The UK’s data protection authority, the Information Commissioner’s Office (ICO), has levied a fine of £14.47 million ($19.5 million) against Reddit for inadequately safeguarding children’s data. This penalty stems from the platform’s failure to implement age verification measures, allowing users under the age of 13 to access the site without appropriate safeguards.
Regulatory Findings and Violations
The ICO’s investigation revealed that Reddit’s terms of service explicitly prohibited children under 13 from using the platform. However, the regulator suspects that a significant number of these children were active users prior to the introduction of an age assurance mechanism in July 2025. The ICO noted that Reddit had not conducted a Data Protection Impact Assessment (DPIA) concerning the risks associated with processing children’s data, despite having users aged 13 to 18 on the site.
Reddit’s Response and Appeal Plans
In response to the fine, Reddit has stated its commitment to user privacy and safety, asserting that it does not require users to disclose personal information, regardless of age. A spokesperson for the platform indicated that the ICO’s demand for more private data collection contradicts their privacy principles. Reddit plans to appeal the ICO’s decision.
Implications for Age Assurance and Compliance
As part of its new measures, Reddit now requires users in the UK to provide their birth date and undergo third-party identity verification when attempting to access mature content. This verification process is facilitated by Persona, a company backed by Peter Thiel, although Persona has faced scrutiny for its data handling practices.
Broader Regulatory Context
The ICO’s actions are part of a broader enforcement strategy under the Online Safety Act, which has seen increased scrutiny of platforms like Reddit and others, including Discord and Pinterest. The ICO has been actively investigating various platforms for compliance with age assurance regulations, with the aim of protecting children online. As of October 2025, the ICO claims its efforts have positively impacted over 3 million children across multiple platforms.
Legal experts have noted that while the fine is significant, the appeal process could prolong the resolution, leaving other data controllers uncertain about compliance expectations. The ICO’s findings emphasize the necessity for organizations to conduct DPIAs to mitigate regulatory risks.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
