The UK’s data protection watchdog has fined Reddit £14.47m after finding serious failings in how the platform handled children’s personal information.
The penalty, issued by the Information Commissioner’s Office (ICO), follows an investigation that concluded Reddit had failed to implement robust age assurance mechanisms and did not have a lawful basis for processing the data of children under 13.
Under UK data protection law, children’s information must be given special protection. The ICO said Reddit did not have effective systems in place to verify users’ ages until July 2025, despite its terms of service prohibiting under-13s from accessing the platform.
The regulator also found that Reddit failed to carry out a data protection impact assessment (DPIA) addressing risks to children until January 2025, even though users aged 13 to 18 were permitted to join.
John Edwards, the UK Information Commissioner, described the failings as unacceptable. “Children under 13 had their personal information collected and used in ways they could not understand, consent to or control,” he said. “Relying on users to declare their age themselves is not enough when children may be at risk.”
In July 2025, Reddit introduced new measures including age verification for access to mature content and requiring users to declare their age at account creation. However, the ICO has warned that self-declaration alone presents risks, as it can be easily bypassed.
The regulator said it would continue monitoring Reddit’s approach as part of wider enforcement activity focused on online platforms that rely primarily on self-declared ages.
The fine takes into account the number of children potentially affected, the duration of the failings and Reddit’s global turnover.
The ICO’s action follows its ongoing supervision of platforms under the UK’s Age Appropriate Design Code, also known as the Children’s Code, which sets out standards for services likely to be accessed by under-18s.
The regulator has said safeguarding children’s privacy online remains a priority and confirmed it will continue working closely with Ofcom, which enforces the Online Safety Act, to ensure coordinated oversight of digital platforms.
The decision underscores intensifying scrutiny of tech companies operating in the UK, particularly around age verification and the lawful processing of children’s data.
Read more:
ICO fines Reddit £14.47m over children’s data protection failures
