Reddit fined £14.47m by UK regulator over children's data failures
UK's ICO fines Reddit £14.47m for failing to verify users' ages and processing children's data without a lawful basis, marking a significant UK enforcement action.
Data
The UK's Information Commissioner's Office this week fined Reddit £14.47m after finding the platform processed children's personal information without a lawful basis and without implementing any robust age verification mechanism. The announcement, dated 24 February 2026, marks the largest penalty the ICO has issued specifically under its children's privacy enforcement programme - and arrives just weeks after a separate fine against a smaller platform demonstrated the regulator's broadening reach.
The core findings
The ICO's investigation established two central failures. First, Reddit did not apply any robust age assurance mechanism, which meant it had no lawful basis to process the personal information of children under the age of 13. Second, the platform had not carried out a data protection impact assessment (DPIA) to evaluate and mitigate risks to children before January 2025. Neither failure was minor or technical. Together, according to the ICO, they left a large number of under-13s on the platform with their data processed in ways they could not understand, consent to, or control.
Reddit's terms of service had always prohibited children under 13 from using the platform. The ICO found that prohibition meaningless without any mechanism to enforce it. There were no checks at account creation that could reliably prevent a child from signing up. There was no system to identify users who were already on the platform and under the minimum age. The gap between policy and practice was, in the ICO's view, not just inadequate - it was unlawful.
John Edwards, UK Information Commissioner, said: "Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today's fine."
Age assurance: what Reddit eventually did
In July 2025, Reddit introduced age assurance measures as part of its compliance work under the UK's Online Safety Act. The implementation required UK users seeking access to mature content to verify their age through one of two routes: a selfie upload using biometric technology to estimate age, or a government ID upload. At account creation, Reddit also began asking users to declare their age.
The ICO informed Reddit, however, that self-declaration alone presents unacceptable risks. Children can simply enter a false date of birth. Self-declaration is easy to bypass, and the regulator is now conducting a specific review of companies that rely primarily on this method. Reddit's current controls remain under active scrutiny.
That distinction - between self-declaration and robust age assurance - is central to the ICO's ongoing enforcement posture. According to the ICO, organisations must match the assurance method to the level of risk on their platform. Where children under a certain age are not permitted to use a service at all, blocking access is the expectation, not merely asking users to confirm their age.
The penalty calculation
In setting the £14.47m figure, the ICO took into account four factors: the number of children affected, the degree of potential harm caused, the duration of the failings, and Reddit's global turnover. The company's scale was relevant. Reddit is not a small operator - its advertising revenue reached $358.6 million in Q1 2025, representing 61% year-on-year growth, and its daily active users reached 108.1 million in the same quarter. A penalty calibrated to a company of that size carries different weight than one levied against a smaller platform.
The fine dwarfs the £247,590 penalty the ICO issued against MediaLab.AI, Inc. - owner of the image sharing platform Imgur - on 5 February 2026, just 19 days before the Reddit announcement. The MediaLab case involved similar structural failures: no age assurance, no DPIA, children's data processed without lawful basis. The two cases together form what the ICO describes as a wider intervention programme targeting platforms where children's personal data is at risk.
The regulatory framework
UK data protection law requires that children receive special treatment with respect to their personal information. The ICO's Age Appropriate Design Code - also known as the Children's code - translates those legal requirements into concrete design standards for online services likely to be accessed by under-18s. The code requires services to act in children's best interests across all aspects of their design and to provide a high level of privacy by default.
Standard 12 of the code requires that profiling for children - including profiling for personalised advertising purposes - be switched off by default. This has direct implications for advertising technology. Programmatic systems that ingest user-level data to personalise content and target audiences become problematic the moment children's data flows through them unidentified. Advertisers may unknowingly target minors. Publishers may violate brand safety commitments. The platform hosting that inventory may face enforcement of exactly the kind Reddit has now encountered.
In December 2025, the ICO published a children's privacy progress update reporting strong results from its proactive supervision programme targeting social media and video sharing platforms. That programme is continuing. The ICO has signalled it will push for further changes where platforms fail to comply with the law or conform to the Children's code, and it will coordinate its work with Ofcom, which holds responsibility for enforcing the Online Safety Act.
