UK’s Information Commissioner’s Office fines Reddit £14.5 million for unlawfully processing children’s data, highlighting the importance of robust age verification measures in online platforms.
The UK‘s Information Commissioner’s Office (ICO) has fined social media platform Reddit £14.5 million for unlawfully processing the personal data of children under the age of 13, potentially exposing them to harmful content. ‘Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control,’ he said.
The penalty, the third-largest in ICO history, follows an investigation into Reddit‘s age verification practices and data protection measures under the . The decision underscores growing regulatory scrutiny of tech companies’ handling of children’s data in the UK.
Regulatory Action and Legal Context
The ICO, the UK’s independent authority , cited failures by Reddit to ensure the lawful processing of children’s data. According to the regulator, the platform did not have a lawful basis to collect personal information from users under 13 prior to July 2025, when age checks were introduced.
The ICO also found that Reddit failed to conduct a required data protection impact assessment (DPIA) to evaluate risks to children’s privacy before January 2025. ‘This is unacceptable and has resulted in today’s fine,’ he said.
John Edwards, the UK information commissioner, stated that ‘s reliance on self-declaration for age verification posed significant risks.
The emphasized that companies must ensure they can verify the age of users accessing their services, particularly when handling data that could expose minors to inappropriate content.
Reddit’s Response and Legal Appeal
Reddit has announced it plans to appeal the decision, arguing that the ICO’s interpretation of the law would require the company to collect more private information from users, contradicting its commitment to privacy and safety. ‘We do not require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety,’ a spokesperson stated.
The company claims it removes users under 13 from its platform but acknowledged that prior to July 2025, it did not have robust age assurance measures in place. Since that date, Reddit has required UK users who wish to access mature content—such as pornography—to verify their age by uploading a selfie or a government-issued ID, as mandated by the Online Safety Act.
Broader Regulatory Trends
The £14.5m fine places among the largest penalties issued by the ICO. It follows earlier high-profile cases, including a £20m fine against British Airways for a 2018 data breach affecting over 400,000 customers and an £18.4m penalty against Marriott International for a 2014 data breach impacting 300 million records.
These cases highlight the ICO’s focus on enforcing standards, particularly for services that may be accessed by children.
The , which underpins this enforcement, mandates that platforms take proactive steps to protect users, especially minors, from online harms. The law requires companies to implement age verification mechanisms and conduct regular risk assessments.
The ’s actions against Reddit reflect its broader strategy to hold tech firms accountable for their data practices, particularly in cases where children’s privacy is at risk.
Implications for Tech Companies
The ruling has significant implications for online platforms operating in the UK. It reinforces the necessity for companies to adopt robust age verification systems and to ensure compliance with data protection laws. For Reddit, the fine underscores the challenges of balancing user privacy with regulatory obligations, particularly as governments worldwide tighten oversight of digital services.
As the appeal process unfolds, the case will likely serve as a benchmark for how regulators assess the responsibilities of tech firms in safeguarding children’s data. The outcome may influence future compliance strategies and legal interpretations of data protection laws in the digital age.
