>> The Information Commissioner's Office's (ICO) interim executive director, Tim Capel, said on Tuesday that its findings from the investigation were provisional, and the regulator would consider any evidence presented by MediaLab before proceeding with a fine.

Translation: we found them guilty. Let's see if they can present any evidence to get out of it.

>> Capel also hinted that even if Imgur continues to block UK users, the ICO may still seek to penalize its parent company.

Good luck with that. It's an American company. The last time I checked they had a revolution to kick out shit people like the ICO.

The ICO has always been a bullshit organisation. It's a place where useless hand wringers go to polish seats as they squirm on their arses.

Given that Imgur has withdrawn from the UK, it looks like they believe the ICO has teeth. And doing business in the UK means you follow UK law *even if* you don't like those laws. The same applies for any internet based company doing business in any country. You follow the native laws, even if your servers are based outside that country. Sometimes that will mean you have to block geographical IP addresses because you can't or don't want to obey local laws.

It's very similar to having to obey import and export laws for physical goods.

They may believe it, but without a financial presence in the UK, there's not much the ICO can actually do to extract a fine. The only next step available is for OFCOM to require ISPs to block the site. Imgur has simply made that decision for them.

As for following the law; as written, that is essentially impossible. The burden it places on websites is not only expensive, but technically insurmountable for any site that allows inter-personal communication. The only way to fully comply, without leaving yourself open to inevitable loopholes and oversights, is to block all traffic from the UK. Even that can be technically considered a material breach of the law, as it prevents the ICO from assessing compliance while still allowing UK visitors via VPN.

When a law cannot be obeyed, it is objectively bad law.

It's no different to the various US sites blocking EU traffic as they can't or don't want to comply with GDPR.

The difference is that the UK sites blocking the EU are typically US local news sites that few outside the US visit. The services that are being and will be blocked from the UK are major sites. Basically, the UK is now China. If you were considering a job or Uni place in the UK, ask yourself if you would be happy working in China, with all its internet blocks. If not, don't get a job or Uni place in the UK.

>> They may believe it, but without a financial presence in the UK, there's not much the ICO can actually do to extract a fine.

This. The ICO can pass round the plate of biscuits and tut.

They can also huff and puff or simply pretend everything is fine instead of extracting a fine.

Or, you know, they can place enough pressure on credit card companies and advertisers that Imgur's revenue streams are damaged enough that Imgur cought up the fine.

You know this isn't about the Online Safety Act, right? A quick Googling reckons the reason the Imgur is in trouble with the ICO is that it:

1) Did not ask users to state their age when signing up

2) Did not use any techniques to estimate or verify users’ ages during account setup

3) Did not ensure children’s profiles are high privacy by default

4) Did show adverts to children, including targeted ads based on age and location

These are GDPR-related and not difficult to comply with, unlike some provisions of the OSA.

That's a fair point. I've had the OSA on my mind a lot recently, so I guess I defaulted to arguing against it. However, you can be certain they've received a OSA notification to imgur as well within the last couple of months. That letter, combined with the recent threat of a fine for the issues you've outlined, is likely what prompted them to throw up their hands and reach for a geoblock.

Besides, GDPR is a more difficult to comply with that you seem to think. One might say just record the absolute minimum PII necessary to operate, but they're specifically being dinged for not implementing special considerations for juvenile accounts, which requires obtaining some quantity of PII beyond an e-mail and IP address. Ultimately, whatever magic techniques people might believe exist, there is no way to fully determine if someone is a child without asking for some form of ID (and even then they might lie). Asking for ID means at least temporarily obtaining sensitive PII, which in the case of a subsequent subject access request then opens you up to liability for potential failure to prove you've removed it. Proving you don't have something is not an easy task.

Anyone who actually has to deal with GDPR knows it's difficult and costly to comply with at the best of times, even when you're making the best effort and operating well in the black. When you're starting from the back foot and already operating at a near-loss, it's going to be a expensive nightmare. Much easier to just cut off the problem at source, as so many other non-european services have done.

but they're specifically being dinged for not implementing special considerations for juvenile accounts, which requires obtaining some quantity of PII beyond an e-mail and IP address.

Treat all accounts as juvenile until proven otherwise. Not hard to do, but it also might affect shareholder value - unacceptable!

1) Did not ask users to state their age when signing up

2) Did not use any techniques to estimate or verify users’ ages during account setup

3) Did not ensure children’s profiles are high privacy by default

4) Did show adverts to children, including targeted ads based on age and location

Curiously (4) appears to imply (2) was satisfied.

The whole exercise seems on the verge of becoming Pythonesque theatre undoubtedly inspired by The Ministry of Silly Walks or The Fish Slapping Dance .

When "thinking of the children" it is worth remembering they will grow very quickly into adulthood to look back at their elders and think, quite rightly, "what a lot of silly bunts."

"Good luck with that. It's an American company."

1) MediaLab AI Inc. has other brands that currently operate in the UK.A full withdrawal of all services would be required.

2) MediaLab AI will want to not do business in any country that is a Hague Convention signatory either, I guess?

Enforcement of fines in other jurisdictions is patchy at the moment, but since this is a protecting-children-online related fine, and MediaLab AI is based in California, and California has recently created a similar law, it might be easier than you think. (Enforcement of foreign judgments is not a federal matter in the US.)

