reddit is telling it's future investors with recent news and more info on their IPO, that they're currently selling and looking to sell their user's data to companies wanting to train their LLMs, including Google.

This is a direct violation of the GDPR for any EU based users.

Legal Basis?

Under Art. 6 GDPR reddit may only really use p1 (f) (p meaning paragraph) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

All other options are impossible, as they don't have consent, nor do they have contracts with their user base to allow for this. Art. 5 p1 (f) is a touchy subject and clearly requires extra provisions being made in case the data subject is a child. Reddit has tons of children (meaning anyone under 18) using their site daily. See for example: https://www.reddit.com/r/teenagers/

What's being processed

Due to the nature of reddit, they are also processing huge amounts of data of special categories Article 9 such as data on sexual orientation, health information, ethnic info, union information, etc. (basically everything in Article 9 can easily be found on reddit):

(note users have not given explicit consent according to the requirements of consent under Art. 7 and 8, which would allow for such processing under Art. 9 p2 (a))

• racial or ethnic origin: https://www.reddit.com/r/Ethnicity/
• political opinions: https://www.reddit.com/r/politics/
• religious beliefs: https://www.reddit.com/r/religion/
• philosophical beliefs: https://www.reddit.com/r/philosophy/
• trade union membership: https://www.reddit.com/r/Unions/
• health: https://www.reddit.com/r/Healthadvice/
• sexuality: https://www.reddit.com/r/sexuality/

These are obviously just a tiny selection of the hundreds of subreddits that are concerned with these types of data, not to mention the unencrypted "private" messages, chats, etc.

My lord, is this legal?

Article 9 p2 (e) states "processing relates to personal data which are manifestly made public by the data subject;"; so they're out of the woods, right? After all, users posted this stuff and it was made public! Sadly, this doesn't work with processing data of children, especially with 9 p4 allowing member states to introduce additional limitations and conditions for further processing.

The real kicker comes with Article 5 p1 (b) though for 9 p2 (e). 5 p1 (b) requires the personal data be: "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);"

Yeeeah... People have posted their stuff publicly, BUT with a clear understanding that the processing of the data ends there. Reddit may process the data insofar they serve the data to the public. That's it. Turning around and selling the data now is a crystal clear violation of Article 5 p1(b). There's no two ways about it. As per Article 5 p2, reddit needs to be able to prove they are in compliance with 5 p1.

They're also processing data under Art. 10 relating to criminal convictions and offences

• https://www.reddit.com/r/AskReddit/ (not joking, this one is a gold mine for GDPR violations)
• https://www.reddit.com/r/AskReddit/comments/5eexva/police\_officers\_of\_reddit\_what\_criminal\_actually/
• https://www.reddit.com/r/AskReddit/comments/1vug9e/criminal\_masterminds\_of\_reddit\_what\_is\_the\_worst/
• https://www.reddit.com/r/AskReddit/comments/18lp04/criminals\_of\_reddit\_how\_did\_you\_get\_caught/

Processing of such data shall be carried out only under the control of official authority or where processing is authorized by Union or Member State law. Rugh-Roh. I'll admit, that this one might be reaching a bit, as it could easily be considered only to apply to "official" type of data here, rather than just criminal talk overall, but fuck it. Throw it on the pile.

Your rights and how they're being violated (not in a kinky fun way)

Now let's look at the Rights of the data subject! Those are always fun :)

Art. 12 p1 "The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child."

This is my favorite. Articles 13 and 14 are provisions on informing the data subject where they had data obtained directly from them or not directly from them. For reddit it mostly applies 13, but since people also talk about people they know, 14 also applies.

Let's check in there real quick. We'll keep it to Article 13 for brevity. Reddit needs to:

• give info on contact details of the controller and the controllers rep (in the case of selling data to Google for LLM training, that's info for Google, not reddit; anyone got that info via DM maybe? No? Oh shit)
• contact details of their data protection officer (both reddit and google, anyone was informed on that for the LLM stuff? No?)
• purposes of processing including the legal basis. Love this one. Anyone know that for the sale of their data to Google to train their LLM? No? Shucks.
• Since they're likely hinging on Art. 6 p1 (f) they need to tell you what the legitimate interest is - in our case MAD MONEY, not sure if that'll hold up.
• recipients or categories of recipients -\> so "big evil data churning, election influencing, minority silencing, union busting, mega corp" Sweet.
• Transfer to third countries -\> likely doesn't apply, as reddit servers are in the US (I believe, no idea if that's true) if not, weeeeeeell...
• right to lodge a complaint with supervisory authority (anyone got that notice?)
• whether the data is provided due to a contract or statutory -\> doesn't apply, users give their data "freely"
• existence of automated decision-making, INCLUDING PROFILING (as per Art. 22 -\> non of the exceptions in that article apply to the current situation) - I'm sure no LLM will ever be used by the largest Ad company on the planet to help profile users, noooooooo, that's craaazy!

Article 13 p3 clearly states in relation to Article 5 p1 (b) that the data subject must be informed about the data that is being collected for further processing BEFORE such processing occurs, including all the info I just listed above from Article 13 p2.

Article 13 p4 states "Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information." yeeaaah... No reddit user knew about their data being actively sold to LLMs (sure LLMs might have scraped it, but that's an entirely different can of worms - in which reddit has a hand, too under GDPR as they're supposed to establish safeguards against such things, but reddit directly selling now without any upfront info... tut, tut..)

Another element of Article 12 p1 is this bit "in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child." I'm sure they'll find a cool and hip way of explaning to all the teens on reddit what an LLM is and how it's using their data.

