UK's ICO fines £14.5 million for inadequate age verification
A £14.5 million enforcement penalty and a regulatory determination constrain Reddit's handling of children’s personal data. Regulators also flagged the company's post‑July 2025 age‑verification approach for relying on users to self‑declare ages.
Change
UK's ICO fined £14.5 million, finding the company unlawfully processed personal data of children under 13 and failed to carry out a required data protection impact assessment before January 2025.
Why it matters
Platforms that rely mainly on user self-declaration for age are now constrained: regulators expect proportionate, auditable age-assurance measures for services likely to pose high risks to children. The ICO has signalled it will prioritise further regulatory engagement and enforcement against high‑risk services that continue to use self-declaration in isolation.
Implications
- — Online platforms that primarily rely on self-declaration for user ages must adopt robust, proportionate age-assurance methods for UK users or face regulatory enforcement.
- — Product and compliance teams of platforms offering mature-content access in the UK must complete and document a data protection impact assessment before processing children’s personal data or deploying age-verification features.
Unlock the decision layer.
Know what's at risk and what to do next.
- Implications: What this forces you to change — operations, exposure, or compliance.
- Who is affected: Which roles, contracts, and obligations are exposed.
- What to watch: Binding deadlines and enforcement dates.
- Real-time alerts: Delivered the moment a binding change is published.
- Ask AI: Ask what this means for your specific role.
No credit card · 14-day trial · Active in seconds
Unlock the decision layer