Photo Credit:AP Photo/Yuki Iwamura, File
Reddit has been fined £14.47m by the Information Commissioner's Office (ICO) for unlawfully processing children’s personal information, after
regulators found serious failings in the platform’s age checks.
The penalty, the largest ever issued by the watchdog for children’s privacy breaches, follows an investigation that concluded the US-based
company did not have adequate safeguards in place to prevent under-13s from accessing its services.
The ICO said Reddit relied primarily on users self-declaring their age when creating an account, a system it described as easy to bypass and
insufficient under UK data protection law. While Reddit’s terms prohibit children under 13 from using the site, the regulator said its own estimates indicated significant numbers of younger users were active on the platform.
John Edwards, UK Information Commissioner, said it was “concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children”.
The investigation found Reddit had not implemented robust age assurance mechanisms and, before January 2025, had failed to carry out a data
protection impact assessment to properly assess risks to children. As a result, the ICO concluded the company processed children’s data without a lawful basis.
Under UK law, organisations likely to be accessed by children must take extra steps to protect them, recognising they may not fully understand
how their data is collected or used.
In July 2025, following the introduction of new requirements under the Online Safety Act, Reddit began introducing stronger age verification measures and restricted unverified users from viewing certain adult content.
A Reddit spokesperson said the company intends to appeal, arguing that requiring more identity information from users would undermine privacy. “We are deeply committed to our users’ privacy and safety,” the company said.
The ICO said it would continue working with Ofcom to ensure platforms meet their responsibilities, warning that self-declaration alone is no longer enough to protect children online.
regulators found serious failings in the platform’s age checks.
The penalty, the largest ever issued by the watchdog for children’s privacy breaches, follows an investigation that concluded the US-based
company did not have adequate safeguards in place to prevent under-13s from accessing its services.
The ICO said Reddit relied primarily on users self-declaring their age when creating an account, a system it described as easy to bypass and
insufficient under UK data protection law. While Reddit’s terms prohibit children under 13 from using the site, the regulator said its own estimates indicated significant numbers of younger users were active on the platform.
John Edwards, UK Information Commissioner, said it was “concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children”.
The investigation found Reddit had not implemented robust age assurance mechanisms and, before January 2025, had failed to carry out a data
protection impact assessment to properly assess risks to children. As a result, the ICO concluded the company processed children’s data without a lawful basis.
Under UK law, organisations likely to be accessed by children must take extra steps to protect them, recognising they may not fully understand
how their data is collected or used.
In July 2025, following the introduction of new requirements under the Online Safety Act, Reddit began introducing stronger age verification measures and restricted unverified users from viewing certain adult content.
A Reddit spokesperson said the company intends to appeal, arguing that requiring more identity information from users would undermine privacy. “We are deeply committed to our users’ privacy and safety,” the company said.
The ICO said it would continue working with Ofcom to ensure platforms meet their responsibilities, warning that self-declaration alone is no longer enough to protect children online.