UK data watchdog fines Reddit £14.47M for letting kids slip past the gate
- Reference: 1771939787
- News link: https://www.theregister.co.uk/2026/02/24/ico_fines_reddit/
- Source link:
The Information Commissioner's Office (ICO) says Reddit's terms of service prohibited children under the age of 13 from using the platform, yet it claims the company did not introduce an age assurance mechanism until July 2025.
Prior to that point, the ICO suspects "a large number of children under 13" were using the website, all while Reddit did not have a lawful basis for processing their data.
[1]
The regulator claims that before January 2025, Reddit had not carried out a data protection impact assessment (DPIA) on the risks of using children's data, despite having users between the ages of 13 and 18 on the site.
[2]
[3]
A DPIA is a mandatory process that must be completed in order for any organization to comply with European data protection laws (including UK GDPR).
The ICO's insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users' online privacy and safety. We intend to appeal ...
The ICO added that by failing to carry out the required assessments, Reddit was potentially exposing these users, and those under the age of 13, to inappropriate or harmful content.
John Edwards, UK Information Commissioner, said: "It's concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children.
"Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today's fine.
[4]
"Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they're not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place.
"Reddit failed to meet these expectations. They must do better, and we are continuing to consider the age assurance controls now implemented by the platform."
The Register asked Reddit to comment and a spokesperson said: "Reddit doesn't [5]require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety. The ICO's insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users' online privacy and safety. We intend to appeal the ICO's decision."
[6]
The platform says that when users in the UK now try to access mature content, they will be asked to provide their birth date and then go through third-party identity verification to validate that.
It states that it uses Peter Thiel-backed Persona to carry out this process, and can usually be resolved by providing a government ID or a self-submitted headshot.
Persona itself has come under scrutiny in recent days after security researchers [7]claimed the company performs extensive surveillance on the individuals who submit their data, prompting Discord to [8]drop it as a partner .
The ICO issued its provisional findings to Reddit on July 8, 2025, and the fine announced today is a reflection of these findings and Reddit's response.
The regulator, together with Ofcom - the communications regulator - are tasked with enforcing the Online Safety Act, and the ICO has been hot on its enforcement since new rules took effect on July 25.
[9]Keir Starmer declares 'months' timeline for social media age clampdown in UK
[10]Kids learn computer theory with wood, cardboard, and hot glue
[11]OpenAI will try to guess your age before ChatGPT gets spicy
[12]iPad kids are more anxious, less resilient, and slower decision makers
Since March 2025, when the [13]probes into Reddit and TikTok began , the data regulator has [14]fined Imgur parent MediaLab for its lack of age assurance mechanisms, prompting the picture-sharing platform to withdraw from the UK.
The ICO is also investigating 17 other platforms, including Discord, Pinterest, and X, and has begun ironing out issues with Meta and Snapchat over how they use children's location data in their user map features.
As of October 2025, the regulator believes its work has positively impacted more than 3 million children online across several platforms.
Jon Baines, senior data protection specialist at Mishcon de Reya LLP, told The Register : "Any UK GDPR fine of £14.4 million is going to be significant, but given that ICO fines are increasingly rare these days, this one will stand out.
"It's notable that this fine, which arose in part from inadequate age checks, was by the ICO, and not by Ofcom, who arguably also have regulatory jurisdiction under the Online Safety Act."
Baines also said that, given Reddit's likelihood of appealing the decision, the time between issuing the fine and whatever enforcement action is ultimately taken could be years.
"This is an inevitable result of the regulatory scheme in place, but it leaves other data controllers in some uncertainty, whilst the process plays out.
"One part of the fine though, is likely – one assumes – to be relatively uncontroversial: the ICO tells us that there was a failure by Reddit to conduct a data protection impact assessment (DPIA) when one was required. Assuming that is factually correct, it is a simple takeaway for other data controllers: DPIAs are a relatively simple way to both assess data protection risk, and to insulate the controller from aspects of regulatory enforcement." ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZ3ZMxGB8DOhkrG6Qf_aAAAAARY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZ3ZMxGB8DOhkrG6Qf_aAAAAARY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZ3ZMxGB8DOhkrG6Qf_aAAAAARY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZ3ZMxGB8DOhkrG6Qf_aAAAAARY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.reddit.com/policies/privacy-policy
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZ3ZMxGB8DOhkrG6Qf_aAAAAARY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.therage.co/persona-age-verification/
[8] https://redact.dev/blog/discord-persona-age-verification-experiment
[9] https://www.theregister.com/2026/02/16/starmer_social_media/
[10] https://www.theregister.com/2026/01/21/eniac_model_build/
[11] https://www.theregister.com/2026/01/21/openai_bets_on_age_prediction/
[12] https://www.theregister.com/2025/12/30/ipad_kids_are_more_anxious/
[13] https://www.theregister.com/2025/03/03/uk_regulator_investigates_tiktok_and/
[14] https://www.theregister.com/2025/10/01/imgur_exits_uk/
[15] https://whitepapers.theregister.com/
Re: Age gating is fundamentally incompatible with privacy
Mmm. I just lost a 2nd Facebook account to a "Show nude face" demand. A picture of Zuckerborg didn't fool it (OK, noob mistake). Account nuked, no appeal, no way to access or delete "my" data. Just unpersoned on the spot.
