UK fines Reddit $19 million for using children’s data unlawfully

The UK Information Commissioner's Office (ICO) has imposed a substantial £14.47 million (over $19.5 million) fine on Reddit for collecting and processing the personal information of children under 13 without adequate safeguards. This enforcement action underscores the increasing regulatory focus on social media platforms' responsibilities to protect underage users' privacy.

According to the ICO's Tuesday press release, Reddit operated without a meaningful age-verification system until July 2025, despite its own terms of service prohibiting users under 13. The regulator estimates that a significant number of underage children were using the platform before this date, with their data processed without lawful basis and potentially exposed to harmful content.

The timing of Reddit's implementation of age assurance measures raises questions about the platform's approach to child safety. In July 2025, the company introduced an age verification system for accessing mature content and a self-declaration prompt for new accounts. However, the ICO criticized these measures as insufficient, noting that children can easily bypass them.

UK Information Commissioner John Edwards emphasized the severity of the violation: "It's concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children. Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen."

Edwards also highlighted a broader industry concern, stating that relying on users to declare their age themselves is inadequate when children may be at risk. The ICO is now focusing on companies that primarily use self-declaration methods for age verification, urging the industry to reflect on their practices and make necessary improvements.

Reddit has announced its intention to appeal the ICO's decision. A company spokesperson told BleepingComputer that "according to external market research, the vast majority of Reddit users in the UK are adults." The spokesperson also emphasized Reddit's commitment to user privacy and safety, arguing that the ICO's insistence on collecting more private information from all UK users is "counterintuitive and at odds with our strong belief in our users' online privacy and safety."

This fine follows a similar penalty issued on February 5 against MediaLab, the owner of the image-sharing platform Imgur, over children's privacy failures. The pattern of enforcement actions suggests that data protection authorities are increasingly scrutinizing social media platforms' compliance with child protection regulations.

Reddit reports having 121 million daily active users and over 471 million weekly active ones, spread across more than 100,000 active communities. The platform's scale and the nature of user-generated content make effective age verification particularly challenging, but the ICO's action demonstrates that size does not exempt companies from their legal obligations to protect children's data.

The case highlights the tension between privacy protection and age verification requirements. While collecting more personal information might improve age verification, it also raises privacy concerns that platforms like Reddit are keen to avoid. This dilemma reflects the broader challenges facing social media companies in balancing user privacy, regulatory compliance, and child safety.

For parents and guardians, this enforcement action serves as a reminder to monitor children's online activities and understand the privacy policies of platforms they use. For Reddit users, the case may prompt questions about how their data is collected and used, particularly for younger users who may have been active on the platform before age verification measures were implemented.

The ICO's decision represents a significant moment in the ongoing evolution of online child protection regulations. As social media platforms continue to grow and evolve, regulators are likely to maintain pressure on companies to implement more robust age verification systems while balancing privacy concerns. The outcome of Reddit's appeal may provide further clarity on how these competing interests will be balanced in future enforcement actions.