UK fines Reddit $19.5 million over children’s data privacy failures

The UK Information Commissioner’s Office (ICO) has fined Reddit £14.47 million ($19.5 million) for failing to implement adequate safeguards to protect children’s personal data.

The regulator concluded that the social media platform unlawfully processed the information of children under 13 and did not put in place sufficient age assurance mechanisms to prevent underage access.

The enforcement action follows an ICO investigation into Reddit, Inc.’s compliance with UK data protection law and the Children’s Code. According to the regulator, the probe found that Reddit had not deployed robust age verification controls before July 2025, despite its terms of service prohibiting children under 13 from using the platform.

The ICO determined that Reddit failed to establish a lawful basis for processing the personal data of underage users because it did not effectively verify their ages. The investigation also revealed that the company did not conduct a Data Protection Impact Assessment (DPIA) addressing risks to children’s data before January 2025. Under UK data protection law, organizations offering services likely to be accessed by minors must assess and mitigate risks to children’s privacy before launching or materially changing such services.

Reddit, founded in 2005 and headquartered in San Francisco, is one of the world’s largest social media platforms, hosting millions of user-created communities known as “subreddits.” The platform allows users to share content, participate in discussions, and access topic-specific forums ranging from hobbies and entertainment to politics and health.

The ICO’s findings indicate that a substantial number of children under 13 were active on the platform during the period under investigation. Because Reddit did not have effective mechanisms to verify age, it could not reliably prevent younger children from creating accounts or accessing content. As a result, children’s personal data, including account details, usage patterns, and potentially behavioral profiling data, was processed without a valid legal basis.

The regulator warned that these shortcomings may have exposed children to inappropriate or harmful content. While Reddit’s terms barred under-13s from using the service, the ICO emphasized that simply setting a minimum age requirement in policy documents is insufficient if technical controls do not enforce it.

In July 2025, Reddit introduced new age assurance measures, including age verification gates for mature content and requiring users to declare their age during account registration. However, the ICO expressed concerns that relying primarily on self-declaration is inherently weak, as it can be easily bypassed by minors entering false birthdates.

In calculating the £14.47 million penalty, the ICO considered several factors, including the estimated number of affected children, the duration of the compliance failures, the potential harm involved, and Reddit’s global turnover.