ICO fines Reddit £14.47m over failure to protect children's data

The UK’s Information Commissioner’s Office has fined social news aggregation site Reddit a £14.47 million monetary fine for unlawfully processing the personal information of children under the age of 13 and failing to conduct a data protection impact assessment to mitigate risks to children.

 

The data protection watchdog said Reddit failed to apply robust age verification checks on its platform, thereby exposing children under the age of 13 years to inappropriate and harmful content. The failure occurred despite Reddit announcing in July 2025 that it had introduced measures to verify the age of users before letting them access mature content and declare their age when opening an account.

 

"It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children," said Information Commissioner John Edwards. "Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine."

 

The information protection watchdog opened an investigation into Reddit’s age assurance practices in March 2025, stating that it intended to investigate how the platform used age verification measures and used children’s personal information. The ICO announced parallel investigations into TikTok and Imgur at the same time.

 

"If social media and video sharing platforms want to benefit from operating in the UK they must comply with data protection law," Edwards said. "The responsibility to keep children safe online lies firmly at the door of the companies offering these services and my office is steadfast in its commitment to hold them to account."

 

According to the watchdog, Reddit not only failed to accurately implement age verification measures, but also failed to carry out a data protection impact assessment focussing on the risks of using children’s personal information before January 2025. This was despite the platform allowing children between 13 and 18 to create new accounts and access content.

 

"Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms," Edwards added.

 

The social news aggregation platform said it would appeal the ICO’s decision to impose a fine based on its investigation.

 

"Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety. "The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety," the company said.