MediaLab AI Inc. has other brands that currently operate in the UK.A full withdrawal of all services would be required

Worth mentioning they also own Kik Messenger, which has it's own controversy surrounding use by minors which pre-dates acquisition by Medialab. Also Whisper which seems to have shut-down(*).

The common theme for these brands is anonymity, so they may feel that's a core value incompatible with the UK market. But it's obviously not an easy offering in a lot of other places too now. Or they may just be running these brands into the ground on purpose while collecting data or who knows what.

(*) https://www.forbes.com/sites/thomasbrewster/2025/04/08/the-wiretap-plagued-by-child-predators-former-200-million-whisper-app-has-disappeared/

Coming soon to GB land, a China-style social credit system :o

It's a tory-brexiter law passed by the tory-brexiters in 2023.

This isn't the Online Safety Act. It's a GDPR thing. Imgur aren't putting in any measures to try to determine if a user is a child and still sends them targeted ads, which is against GDPR.

It isn't vanilla GDPR though. It's an extra added to the Data Protection Act over-and-above EU requirements.

Passed under the Tories, but the Lords amendment had cross-party support and was initiated by a genuinely cross-bench peer and debated with - as far as I can see - no real opposition (in fact very enthusiastic support from all parties):

https://hansard.parliament.uk/lords/2017-12-11/debates/154E7186-2803-46F1-BE15-36387D09B1C3/DataProtectionBill(HL)

GDPR isn't a Tory law. It's adopted from the EU and is actually a pretty damn good bit of legislation. If you can't comply with GDPR then you really shouldn't be providing web services of any sort.

>>GDPR isn't a Tory law. It's adopted from the EU

Err I think you will find the main driver behind the GDPR (EU) was.... the UK! When we divorced our geographical neighbours we just copied the GDPR(EU) legislation into our own as an interim measure (and we all know how interim measures go)

>>is actually a pretty damn good bit of legislation

Yup. It, unusually, does what it says on the tin

>>If you can't comply with GDPR then you really shouldn't be providing web services of any sort.

Indeed.

When we divorced our geographical neighbours we just copied the GDPR(EU) legislation into our own as an interim measure (and we all know how interim measures go)

Not quite right. We enacted the EU Regulation into UK law via the Data Protection Act 2018. This is normal - you require a bit of domestic legislation to deal with local/domestic legalities of things like "you must have a regulator".

So we didn't copy GDPR into UK law at the point of Brexit. It was already a part of UK law which would require manual repeal by Parliament, and we haven't bothered (although such a move would be Very Bad TM for British business given that it would halt data transfers between us and our biggest trading partner).

I hope that was [1]451 ( [2]Ray Bradbury reference ).

[1] https://en.wikipedia.org/wiki/HTTP_451

[2] https://en.wikipedia.org/wiki/Fahrenheit_451

This is just utterly atrocious news, a big pile of steaming poo

Easy option is to exit the UK, it just doesn't matter.

The inevitable consequence of squandering genuine power and influence in return for the fantasy of sovereignty.

These power-crazed goons hurt only the UK. US companies will just disconnect the UK from the Internet.

I saw that Bible Gateway, the main site for looking up bible verses in all sorts of languages, vanished. No doubt the ICO threatened them too.

So authoritarian.

Britain is not a free country. Think of the children is now the excuse for every kind of state surveillance.

Not sure why you getting downvotes. Government is bought by big corporations. They "voted" for these changes with their brown envelopes, which carry more weight than ballot papers. Politician cannot buy a mansion showing the poll results.

It's not a UK-originated law that was broken but GDPR which applies across the EU (and the UK).

The breaches of GDPR are pretty damn obvious and easy to rectify.

Bible Gateway is readily accessible from the UK.

US companies will do nothing that hits their bottom line.

That's ok we'll do fine without your Christian fundamentalist crap. In fact we forced you to travel across an entire ocean to subjugate another country because we didn't want it in the first place.

While looking at the age verification of Reddit I noticed it only forces you to verifiy your age if you are logged in. To view adult subreddits without verifying your age you can logout or open an incognito window then right click and inspect element on the mature content warning and delete the "blocking-modal" to view it. Ublock origin already has rules for this in its optional "uBlock filters – Annoyances" list.

With blocking that innefective im sure they will be next for a fine from the ICO/Ofcom and posibly blocking the UK as its easier.

Reddit is indeed under investigation for almost exactly the same GDPR offences.

Since the ICO is a gov dept they are almost certainly just using Windows and Google Chrome as their browser.

Any mention of Firefox or Ublock Origin an they will probably look at you with their head tilted like a confused puppy.

Reddit has age verification?

I have not seen it and my account is not old enough to vote.

It does for certain elements deemed to be NSFM (M being minors), using facial age estimation.

Its just one image, a purple one, but legally no different, surely?

With this sort of thing and the Online Safety Act, maybe all social media companies will have to withdraw from the UK,

Making the UK instantly the happiest and most productive country in the world.

All small social media companies. The law is glaringly obviously written for benefit of Facebooks. Corrupt to the core.

Just shut off all internet for the UK until their government stops the BS.

It's still possible for UK residents to access Imgur via VPN. It does make it unlikely that Brits will see imbedded images but those with enough interest to log into the site can still get there.