Send reddit a little e-mail

For added fun, I urge anyone who still has a reddit account and is a EU citizen to contact reddit and make use of their rights under the GDPR to be specifically excluded from any use for LLM training, etc. Which is your RIGHT under Article 12 p2 specifically Article 21 right to object. You can contact them via "[email protected]"

Let's be really petty and assume that reddit and Google are shit at what they do, so they're likely not even engaged in a Data Processing Agreement required under Article 28 p3 and if so, I'd love my supervisory authority to take a look at that one.

Delving into the Arcane

Let's kick it up a tiny notch and go into the more arcane bits of the GDPR with Article 35, Data Protection Impact Assessment. I'm sure you'll love p1:

"Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. 2A single assessment may address a set of similar processing operations that present similar high risks."

New technologies you say? Likely to result in a high risk, you say? Remember how most chatbots and AIs turn super racist, super quick? Or AIs being easily triggered into revealing their training data 1:1? Oh I'm sure there's nooooo such risk with LLMs run by evil mega corp known for exploiting the shit out of exactly this kind of info for well over a decade now.

But we needn't even argue that point. Article 35 p3 (b) clearly states: "processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10;"

Oh nooo. Remember my list from the start? LLMs are 100% definitely large scale processing all that with reddit data sets.

Any assessment carried out would clearly indicate risk and thus Article 36 would apply, where reddit has to consult with supervisory authorities in the EU BEFORE starting this. Knowing reddit, if they ever even did such an assessment, they've come out with "low risk, nothing to see".

Then there's Article 32 of the GDPR: Security of processing. p1 (b): "the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;" yeeeaaah, good luck with that on an LLM there, buddies.

Cool, what now?

Here's what you do to exercise your rights and defend your data against the highway robbery and continuous violation by US Tech-Bros:

• Find your supervisory authority (just use google, for added irony) by searching for "Data Protection supervisory authority [the state you live in]".
• Find their contact info, usually they have a form to complain ready made
• give the company info applicable for your state, I've gone ahead and fished those out for you (see at the end here)
• Tell them about the upcoming reddit Google partnership: https://apnews.com/article/google-reddit-ai-partnership-a7f131c7cb4225307134ef21d3c6a708
• Tell them you're an EU citizen and reddit user (or former and they still have data of yours)
• Tell them you believe them to be in violation of Articles: 5, 6, 9, 10, 12, 13, 14, 32, 35, 36, and possibly more.
• Link to this thread, if you like

US

Reddit, Inc. 548 Market St. #16093 San Francisco, California 94104

EU

Reddit Netherlands B.V. Euro Business Center Keizersgracht 62, 1015CS Amsterdam Netherlands [email protected]

UK

Reddit UK Limited, 5 New Street Square, London, United Kingdom, EC4A 3TW [email protected]

Good luck!

Link to the Blog Post and PDF: https://impheim.com/2023/10/mother-of-loam-a-single-quest-ttrpg-module/

He's also put out another one over here: https://impheim.com/2023/10/the-everfog-field-of-spears-a-single-quest-ttrpg-module/

An idea put forward to turn items the characters already have into magic items rather than only (or primarily) giving them magic items they can find.

Short little video on a different approach to handling Magic Items to increase the chance of them being used and going to the right character.

Short and sweet video on how to approach Magic Items a little differently (mainly aimed at DMs, but I found it interesting still).

For me it was rescuing a little bee buddy from a spider. It buzzed like crazy on my palm, getting rid of the web and finally flying away.

Spider has been eating well on that net. The bee buddies are my guests though, so spider friend doesn't get to snack on them.

It's the best indicator to my mind if my vacation was long enough. If I can still type that thing out and get it right on the first try, I haven't been gone long enough.

I will try again around Christmas.

Got bites on each of my knuckles, on my joints and wrists. Was itching as heck and I was too tired to really do much about it but scratch and try and get back to sleep. I think it might have only been one of them as well.

They're the epitome of biting the hand that feeds you.

Silly little critters.

Something special about being awake before everyone else is. The world is so nice and quiet.

To help give some guidance on how you might be able to find smaller creators, despite the distinct lack of tools to do so baked into the youtube interface, I figured I'd give you at least a starting point.

• When searching for a topic you're interested in, set your filters to sort by views and narrow down the date range to last week.
• Once you've done that, scroll down a while until you start hitting videos that been up for 2 or more days but have below 100 or so views.
• Since most interactions for content creators happen during the first few hours of any uploaded video, you'll almost assuredly find a creator with a very low subscriber count.

Mind you needn't sort by views, you can simply sort by anything and look for videos that haven't been up long and have very few views. This sorting just helps narrow it down more quickly.

Now, if these are going to be good? I don't know, but it's part of the joy of finding someone that you really enjoy.

Hope this helps some of you. Feel free to share if you find one of those gems!

Needs no brain power and since the content here is much less doom and gloom, it's not so heavy on the mind and soul either.

With algorithms, clickbait, the power of hate and controversy, it's become increasingly difficult to find or amplify the smaller creators (below 1000 subscribers/followers) across the internet.

Know a diamond in the rough, that barely anyone knows about? Go talk about them there. Tell the fediverse why they're a worth a subscription, or even promote your own work.

This can be anyone from YouTubers, Twitch Streamers, Arts&Crafts Creators, Writers, Musicians, Artists, whatever comes to mind as long as it is SFW.

Do observe the rules in the sidebar, before posting.

With algorithms, clickbait, the power of hate and controversy, it's become increasingly difficult to find or amplify the smaller creators (below 1000 subscribers/followers) across the internet.

https://kbin.social/m/discoversmallcreators

is meant to help just that. Know a diamond in the rough, that barely anyone knows about? Go talk about them there. Tell the fediverse why they're a worth a subscription, or even promote your own work.

!@discoversmallcreators https://lemmy.world/c/[email protected]