The Information Commissioner’s Office (ICO) has found that Reddit, Inc. used children’s personal information unlawfully, including not checking the age of users accessing its platform. It has fined Reddit £14.47 million. The ICO’s estimates indicated that there were a large number of children under 13 on the platform and Reddit did not have a lawful basis for processing their personal information.
The ICO found failures in age assurance under UK data protection law, including Reddit failing to apply any robust age assurance mechanism, thereby not having a lawful basis for processing personal information for children under the age of 13. Reddit also failed to carry out a data protection impact assessment (DPIA) to assess and mitigate risks to children before January 2025. These failures mean that Reddit was using children’s data unlawfully, possibly exposing them to harmful and inappropriate content. This was despite Reddit’s terms of service prohibiting children under 13 using its platform.
In July 2025, Reddit introduced age assurance measures that include age verification to access mature content and asking users to declare their age when opening an account. This was to comply with the Online Safety Act 2023.
However, the ICO informed Reddit that relying on self-declaration still presents a risk to children as it is easy to bypass. It is keeping Reddit’s processing of children’s personal information under review as part of an ongoing operation focusing on online platforms that rely on self-declaration, which is an area of focus for the ICO, set out in its December 2025 children’s privacy progress update.
In setting the penalty amount, the ICO considered the number of children affected by the infringements, the degree of potential harm, duration of the failings and Reddit’s global turnover.
Earlier in February, the ICO also fined Imgur owner MediaLab £247,590 for children’s privacy failures. It concluded that it had failed to implement any measures to check the age of users; processed the personal information of children under 13 without parental consent or any other lawful basis when offering online services and failed to carry out a data protection impact assessment to identify and reduce privacy risks to children.
Reddit has indicated that it intends to appeal.
