The UK’s Information Commissioner’s Office has imposed a £14.5 million fine on Reddit for unlawfully processing data belonging to children under thirteen. The platform failed to prevent young users from accessing inappropriate content and did not maintain proper safeguards during their engagement with the service.
Reddit’s verification system relied entirely on users self-declaring their age when creating accounts. The ICO determined this approach was insufficient and easily circumvented, leaving the platform unable to establish a legitimate legal basis for collecting and using children’s personal information before January 2025.
The company did not conduct a data protection impact assessment to identify and address potential harms to minors. According to information commissioner John Edwards, children’s personal data was collected without their understanding or control, exposing them to harmful material they should never have encountered on the platform.
This penalty ranks as the third largest fine issued by the ICO, following a £20 million sanction against British Airways and an £18.4 million penalty against Marriott Hotels. It represents the most significant enforcement action specifically targeting violations of children’s privacy rights.
Reddit has announced plans to challenge the decision, arguing that requiring additional personal information contradicts privacy principles. The company maintains it does not mandate identity verification and removes underage users from the platform. Since July, Reddit began implementing age verification for users accessing mature content through photo ID or selfie uploads.
Regulators emphasized that online services accessible to children must implement effective age assurance mechanisms to prevent exposure to risks. Companies operating such platforms bear responsibility for protecting minors through appropriate data handling practices and robust verification procedures.
