Reddit was fined £14.47 million. Reddit, Inc. was fined £14.47 million ($19.52 million) by the UK's Information Commissioner's Office (ICO) after an investigation found that the social media site illegally processed the personal data of children under the age of 13, neglected to put in place efficient age verification controls, and exposed young users to potentially dangerous content. Reddit's terms of service specifically forbade children under the age of 13 from using the site, which has 121 million daily users across thousands of communities.
However, the platform did not implement any age assurance procedures until July 2025.
Given that many children under the age of thirteen were thought to have been active on Reddit during this time, the ICO concluded that Reddit had no legal basis under UK data protection law to process personal data belonging to underage users. Reddit was found by the regulator to have allowed users between the ages of 13 and 18 to use its platform, but to have neglected to perform a Data Protection Impact Assessment (DPIA), which is a mandatory requirement to assess and mitigate risks to children, prior to January 2025. "Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control," said UK Information Commissioner John Edwards.
They might have been exposed to inappropriate content as a result.
This is intolerable, which is why the fine was imposed today. He also cautioned that the ICO is currently closely examining platforms that mainly rely on user self-declaration of age because it is insufficient. Reddit's Reaction and Age Assurance Measures In July 2025, Reddit implemented age assurance measures, such as requiring users to disclose their age when creating an account and requiring age verification in order to access mature content.
The ICO did, however, warn that self-declaration is still easily circumvented and that it is still keeping an eye on how Reddit handles child data.
"The ICO's insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users' online privacy and safety," a Reddit spokesperson said in response to the regulator's position. Reddit has stated that it plans to challenge the ICO's ruling. When it comes to children's privacy, this is the biggest fine the ICO has ever imposed.
It comes after MediaLab.AI, Inc., the owner of the picture-sharing website Imgur, was fined £247,590 on February 5, 2026, for similar child data breaches, which led to Imgur's complete withdrawal from the UK market. The ICO has started to address concerns with Meta and Snapchat regarding the use of children's location data, and it is currently looking into 17 other platforms, such as Discord, Pinterest, and X.
The regulator estimates that over 3 million children have benefited from its enforcement efforts across multiple platforms as of October 2025. The number of children impacted, the extent of possible harm, the length of the failures, and Reddit's worldwide turnover were all taken into consideration by the ICO when determining the penalty amount. In addition to signaling to the larger tech industry that self-declaration of age alone will not satisfy legal data protection obligations for platforms accessible to minors, the fine highlights the UK regulator's growing commitment to enforcing its Age Appropriate Design Code (Children's Code).
X, LinkedIn, and X for daily updates on cybersecurity. To have your stories featured, get in touch with us.
