion API, list Reddit as a recipient in the privacy notice with a link to its privacy policy, document the joint controllership and the transfer impact assessment, and provide an easy mechanism to withdraw consent at any time.