ICO fines Imgur £247,590 over children’s data protection failures

The Information Commissioner's Office (ICO) has issued a £247,590 monetary penalty to MediaLab, the owner of image-sharing and hosting platform Imgur.

Following an investigation, the ICO found that between September 2021 and September 2025, Imgur allowed children to access the platform without basic safeguards required by the Age-Appropriate Design Code (Children's Code) and the UK General Data Protection Regulation (GDPR).

Specifically, Imgur processed the personal information of children under 13 without obtaining parental consent, failed to implement any measures to verify user ages, and did not conduct any data protection impact assessments (DPIAs) to identify and mitigate data protection risks. Because Imgur had no way to determine the age of its users, the ICO concludes that children were exposed to the risk of viewing harmful content, including material related to violence, eating disorders, and antisemitism.

While Imgur's terms of service stated that children under 13 required parental supervision, the ICO found no technical measures in place to enforce this or obtain consent. According to the ICO, the size of the fine reflects the duration of the breach, the potential for harm, and the company's global turnover. MediaLab has accepted the provisional findings and committed to addressing these failings should it restore access to Imgur in the UK in the future. The ICO stressed that further regulatory action may follow if the platform resumes processing UK children's data without implementing the measures it has committed to.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.