The United Kingdom’s Information Commissioner’s Office (ICO) has issued a £14.47 million fine to social media company Reddit, Inc. for serious failures in protecting the privacy of children using its platform, marking one of the largest penalties ever imposed by the regulator in this area.
The ICO’s investigation concluded that Reddit unlawfully collected and processed the personal information of children under the age of 13, exposing young users to potential risks without a lawful basis and without adequate safeguards.
Age Assurance Failures Under Scrutiny
According to the ICO, Reddit did not implement any robust age assurance mechanism before July 2025, despite prohibiting children under 13 in its terms of service. The platform relied primarily on users’ self-declared ages, a method regulators said was easily bypassed and insufficient under UK data protection law.
The watchdog also found that Reddit failed to carry out a data protection impact assessment (DPIA) focusing on risks to children before January 2025 — a legal requirement for services likely to be accessed by minors. Without these assessments and age checks, the processing of children’s personal data was considered unlawful.
Regulator’s Message: Children’s Safety First
John Edwards, the UK Information Commissioner, stressed the seriousness of the breach. He said it was “concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children” and that collecting or using such data without proper protections left young users vulnerable to harm.
Edwards added that organisations offering online services that children can access must be confident about their users’ ages and have effective measures in place to shield them from inappropriate content and data misuse.
Changes and Ongoing Review
In response to regulatory pressure, Reddit introduced age assurance measures in July 2025, including requiring users to declare their date of birth when accessing mature content and implementing third-party age and identity verification for such access. However, the ICO warned that relying on self-declaration still posed risks, and the regulator is continuing to monitor Reddit’s practices.
Reddit to Appeal
Reddit has indicated it plans to appeal the fine, arguing that additional age verification requirements may conflict with its privacy-centric ethos, which minimises the collection of personal identity data. However, UK authorities have maintained that effective safeguards are essential to protect children online.
Part of Broader Enforcement Push
The penalty is part of the ICO’s wider effort to enforce children’s privacy protections under UK data protection law. Earlier this month, the regulator also fined MediaLab.AI, Inc., owner of image-sharing platform Imgur, for similar privacy failures — and has ongoing investigations into other major tech platforms.
