Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if you are viewing a Reddit post and want to see the deleted contents, you can tweak the "reddit.com" domain a little, to enter a website that will show you all the deleted contents, using the Pushshift.io website.

However, several Reddit users from the EU are concerned about this, because Pushshift.io is not respecting the "right to be forgotten" from GDPR, when they're asked to remove contents that belong to the user.

(besides that this data is being collected and stored without anyone's consent)

In a Reddit post, they say:

  1. What happens when a removal request is made?
    A) Right now, we internally blacklist the account so that the data is not exposed via any public API. For full disclosure, we currently do not permanently delete any data unless there is a major issue involving PII, etc. While you have the right to request that people cannot search your comments and submissions via the public API, we reserve the right to keep data in our private archive so long as we never allow any data that you requested be removed get exposed through any public API endpoints.

So they are still keeping our data against our wishes, and all it takes is their servers getting breached, for all this data to be exposed.

Not only that, all the data apparently can be downloaded from this page, which contains compressed databases of their API. But while they remove (hide) the data from the API, that data is still available for anyone to publicly download.

In this Reddit post, they replied with:

safrax MOD · 10 hr. ago
Pushshift is not subject to the GDPR. No useful discussion will come from this so I'm locking the thread.

There's also an old comment here, saying:

GDPR only applies to websites you give your data to, not third parties that scrape it. There's no violation here.
Not to mention that pushshift is US based and GDPR doesn't even apply.

Is it really correct that Pushshift is not subject to the GDPR?


The Reddit user u/Stuck_In_the_Matrix is the creator of this API, and he said in a post:

I am an American but I don't see that as an excuse to violate or circumvent EU law. My intention is to observe the laws governing the GDPR and make a good faith effort to follow the law to respect and protect the privacy of residents of the EU.

But he clearly isn't respecting EU residents' privacy, with this.

  • 2
    An easy way to resolve this would be to complain to your domestic supervisory authority (e.g. the ICO in the UK). A decision of the ICO that they fall within scope of the GDPR will put a quick end to their claims.
    – JBentley
    Sep 27, 2022 at 10:41
  • 3
    "GDPR only applies to websites you give your data to, not third parties that scrape it": that person either hasn't read the GDPR, has misunderstood it, or is lying.
    – phoog
    Sep 27, 2022 at 11:22
  • It is worth noting that even if the GDPR foes not apply, as per Amon, other data protection laws, such as the CCPA,. might well apply, and several have a "right of deletion" similar to that in the GDPR. Sep 28, 2022 at 2:21

2 Answers 2


Maybe, but probably not

The geographic location of the organisation is immaterial: under Article 3.2:

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ... (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Posts anyone (not just EU citizens) make to Reddit (or anywhere else) while they are physically located in the EU or UK engage the GDPR. Pushift.io is therefore captured by the GDPR and any denial of that is just plain wrong.

Given the denial, it is likely right out of the gate that they are non-complient. For example, they are unlikely to provided the required information under Article 14. More importantly, it seems that they have not determined the lawful basis for processing the data under Article 6 - they can possibly rely on the public interest basis (preserving deleted publication is arguably a public interest) or a legitimate interest but that requires a balancing of their interest against the data subject's.

That said, the right to be forgotten is not absolute, the reasons that might be applicable here are:

  • The data is being used to exercise the right of freedom of expression and information.
  • The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority.
  • The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
  • Note that the exceptions with public interest etc need to be specific to the particular persons data. Scraping all users data, which is what pushshift.io appears to be doing is not covered by that.
    – quarague
    Sep 27, 2022 at 7:10
  • Thank you, but I'm failing to understand the "but probably not" part. I don't think the data they collect applies to any of those 3 points at the end of your answer.
    – GDPR
    Sep 27, 2022 at 8:36
  • I think you are right to look into the Art 3(2)(b) monitoring criterion since it is the most likely mechanism through which GPDR could apply here. But you fail to actually analyze that criterion, and instead prematurely decide that all processing of posts from EU/UK would immediately trigger the GDPR. I don't think this is correct. I think that, unfortunately, the correct conclusion is that Pushshift is not subject to GDPR.
    – amon
    Sep 27, 2022 at 12:09

It is quite possible that Pushshift is not subject to the GDPR. But it's impossible to know for sure until a court rules on this specific case.

