Reddit has said, more than once, that it will check whether its users are human and still never learn who they are. It has named some methods it may use. It has not said, in anything we could find, how a check can tell the site "a person" while telling it nothing else. That gap is the whole question, because the two goals pull in opposite directions: proof usually means someone sees something about you.
There is a known design that can do it, and it has known weak points.
What Reddit has said
The first statement came in May 2025, after researchers from the University of Zurich secretly ran AI bots on the r/changemyview forum. Decrypt reported that the bots posted over 1,700 comments, collected more than 20,000 upvotes, and won 137 "deltas", the forum's award for changing someone's mind. 1 Reddit's chief executive, Steve Huffman, then wrote that the site would need to know whether a user is human and, in some places, an adult, but "we never want to know your name or who you are." Reddit said it would use third-party verification services. 1
Ten months later, the plan had a shape. The table keeps each claim next to its source and its status.
| When | What | Status |
|---|---|---|
| May 2025 | Reddit will use outside services to confirm users are human, and in some places adult, without learning names. 1 | Announced |
| June 2025 | Reddit is considering World ID, an iris-scanning identity system. Reddit and the company behind it declined to comment. 2 | Reported, two unnamed sources |
| March 2026 | Accounts that look automated may be asked to verify. It will not apply to most users, and accounts that fail may be restricted. 3 4 | Announced |
| March 2026 | Methods named: passkeys from Apple, Google and YubiKey, face-based biometrics, World ID, and in some countries a government ID, which Reddit calls its least preferred option. 3 5 | Announced, though outlets differ on which are in use now and which are only considered 4 |
| March 2026 | Huffman described Face ID and Touch ID as "the most lightweight way" to show a human is present. 6 | Interview remark |
Reddit also said it removes roughly 100,000 accounts a day and will label permitted bots "[APP]". 3
The ticket-booth idea
Imagine a booth that sells tickets at the door of a club. You show your passport to the clerk in the booth. The clerk hands you a plain stamped ticket and keeps no list of who bought which. At the club door, the guard checks only that the stamp is real. The guard learns you are allowed in. The guard never sees your passport, and cannot tell which ticket the booth gave to whom.
Computer scientists built a version of this. It is described in RFC 9576, an informational document published in 2024, under the name Privacy Pass. 7 A person proves some fact about themselves, such as "I am not a bot," to one party and gets back a token. The token can be shown to a website, which can check that it is genuine. The design aims so that the website cannot connect the token to the moment it was issued, and cannot tell whether two tokens came from the same person. 7
A check can confirm a person is there without learning who, only if no one in the chain keeps the link.
Reddit has not said it will use this design. We raise it because it shows that the goal is not contradictory. It can be met on paper, with conditions.
Where the weak points are
The same document is frank about the conditions. 7 They come down to one sentence. A check can confirm a person is there without learning who, only if no one in the chain keeps the link. The pieces of that sentence are these.
- Someone sees you. The party that checks the fact, called the attester, learns something. If it sees an account name or an IP address, you have to trust it not to pass that to the party issuing tokens.
- Companies that share an owner can compare notes. The document assumes parties run by the same operator can link a token to its issue. Parties run by different operators are assumed not to collude, and the document says enforcing that is out of scope.
- A crowd is the cover. Protection depends on how many people look identical to an observer. A small group, or details that single you out, such as timing, shrink it.
- Not everyone can pass. The document warns that people who cannot complete a given check may be treated worse, and that depending on a few attesters concentrates power.
Now hold Reddit's menu against that list. Biometric Update reports that Reddit sees passkeys as showing only that "a human probably did something," with no proof that one person has one account. It reports Reddit's description of World ID as a model where account information, usage data and identity stay separate. 5 In the Semafor account, an iris scan is turned into an encrypted code, split across servers, and the user holds the resulting ID in a vault on their phone. Semafor describes this and did not independently test it. 2
What Reddit has not said
The March and April 2026 coverage we read does not say any of the following. 3 5
- Which method Reddit will adopt and when.
- What data the outside providers collect, how long they keep it, and whether they pass anything to Reddit.
- What counts as suspicious behavior, beyond posting speed as an example.
- How an account that fails a check can appeal, and how long a restriction lasts.
- How government IDs for age checks are handled.
The answers decide whether the promise holds. "We never want to know who you are" describes an intention. A design describes who can see what.
Our reading. Huffman said the aim is that account information, usage data and identity "never mix." 4 That is the right target. It is also the sentence that most needs a mechanism behind it. Our inference is that whether the checks Reddit has named keep that promise depends on details it has not published. A government ID check, for one, shows your identity to whoever handles it. We have no evidence that Reddit has built any of these badly.
Questions to ask of any check like this
- Who sees my face, device or ID, and is it the site or someone else?
- What does the site get back: a yes, or a number it can use to recognize me again?
- Can two visits, or two sites, be linked through whatever the check returns?
- How many other people would look the same to an observer?
- What happens if I cannot take the test?
References
- Lanz, J. A. (2025, May 8). Reddit Cracks Down After AI Bots Secretly Infiltrated Debate Forum. Decrypt. https://decrypt.co/318649
- Albergotti, R. (2025, June 20). Reddit considers iris-scanning Orb developed by a Sam Altman startup. Semafor. https://www.semafor.com/article/06/20/2025/reddit-considers-iris-scanning-orb-developed-by-a-sam-altman-startup
- Perez, S. (2026, March 25). Reddit takes on the bots with new ’human verification’ requirements for fishy behavior. TechCrunch. https://techcrunch.com/2026/03/25/reddit-bots-new-human-verification-requirements
- Bell, K. (2026, March 25). Reddit will prompt some accounts to ’verify humanness’ in latest bot crackdown. Engadget. https://engadget.com/social-media/reddit-will-prompt-some-accounts-to-verify-humanness-in-latest-bot-crackdown-161000181.html
- McConvey, J. R. (2026, April 2). Reddit adds labeling for non-human accounts, weighs personhood verification methods. Biometric Update. https://www.biometricupdate.com/202604/reddit-adds-labeling-for-non-human-accounts-weighs-personhood-verification-methods
- Biometric Update. (2026, March 24). Reddit CEO weighs biometrics, passkeys for proof of personhood. Biometric Update. https://www.biometricupdate.com/202603/reddit-ceo-weighs-biometrics-passkeys-for-proof-of-personhood
- Davidson, A., Iyengar, J., & Wood, C. A. (2024, June). The Privacy Pass Architecture (RFC 9576). https://www.rfc-editor.org/rfc/rfc9576.html