Reddit Faces £14.47 Million Fine for Children’s Privacy Violations in the UK
In a landmark decision, the UK’s Information Commissioner’s Office (ICO) has imposed a £14.47 million ($19.52 million) fine on Reddit, Inc. for unlawfully processing the personal data of children under 13 years old. The investigation revealed that Reddit failed to implement effective age verification measures, thereby exposing young users to potentially harmful content.
Reddit, a platform with 121 million daily users across numerous communities, explicitly prohibits individuals under 13 from using its services. However, the ICO found that, prior to July 2025, Reddit lacked any substantial age assurance mechanisms. This oversight led to a significant number of underage users accessing the platform, resulting in the unlawful processing of their personal data under UK data protection laws.
The ICO also noted that Reddit did not conduct a Data Protection Impact Assessment (DPIA) before January 2025. A DPIA is a mandatory evaluation designed to identify and mitigate risks associated with data processing activities, especially those involving children. By neglecting this requirement, Reddit failed to adequately assess the potential dangers posed to its younger user base.
UK Information Commissioner John Edwards emphasized the gravity of the situation, stating, Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.
Edwards further criticized the reliance on self-declared age verification, highlighting its insufficiency in protecting children online. He indicated that the ICO is intensifying its scrutiny of platforms that depend solely on this method.
In response to the regulatory pressure, Reddit introduced age assurance measures in July 2025. These measures include age verification for accessing mature content and prompts for users to declare their age during account creation. Despite these efforts, the ICO remains cautious, pointing out that self-declaration can be easily circumvented and that they will continue to monitor Reddit’s handling of children’s data.
A Reddit spokesperson contested the ICO’s findings, stating, The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety. Reddit has announced plans to appeal the ICO’s decision.
This penalty marks the largest fine the ICO has ever issued concerning children’s privacy. It follows a £247,590 fine against MediaLab.AI, Inc., the owner of image-sharing platform Imgur, for similar violations, which led to Imgur’s withdrawal from the UK market.
The ICO is currently investigating 17 other platforms, including Discord, Pinterest, and X, and has initiated discussions with Meta and Snapchat regarding the use of children’s location data. As of October 2025, the regulator estimates that its enforcement actions have positively impacted over 3 million children across various platforms.
In determining the fine amount, the ICO considered factors such as the number of children affected, the potential harm caused, the duration of the violations, and Reddit’s global revenue. This substantial penalty underscores the UK’s commitment to enforcing its Age Appropriate Design Code (Children’s Code) and serves as a warning to the tech industry that self-declaration of age is insufficient to meet legal data protection obligations for platforms accessible to minors.
