Reddit fined £14.47M for violating children's privacy

The Information Commissioner’s Office (ICO) has issued a fine of £14.47 million for using children’s personal information unlawfully and for failing to check the age of users.

According to the United Kingdom’s privacy and data protection authority, Reddit failed to apply any robust age assurance mechanism. Therefore, the online forum didn’t have a legal basis for processing the personal information of children under the age of 13.

On top of that, Reddit neglected to carry out a data protection impact assessment (DPIA) to determine and mitigate potential risks to children before January 2025.

These failures meant Reddit was using children’s data unlawfully, potentially exposing them to inappropriate and harmful content.

“It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children. Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine,” John Edwards, UK Information Commissioner, said in a statement.

In July 2025, Reddit introduced age assurance measures to verify the age of users to allow them to access mature content. Furthermore, new users were asked to declare their age when they opened an account.

The ICO warned Reddit that relying on self-declaration would present risks to children, as it is an easy way to bypass age restrictions and gain access to inappropriate or harmful content.

According to the British data protection authority, a large number of children under 13 are active on the platform. This would have been evident if Reddit had carried out a DPIA. Since the online forum failed to do this, the personal information of under-13-year-olds was collected without a proper legal basis.

In setting the penalty amount, the ICO took into consideration the number of children affected by these infringements, the degree of potential harm that was caused, the duration of the failings, and Reddit’s annual global turnover.

“Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Reddit failed to meet these expectations. They must do better, and we are continuing to consider the age assurance controls now implemented by the platform,” Edwards continued.

Reddit announced that it will appeal the ICO’s decision.

“Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety. The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety,” a Reddit spokesperson said.