The UK’s information regulator has issued its largest ever penalty for a breach of children’s privacy, fining the social news platform Reddit £14.47 million for unlawfully processing the personal data of users under the age of 13 and potentially exposing them to harmful content.
According to the Information Commissioner’s Office (ICO), Reddit failed to implement effective age verification, relying solely on a self-declaration system that it said was “easy to bypass.” This left the platform without a lawful basis for processing the information of what the regulator estimated was “a large number” of children under 13 active on the service.
Information Commissioner John Edwards stated that companies operating online services likely to be accessed by children have a responsibility to protect them by ensuring they know their users’ ages. “Children under 13 had their personal information collected and used in ways they could not understand, consent to or control,” he said, adding that this left them potentially exposed to content they should not have seen.
The ICO also found that Reddit failed to carry out a mandatory Data Protection Impact Assessment to assess and mitigate risks to children before January 2025, a requirement under UK data protection law.
Platform Appeal and Privacy Stance
Reddit has stated it will appeal the decision. A company spokesperson argued that the ICO’s insistence on collecting more private information from every UK user is “counterintuitive and at odds with our strong belief in our users’ online privacy and safety.” Reddit maintains it does not require users to share identifying information regardless of age and removes those under 13, as its user agreement states that users must be at least 13 years old.
In July 2025, Reddit introduced age verification measures for UK users wanting to access mature content such as pornography, requiring them to upload a selfie or government ID to prove they are over 18. This move was to comply with the UK’s Online Safety Act, though the ICO has indicated that relying on self-declaration alone is insufficient.
Part of a Wider Regulatory Crackdown
The fine against Reddit forms part of a broader ICO intervention concerning children’s personal information online. The regulator has previously fined MediaLab.AI, the owner of Imgur, £247,590 for similar children’s privacy failures, which led to Imgur’s withdrawal from the UK market. It is currently investigating 17 other platforms, including Discord, Pinterest, and X, and has engaged with Meta and Snapchat regarding children’s location data.
This £14.47 million penalty is the third largest financial punishment issued by the ICO. It follows a £20 million fine for British Airways in 2018 and an £18.4 million fine for Marriott in 2014. Another significant recent fine includes £14 million for Capita in 2025 for data breaches.
Campaigners Highlight Enforcement Gap
Child rights advocates have welcomed the action but pointed to a failure to enforce existing rules. Colette Collins-Walsh, head of UK affairs at the 5Rights Foundation, said that for years, a major global platform relied on “little more than a tick-box self-declaration of age, leaving the youngest users unprotected.” She noted that the regulation needed to prevent such failures has been in place since 2018 and was simply not enforced, adding that new rules mean little if existing ones are not upheld. The foundation advocates for robust enforcement of the Age Appropriate Design Code to protect children from AI harms and other risks.
