Reddit fined £14m over children’s data protection failures
Social media platform Reddit has been fined £14.47m by the Information Commissioner’s Office (ICO) after a probe found it unlawfully processed children’s personal information.
The platform was also found to have failed to implement adequate age checks.
The UK data protection regulator said the US-based company did not implement robust age assurance measures, meaning it had no lawful basis for processing the data of children under 13 on its platform.
It has also failed to carry out a data protection impact assessment (DPIA) to assess and mitigate risks to children before the January 2025 deadline.
The ICO said these shortcomings left children potentially exposed to inappropriate and harmful content.
Under UK data protection law, companies must have a lawful basis to process personal data and are required to provide enhanced protections for children.
Services likely to be accessed by under-18s must comply with the ICO’s Age Appropriate Design Code, also known as the children’s code.
Although Reddit’s terms of service ban children under 13 from using the platform, the ICO found that, until July 2025, it had no effective mechanisms to verify users’ ages.
The regulator said its estimates indicated a large number of under-13s were using the service during the period under investigation.
In July 2025, Reddit introduced age verification for accessing mature content and required users to declare their age when opening an account.
However, the ICO said relying on self-declaration carries risks because it can be easily bypassed.
The regulator confirmed it is continuing to review Reddit’s current controls as part of wider work focusing on platforms that depend primarily on self-declared age information.
John Edwards, the UK Information Commissioner, said: “It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children.”
“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”
He added that companies operating online services likely to be accessed by children must ensure they have effective age assurance measures in place.
In determining the level of the fine, the ICO said it considered the number of children affected and the harm caused, as well as the duration of the failings and Reddit’s global turnover.
The penalty follows a separate enforcement action against MediaLab and forms part of a broader intervention by the regulator aimed at improving how online platforms handle children’s data.