Reddit fined £14.47 million by UK regulator over children’s data handling

Social media platform Reddit has been fined £14.47 million by the UK's data protection regulator, the Information Commissioner's Office (ICO), concerning the handling of children's data. The ICO stated that Reddit did not implement an effective age assurance mechanism until July 2025, despite its terms of service prohibiting users under 13, leaving the personal data of potentially many young users unprotected and processed without a lawful basis, according to a recent report by The Register.

The ICO's investigation found that prior to January 2025, Reddit had not conducted a Data Protection Impact Assessment (DPIA) on the risks associated with processing the data of users aged 13 to 18, including those under 13. This failure, the regulator claims, potentially exposed these young users to inappropriate or harmful content. Reddit disputes the ICO's findings, emphasizing its commitment to user privacy and stating that it does not require users to share identifying information regardless of age. The platform intends to appeal the decision. Reddit has since implemented a birth date verification process for accessing mature content, utilizing a third-party identity verification service.

This significant fine underscores the UK regulator's increasing enforcement activity under the Online Safety Act, which took effect in July 2025. The ICO is actively investigating numerous other platforms for similar issues related to age assurance and children's data. While Reddit plans to appeal, potentially delaying resolution for years, the ICO's actions signal a stricter regulatory environment for tech companies operating in the UK.

Source: The Register