UK slaps Reddit with $20m fine for age verification and privacy breaches, warns other platforms to “take note”

The Information Commissioner’s Office has fined Reddit £14.5m pounds (almost $20m dollars) after finding the platform relied on easily bypassed age checks and unlawfully processed children’s data.

It is the largest fine ever handed out by the information watchdog over children's privacy issues.

The UK regulator said the online chat platform depended largely on users self-declaring their age when creating accounts – a method that it warned was ineffective at protecting children and one that does not meet legal expectations where risks are present.

Because of this, the regulator argued that Reddit had no lawful basis to process the personal data of children under 13 who were using the platform.

Lack of safeguards

Although Reddit’s terms of service prohibited users under 13 from using the platform, the regulator found that the company failed to enforce that rule until July 2025, when it did so to comply with the Online Safety Act.

The regulator added that the company did not carry out the required data protection impact assessment (DPIA), which examines risks to children, before January 2025.

Under UK GDPR laws, firms must carry out such assessments before processing data that could pose a high risk and failing to do so is an offense.

The ICO’s age appropriate design code (also known as ‘the Children’s code’) translates the UK’s legal requirements into design standards for online services likely to be accessed by under 18s.

Failing to meet any of these requirements meant that “a large number of children’s data” was collected by the online platform and used without adequate protections, potentially exposing them to inappropriate or harmful content.

UK information commissioner John Edwards said relying on self-declaration “is not enough when children may be at risk,” adding that companies must be confident they know the age of their users and apply effective safeguards.

According to Edwards, the fine took into consideration company turnover, the duration of the failings, as well as the number of children affected and the potential degree of harm it caused.

The commissioner added that he hoped that other companies were taking note.

"Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms."

UK information commissioner, John Edwards

Reddit said that it intends to appeal against the fine and doesn't require users to share details about their identities, regardless of age, because it is "deeply committed to user safety and privacy."

Self-declaration – the scrutiny continues

The regulator said it is keeping Reddit’s processing of children's personal data “under review” as part of its work focusing on online platforms that primarily rely on self-declaration, an area of scrutiny for the regulator.

The ICO first started investigating the platform last March, alongside TikTok and image-sharing site Imgur over concerns about their use of children’s data.

Earlier this month, Imgur was fined £247,590 for failing to use children’s personal information lawfully.  TikTok meanwhile is in the process of appealing its own 2023 penalty for children’s date misuse, with a hearing scheduled for May 2026.

Unlock more exclusive Cybernews content on YouTube