UK data watchdog the Information Commissioner’s Office (ICO) has fined Reddit £14.47 million after finding the social media platform unlawfully processed children’s personal data and failed to put in place effective age checks.
The penalty follows a lengthy investigation which concluded that Reddit lacked robust systems to verify users’ ages, despite its own terms of service prohibiting children under 13 from accessing the platform.
According to the ICO, Reddit did not apply any meaningful age assurance measures before July 2025. As a result, it did not have a lawful basis to process the personal information of under‑13s who were using the service.
The regulator also found that Reddit failed to carry out a data protection impact assessment (DPIA) to identify and mitigate risks to children prior to January 2025. This meant children’s data was collected and used without adequate safeguards, potentially exposing underage users to inappropriate or harmful content.
Reddit introduced new age assurance measures in July 2025, including age verification controls for mature content and requiring users to declare their age when creating an account. However, the ICO warned that self‑declaration mechanisms are easily bypassed and said it remains concerned about platforms that rely heavily on this approach.
In determining the size of the penalty, the ICO said it considered the number of children affected, the potential harm caused, the duration of the failings and Reddit’s global turnover.
The watchdog added that it is keeping Reddit’s current age assurance controls under review as part of its ongoing supervision of services accessed by children.
Information commissioner John Edwards said children under 13 had their personal information collected and used in ways they could not understand, consent to or control, leaving them potentially exposed to content they should not have seen, which he described as “unacceptable”.
“Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used,” he added. “To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place.”
The ICO said the fine forms part of its broader efforts to improve how online platforms protect children’s data and stressed that safeguarding children’s privacy online remains a key priority.
It added that it will continue to scrutinise platforms that rely primarily on self‑declared ages and will work alongside Ofcom to ensure coordinated enforcement under the Online Safety Act.