The ICO issued its provisional findings to Reddit on 8 July 2025. Reddit submitted representations on those findings. The ICO considered those representations and then reached its decision to impose the fine - a process that took approximately seven months from provisional findings to final penalty.
Implications for digital advertising
The Reddit fine matters beyond child protection enforcement alone. Reddit is an advertising platform. Its Custom Audience API, advertising terms, and expanded advertiser agreements reflect a platform that has been building out its commercial infrastructure aggressively. Advertising on Reddit involves processing user data - and that processing, for UK users who are under 13, was occurring without a lawful basis.
The ICO's enforcement action does not directly address Reddit's advertising business, but the structural failure it identified - the absence of age assurance - has direct consequences for anyone running campaigns on the platform. If a platform cannot confirm that users are above a minimum age, advertisers cannot be confident their campaigns are reaching only the audiences their consent mechanisms and targeting parameters assume.
The new COPPA rules in the United States - which took effect on 23 June 2025, with a full compliance deadline of 22 April 2026 - introduced stricter requirements on consent for third-party data sharing involving children's data. The regulatory pressure on platforms handling children's data is not confined to the UK. It is building simultaneously across multiple jurisdictions, with enforcement timelines that are now beginning to produce visible consequences.
According to the ICO, age assurance tools act as a guardrail to prevent children from accessing services they should not be using, or to help platforms tailor the experience for different age groups. Those tools can also form part of a broader strategy for reducing the data risks children face - and for ensuring that the advertising infrastructure built on top of platform data operates on a lawful foundation.
The regulator was direct about what it expects going forward: "Relying on users to declare their age themselves is not enough when children may be at risk," according to Edwards. That message is not addressed only to Reddit. The ICO has explicitly flagged companies that primarily rely on self-declaration as an area of current focus.
Coordination with Ofcom
The ICO and Ofcom are working in parallel on children's online safety. The ICO handles data protection. Ofcom enforces the Online Safety Act, which imposes its own obligations on platforms regarding children's access to harmful content. Both regulators have identified age assurance as a shared priority. Their coordination matters for platforms navigating overlapping compliance obligations - a data protection failure of the kind Reddit experienced can now trigger scrutiny from two separate regulators with distinct but complementary enforcement powers.
Timeline
- September 2021 - MediaLab begins operating Imgur without age assurance for children in the UK, a period that extends until September 2025.
- January 2025 - Reddit carries out its first DPIA focusing on risks of children's personal information, more than a year after such an assessment was required.
- 8 July 2025 - ICO issues provisional findings to Reddit over children's data processing failures.
- July 2025 - Reddit introduces age assurance measures in the UK, including age verification for mature content and self-declaration at sign-up, following Online Safety Act requirements.
- 23 June 2025 - New COPPA rules take effect in the United States, with full compliance required by 22 April 2026.
- December 2025 - ICO publishes children's privacy progress update reporting strong results from its proactive supervision programme.
- 5 February 2026 - ICO announces £247,590 fine against MediaLab.AI, Inc. for children's privacy failures on Imgur.
- 24 February 2026 - ICO fines Reddit £14.47m for failing to apply age assurance and for processing children's personal data without a lawful basis.
Summary
Who: Reddit, Inc., the US-based social media and content aggregation platform, was fined by the UK's Information Commissioner's Office. John Edwards, the UK Information Commissioner, announced the penalty.
What: A £14.47m fine for failing to apply any robust age assurance mechanism and for processing the personal information of children under 13 without a lawful basis. Reddit also failed to carry out a data protection impact assessment before January 2025.
When: The ICO announced the fine on 24 February 2026. The ICO's provisional findings were issued to Reddit on 8 July 2025. Reddit introduced age assurance measures in July 2025, though the ICO considers self-declaration insufficient.
Where: The enforcement action covers the processing of personal data of UK-based users on Reddit's platform. Reddit, Inc. is incorporated in the United States.
Why: Reddit's terms of service prohibited under-13s from using the platform, but the company had no mechanism to enforce that prohibition. A large number of children under 13 were present on the platform, their data was processed without lawful basis, and they were potentially exposed to inappropriate and harmful content. The fine forms part of a broader ICO programme targeting platforms that fail to implement adequate age assurance under the UK Children's code.