The UK’s Information Commissioner’s Office (ICO) has issued a £14.47 million ($19.52 million) fine against Reddit, Inc. after an investigation concluded the social media platform unlawfully processed the personal information of children under the age of 13, failing to implement effective age verification controls and leaving young users exposed to potentially harmful content.
Reddit, which hosts 121 million daily users across thousands of communities, had terms of service explicitly prohibiting use by children under 13, yet the platform did not introduce any age assurance mechanisms until July 2025.
The ICO determined that Reddit had no lawful basis under UK data protection law to process personal data belonging to underage users during this period, as a large number of children under 13 were estimated to have been active on the platform.
The regulator also found that Reddit failed to conduct a Data Protection Impact Assessment (DPIA), a mandatory requirement to assess and mitigate risks to children, before January 2025, despite knowingly allowing users aged 13 to 18 on its platform.
UK Information Commissioner John Edwards stated: “Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”
He further warned that relying solely on user self-declaration of age is insufficient and that the ICO is now actively scrutinizing platforms that primarily depend on this method.
Reddit’s Response and Age Assurance Measures
In July 2025, Reddit introduced age assurance measures that include age verification to access mature content and prompting users to declare their age during account creation. However, the ICO cautioned that self-declaration remains easily bypassed and continues to monitor Reddit’s processing of children’s data.
A Reddit spokesperson pushed back against the regulator’s stance, stating: “The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety.” Reddit has confirmed it intends to appeal the ICO’s decision.
This penalty is the largest fine the ICO has ever issued in relation to children’s privacy. It follows the February 5, 2026, fine of £247,590 against MediaLab.AI, Inc., the owner of image-sharing platform Imgur, for similar children’s data failures, which resulted in Imgur withdrawing from the UK market entirely.
The ICO is currently investigating 17 other platforms, including Discord, Pinterest, and X, and has begun addressing concerns with Meta and Snapchat over children’s location data use. As of October 2025, the regulator estimates its enforcement work has positively impacted over 3 million children across various platforms.
In setting the penalty amount, the ICO factored in the number of children affected, the degree of potential harm, the duration of the failures, and Reddit’s global turnover.
The fine underscores the UK regulator’s escalating commitment to enforcing its Age Appropriate Design Code (Children’s Code) and signals to the broader tech industry that self-declaration of age alone will not satisfy legal data protection obligations for platforms accessible to minors.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
