ICO fines Reddit £14.47m over children's data protection failures

The Information Commissioner's Office (ICO) has issued a formal monetary penalty of £14.47 million to Reddit for the unlawful processing of children's personal information. Following an investigation, the ICO revealed that the social media platform failed to implement robust age assurance mechanisms, lacked a lawful basis for processing data belonging to children under the age of 13 and did not conduct a data protection impact assessment (DPIA) to mitigate risks to children until January 2025, despite the platform being accessible to children over the age of 13.

Furthermore, according to the ICO's estimates, a significant number of under 13 year-olds were using the platform, potentially exposing them to inappropriate and harmful content. While Reddit's terms of service prohibited users under 13, the ICO reported that the platform had no age-verification measures until July 2025. Reddit has since introduced age verification for mature content and a self-declaration system for new accounts. However, the ICO has warned that relying on self-declaration is easy to bypass and presents ongoing risks.

The financial penalty amount was determined based on the number of children affected, the duration of the failings, the potential for harm, and Reddit's global turnover. The ICO intends to keep the company's data processing under review as part of a wider focus on online platforms that rely on age self-declaration.

In a statement, Information Commissioner John Edwards said, "Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they're not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. 

"Reddit failed to meet these expectations. They must do better, and we are continuing to consider the age assurance controls now implemented by the platform.

"Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms."

In response to the enforcement action reported by The Register, a spokesperson for Reddit said: "Reddit doesn't require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety. The ICO's insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users' online privacy and safety. We intend to appeal the ICO's decision."

The article notes, however, that Reddit uses the Peter Thiel-backed age assurance system, Persona, which has recently come under scrutiny for the extent of its data-processing capabilities.

On a technical point, the ICO has not yet published the monetary penalty notice for its action against Reddit. In the recent enforcement action against Imgur, the ICO noted that it was "considering the redaction of personal and commercially confidential or sensitive information ahead of publishing the monetary penalty notice." This statement was made on 5 February, raising questions about the complexity of the redaction process. In the interest of transparency, we have submitted a request under the Freedom of Information Act 2000 to inquire whether the penalty notices for Reddit and Imgur will be made available at a later date.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.