That's after losing a first account to "Prove you're over 13 by providing government ID". I'd had that account over 13 years. Again, no interaction was possible other than uploading a passport or driving licence.
"Papers, please" isn't coming, it's already here. If you haven't experienced it yet: don't worry, you will, and soon.
I
So which version is correct?
>> Children under 13 had their personal information collected and used in ways they could not understand
>> Reddit doesn't require users to share information about their identities, regardless of age,
Instead of 'think of the children', how about 'where are the parents?'.
Re: So which version is correct?
Parents should be legally responsible for their children's behaviour until adulthood. They can opt out of that responsibility if they want, but then should incur billing (or more likely, withheld benefits) for the state to take over said duties.
Re: So which version is correct?
Please don't let the state be an option. They'll put Mandelson in charge of that department.
The perpetrator is not held liable?
The logical progression of this is, if I speed in my car against the law, the traffic police will be prosecuted but not me? If I were to hack into say Microsoft, then Microsoft gets fined? It is crazy to hold the platform liable if they have stated there is a minimum age to use the service. There is actually a problem with who is being criminalised by this law.
It also creates a massive hole for peer-to-peer network services if we cannot hold the user liable at all. There is no central registration on P2P services at all, so no-one at all can be held liable, so that will be free access for kids.
Re: The perpetrator is not held liable?
Not quite - in the UK it is illegal to sell alcohol to under 18s, and the store is responsible in the law if they do sell alcohol to an under 18. Saying "I thought the 11 year old was 18 years old" isn't a defence. You have to verify that they are over 18, either by them clearly looking aged, or using ID if there is any question.
The 11 year old is still doing something illegal, but the store is also doing something illegal.
Traffic cops chasing a perp (as long as they are not irresponsibly risking public safety) are not breaking the law.
Microsoft being hacked - Microsoft may not have taken suitable measures to protect the data they hold, so would be guilty of not conforming to data protection laws, but the hacker is still commiting an offence, regardless of what Microsoft may or may not have done to stop them.
Re: The perpetrator is not held liable?
If I were to hack into say Microsoft, then Microsoft gets fined
There's a pretty good case for this yes, it's not helping your point :)
Regarding P2P software I suppose we can only assume the directional of travel will be toward outlawing publishing of software that has capabilities to do such things. But it's a ratchet, there are some other teeth to take control of before then. Where a good stand can be made I really don't know, but the original internet freedoms are under attack.
'effective age assurance measures'
This seems extremely harsh. Nobody was doing, what is now called, 'effective age assurance measures' before July 2025, when the relevant bits of Ofcom's interpretation of the Online Safety Act making clear what was required, came into force. This looks like retrospective application of standards Reddit couldn't possibly have foreseen would be so stringent at the time.
Immediately after July 2025 the site became almost unusable for anyone not willing to pony up privacy invading personal information no matter what their age, with some semblance of sanity only reappearing relatively recently, so they certainly have tried to comply and at great cost to legitimate adult users.
Whatever you position on this whole direction of change, 30 years of internet status quo being up-ended in plus or minus a handful of months surely demands more delicate enforcement than 15mil pound fines?
Re: 'effective age assurance measures'
> the site became almost unusable
I have seen no difference in Reddit before or after July 2025. I have never been asked to verify my age and I am subscribed to several subs that have NSFW pictures posted, including one I added this week.
I'll agree Reddit is often unusable but that is down to their own technical issues and nothing to with age verification.
Re: 'effective age assurance measures'
Experiences might depend on the age/activity/profiling of your account/linking to single-sign-ins and so on. My then 10 year old account with relatively low activity and all data collection opt-outs was blocked from accessing the entirety of all kinds of mundane threads and profiles, seemingly just on the basis of a single slightly out-of-bounds avatar or the profile having once posted a picture of a celebrity attending the BAFTAs or whatever. Literally 2/3rds of threads turned up in routine Google searches about programming or movies or politics entirely blurred.
Obviously, at the time it looked like a massive over-reaction. Now they've been hit with this fine you have to question whether they actually under-reacted by not just shuttering the entire site to UK audiences.
I have a couple of sites hosted in my UK homeland which are not salacious but could require OSA age verification so I simply block access to UK citizens as the easiest, cheapest and privacy protecting option.
I do not consider myself to be denying access to my fellow UK citizens - It is our government doing that.
My position is not going to change until the legislation does or the government takes on responsibility for age verification.
If our government wants UK citizens to enjoy the same benefits as foreign citizens have it's up to them to fix things. If they don't like what I am doing I will simply move those servers overseas.
Age gating is fundamentally incompatible with privacy
The UK is going to have to make a choice: are parents responsible for their own children, or does everyone else have to be identified in everything they do?
It won't stop with porn, it won't stop with "social media." Australia is now age gating search engines. Either people take a stand against this, or we're a few years away from a total identity ecosystem.
The choices will be either "papers, please" or taking a mugshot for every online service you want to use.
Don't forget where those papers and mugshots go. Don't trust Persona. Peter Thiel is one of the largest funders of American fascism.
How much longer can I comment on El Reg before bureaucrats demand my paperwork? Wouldn't want a kid to read salty language, would we? Please, think of the children!