Britain’s data protection regulator has fined Reddit £14.47 million after finding the platform unlawfully processed children’s personal data and failed to implement adequate safeguards to verify the age of its users.

The UK Information Commissioner’s Office (ICO) said its investigation revealed that Reddit lacked robust age assurance mechanisms, allowing children under the age of 13 to access the platform despite the company’s terms of service prohibiting their use. As a result, the regulator concluded that Reddit did not have a lawful basis for processing the personal information of those users.

The ICO also found that the company failed to conduct a data protection impact assessment (DPIA) examining risks to children until January 2025, despite allowing teenagers between the ages of 13 and 18 to use the platform. Without proper risk assessments or safeguards in place, children were potentially exposed to inappropriate or harmful content.

John Edwards, the UK Information Commissioner, said the findings highlight serious shortcomings in how online platforms protect young users.

“It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children,” Edwards said. “Children under 13 had their personal information collected and used in ways they could not understand, consent to or control.”

According to the ICO, evidence suggested a significant number of under-13 users were active on the platform before stronger controls were introduced. Reddit began implementing age assurance measures in July 2025, including requiring users to declare their age when creating an account and introducing verification for mature content. However, the regulator warned that self-declaration alone can be easily bypassed and does not provide sufficient protection.

The ICO said the fine reflects the number of children potentially affected, the duration of the violations, and Reddit’s global turnover.

The penalty follows a separate enforcement action against MediaLab and forms part of a broader effort by UK regulators to strengthen protections for children’s data online. The ICO said it will continue monitoring platforms that rely primarily on self-declared age verification and will push companies to adopt stronger safeguards in line with the UK’s Children’s Code.

Need Help?

If you have questions or concerns about any global guidelines, regulations and laws, don’t hesitate to reach out to BABL AI. Their Audit Experts can offer valuable insight, and ensure you’re informed and compliant.