As Dale M's answer correctly points out, we have to consider Art 3(2) GDPR, since Pushshift is not EU-based:

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

The critical question then is whether Pushshift triggers either the Art 3(2)(a) targeting criterion or the Art 3(2)(b) monitoring criterion. The EDPB has published their guidelines 03/2018 on the territorial scope of the GDPR to help us understand this.

Art 3(2)(a) targeting criterion

Whether a data controller is “offering” a service depends largely on the intention of the controller, and mere availability of their website is not sufficient. Recital 32 (quoted below) provides relevant factors to consider, and the EDPB document summarizes further factors from case law that would suggest a targeting intention.

[…] In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

The Recital 23 factors are:

  • use of a language or currency generally used in one or more EU member states
  • mentioning customers or users who are in the EU

Explicit non-factors are:

  • availability of websites or contact details
  • use of a language generally used in the controller's country

I cannot see that Pushshift would meet any of the factors that would cause GDPR to apply per Art 3(2)(a).

At most, it could be argued that Pushshift is so important that they should reasonably expect that their services will be used from the EU, so that they should reasonably expect themselves to be offering a service to people in the EU. But that's a rather convoluted argument.

Art 3(2)(b) monitoring criterion

This criterion is potentially more interesting since it doesn't rely on the intention of the data controller. But what is monitoring? Recital 24 of the GDPR explains:

In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

The EDPB adds their interpretation that

While Recital 24 exclusively relates to the monitoring of a behaviour through the tracking of a person on the internet, the EDPB considers that tracking through other types of network or technology involving personal data processing should also be taken into account

The EDPB gives clear-cut examples of monitoring:

  • Behavioural advertisement
  • Geo-localisation activities, in particular for marketing purposes
  • Online tracking through the use of cookies or other tracking techniques such as fingerprinting
  • Personalised diet and health analytics services online
  • CCTV
  • Market surveys and other behavioural studies based on individual profiles
  • Monitoring or regular reporting on an individual’s health status

There is a potential argument that Pushshift's activities do imply such monitoring, since Pushshift's service makes it possible to search for one user's Reddit comments.

But I think that this argument is a stretch, since Pushshift itself does not make per-user inferences based on this data. Pushshift merely takes the Reddit data and indexes it. Yes, that is processing of personal data as defined by the GDPR, but it does not seem to be “monitoring” within the meaning of the GDPR. Thus, I think it is unlikely that Pushshift is subject to GDPR per Art 3(2)(b).


For GDPR to apply, one of the cases in Art 3 GDPR must be fulfilled. Art 3(1) does not apply due to the services location. Per the above analysis, Art 3(2)(a) is very unlikely to apply since there is no evidence of an intention to offer the service to people in the EU. The Art 3(2)(b) monitoring criterion is more interesting, but after looking at the relevant factors it too is unlikely to apply to Pushshift's actual service.

Thus, it is likely that Pushshift is indeed free from GDPR compliance concerns, which means not having to provide a privacy notice, not having to determine an appropriate legal basis, and not having to fulfill data subject requests such as when they try to invoke a right to be forgotten.

  • Thank you very much for the extensive reply. So are you saying that if I have a service that is subject to GDPR, and fully compliant to GDPR, delete data on request, etc, but I make another service in the USA that simply scraps all the data and keeps it, it won't be subject to GDPR and therefore I have a loophole here as a way to keep all the data from EU users anyway?
    – GDPR
    Sep 27, 2022 at 13:08
  • 1
    @GDPR Location of the data controller matters. If you run a US service but actually manage it from EU, GDPR still applies per Art 3(1). If you're not from the EU, then we'd have to re-run this Art 3(2) analysis with the specific facts. It is possible that some of your activities are subject to GDPR, while others are not – Google is an example of this. Can't do that analysis without specific facts though (why is data collected, published, and self-scraped by the same entity?). It is best to think about GDPR as covering processing activities, not persons, entities, or data.
    – amon
    Sep 27, 2022 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .