Reddit fined £14.5 million for using children’s data unlawfully
The UK Information Commissioner’s Office (ICO) has fined Reddit £14.47 million for using children’s personal information unlawfully.
The UK’s data protection watchdog investigated the popular social media platform and found that the platform potentially exposed children to inappropriate and harmful content through its failure to use their personal information lawfully.
The ICO’s investigation found that Reddit failed to apply any robust age assurance mechanism as required under the Online Safety Act, and as such it had no legal basis for processing the personal information of children under the age of 13.
It also found that the company failed to properly assess and mitigate the risks to children around the processing of their personal information before January 2025.
The ICO noted that in July 2025, Reddit introduced age verification checks to prevent underage users from accessing mature content. However, these checks simply required users to declare their own age when creating an account.
This self-declaration method of verifying user age is easily bypassed, the ICO said, and it informed Reddit that this subsequently presents a risk to children, potentially allowing them to access harmful or inappropriate content.
According to the ICO’s findings, a large number of children under 13 were using the platform, and Reddit did not have a lawful basis for processing their information.
The regulator said it is keeping the company’s processing of children’s personal information under review as part of its ongoing work to crack down on websites that use self-declaration as a form of age assurance.
“It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children,” said UK Information Commissioner John Edwards.
“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”
“Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place,” he said.
“Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform.”
Edwards added that the industry should take note of this fine and adapt their age verification measures to move away from self-declaration and towards more robust age assurance mechanisms.
“Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method,” he said.
“I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms.”
