REGULATORY · UK
UK regulator fines Reddit over inadequate age assurance for children’s data processing
Change
The UK Information Commissioner’s Office fined Reddit £14.5 million for failing to implement robust age assurance, finding it unlawfully processed personal data of children under 13 (based on conduct before Reddit’s July 2025 UK age-check rollout).
Why it matters
The ICO concluded Reddit lacked a lawful basis to process personal information of children under 13 because it did not apply a robust age assurance mechanism, and imposed a £14.5 million penalty. The regulator tied the violation to Reddit’s practices before its July 2025 UK system that verifies ages before access to adult content. The ICO also stated ongoing concern with Reddit’s post-July 2025 approach because it relies on users declaring their age at account creation. The action increases compliance and enforcement risk for online services that depend on self-attestation for age gating while processing minors’ data.
Implications
- • £14.5m penalty sets a concrete enforcement cost for weak age assurance.
- • Self-declared age checks are explicitly flagged as potentially inadequate by ICO.
- • Children’s data processing without robust age assurance treated as unlawful under-13.
- • Post-launch mitigations may not eliminate regulator scrutiny of current controls.
Who is affected
- • Reddit (UK operations and product compliance teams)
- • Online platforms processing UK minors’ personal data
- • Adtech/analytics vendors receiving data from platforms with under-13 users
- • UK-based child safety and data protection compliance functions
Source
Read full article on Ars Technica →
Topics
Law & Public Safety Regulatory Actions Compliance Data Privacy