LONDON — In a landmark decision on children's online privacy, the UK's Information Commissioner's Office (ICO) has imposed a record £14 million fine on Reddit for failing to implement proper age verification measures, exposing young users to potential risks. The penalty, announced on Wednesday, marks the largest ever issued by the ICO specifically for breaches related to children's data protection. According to the ICO, the U.S.-based social media platform unlawfully processed personal information from children under 13 without verifying their ages or conducting necessary risk assessments.
The investigation into Reddit began after concerns arose about how the platform handled user data, particularly for minors. ICO officials found that Reddit did not apply any robust age assurance mechanisms, lacking a lawful basis for collecting and using data from children under 13. Furthermore, the company failed to carry out a data protection impact assessment (DPIA) to evaluate and mitigate risks to children before January 2025, as required under UK data protection laws.
John Edwards, the UK Information Commissioner, emphasized the gravity of Reddit's shortcomings in a statement released alongside the fine. "It's concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children," Edwards said. He added, "Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today's fine."
Edwards went on to outline the broader responsibilities of online platforms. "Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they're not exposed to risks through the way their data is used," he stated. "To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place." He criticized Reddit's reliance on self-declared ages, noting, "Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms."
Reddit, which boasts over 500 million monthly active users worldwide, has faced scrutiny for its content moderation practices amid growing concerns about online safety for minors. The platform, known for its community-driven forums called subreddits, allows users to post and discuss a wide range of topics, some of which include adult-oriented or potentially harmful material. Without age checks, children could access inappropriate content, raising alarms from regulators about compliance with the UK's Data Protection Act 2018 and the upcoming Online Safety Act.
In response to the fine, a Reddit spokesperson told Sky News that the company intends to appeal the ICO's decision. "Reddit doesn't require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety," the spokesperson said. They argued, "The ICO's insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users' online privacy and safety." This stance highlights a tension between privacy advocates and regulators pushing for stricter controls to safeguard vulnerable users.
The ICO's probe into Reddit is part of a wider crackdown on tech giants' handling of children's data. Earlier this month, MediaLab, the owner of image-hosting site Imgur, was fined £250,000 for similar failures in age verification and data protection. In 2023, TikTok settled with the ICO for a £12.7 million penalty after an initial proposed fine of £27 million, stemming from issues with processing data from users under 13 without parental consent.
These cases underscore the evolving regulatory landscape in the UK, where the ICO has ramped up enforcement following high-profile scandals involving social media and youth mental health. The Online Safety Act, set to fully come into force later this year, will impose even stricter duties on platforms to prevent children from encountering harmful content. Experts suggest that fines like Reddit's could signal more aggressive action against non-compliant companies, potentially affecting global operations as UK rules influence international standards.
Background on the ICO's investigation reveals it was triggered by complaints and audits focusing on how platforms verify user ages. According to ICO documents, Reddit's system relied solely on users self-reporting their birthdates during signup, without additional checks. This method, while privacy-friendly in Reddit's view, was deemed insufficient by regulators, especially given reports of underage users engaging with mature communities.
Edwards' comments also point to ongoing monitoring. "Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform," he said. Indeed, Reddit has reportedly introduced some updates to its age verification processes in recent months, though details remain under review by the ICO.
The fine's amount—£14 million—reflects the severity of the breaches and Reddit's scale as a multinational corporation with significant revenue streams from advertising. For context, Reddit went public on the New York Stock Exchange in March 2024, valuing the company at around $6.4 billion. The penalty, while substantial, represents a fraction of its operations but serves as a deterrent amid rising calls for accountability in Big Tech.
Broader implications extend to the tech industry at large. Advocacy groups like the NSPCC, the UK's leading children's charity, have welcomed the decision, arguing it reinforces the need for proactive safeguards. "This fine sends a strong message that platforms cannot prioritize profits over child safety," a spokesperson for the organization said in a separate statement, though not directly quoted in the ICO release.
Looking ahead, Reddit's appeal could prolong the matter, potentially leading to court challenges over the balance between data privacy and child protection. The ICO has indicated it will continue targeting platforms using self-declaration methods, which could impact sites like Discord or other forums popular with young users. As the UK prepares for the Online Safety Act's implementation, companies may need to invest heavily in AI-driven age verification tools or third-party checks to avoid similar penalties.
In related developments, the ICO's actions come amid other regulatory moves in Europe and beyond. The European Union's Digital Services Act imposes similar obligations, and U.S. states like California have enacted laws requiring age-appropriate design for apps. Reddit's case may prompt a reevaluation across borders, with privacy watchdogs coordinating efforts to protect minors in the digital age.
As this story develops, more details on Reddit's appeal and any remedial actions are expected. The ICO has urged the public to stay informed about online safety, particularly for families navigating social media. For now, the £14 million fine stands as a pivotal moment in holding tech platforms accountable for the youngest users.