ICO Fines Reddit £14.47m for Unlawful Use of Children’s Data

The UK Information Commissioner’s Office (ICO) has imposed a £14.47 million penalty on Reddit after concluding the platform mishandled children’s personal information and failed to implement proper age protections.

What the ICO found

• Reddit did not deploy a robust age assurance system before mid-2025, meaning there was no lawful basis to process the personal data of users under 13.
• A data protection impact assessment (DPIA) to assess and mitigate risks to children was not carried out before January 2025.
• These shortcomings meant children’s data were being processed unlawfully, potentially exposing them to inappropriate and harmful content.
• In July 2025, Reddit finally introduced age verification for accessing mature content and required users to declare their age when creating an account. The ICO warned that self-declaration alone is risky because it can be bypassed, and the regulator continues to monitor Reddit’s handling of children’s data as part of broader scrutiny of platforms that rely on self-declaration.

What Reddit’s leadership and the ICO emphasized

• UK Information Commissioner John Edwards highlighted the risk to children and stressed that platforms likely to be used by minors must know the age of their users and have effective age assurance in place.
• The ICO noted that relying on users to voluntarily declare their age is insufficient for protecting children and is prioritizing work on platforms that primarily use self-declaration methods. Industry improvements were urged.

Summary of findings and implications

• Reddit’s terms of service prohibited under-13s, yet the company did not implement age checks until July 2025.
• The ICO’s estimates suggested a large number of under-13 users were present, with no lawful basis for processing their data.
• A DPIA focused on risks to children was not conducted before 2025, even though users aged 13–18 were allowed on the platform.
• By using under-13 data without a lawful basis and without proper risk assessment, children faced potential exposure to inappropriate and harmful content.
• The penalty took into account the scale (number of affected children), potential harm, the duration of the failings, and Reddit’s global turnover.

The ICO’s role in protecting children online

• The ICO is the UK regulator for data protection, prioritizing safeguarding children’s online privacy.
• The Age Appropriate Design Code (often called the Children’s Code) translates legal requirements into design standards for online services likely to be used by under-18s, emphasizing children’s best interests and privacy by default.
• As of December 2025, the ICO reported progress on its Children’s Code strategy, including proactive supervision of how social media and video-sharing platforms handle children’s data. The ICO will continue to push for compliance and coordinate with Ofcom to enforce the Online Safety Act.

Age assurance guidance for online services

• Age assurance tools act as safeguards to prevent access to services inappropriate for a user’s age and to tailor the user experience.
• Providers should align the strength of age assurance with the platform’s risk level, potentially applying full Children’s Code protections to all users or using proportionate age checks to limit safeguards by age.
• For services that must restrict access to certain ages, robust age checks are essential to prevent access.
• Further guidance is available in the ICO’s age assurance opinion.