Reddit hit with £14.5m fine over children's privacy failures

The UK Information Commissioner has fined Reddit £14.5m for failing to properly carry out age verification.

An investigation found the social media platform failed to apply an age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13.

It also failed to carry out a data protection impact assessment to assess the risks to children.

The Information Commissioner’s Office (ICO), the independent regulator for data protection, said these failures meant Reddit was using children’s data unlawfully and potentially exposing them to harmful content.

John Edwards, UK Information Commissioner, said: “It's concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children. 

“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”

The ICO said Reddit’s terms of service prohibited children under 13 using its platform, but despite that it did not have measures in place to check the age of users accessing its platform until July 2025.

Age assurance measures introduced by Reddit in July 2025, including age verification to access mature content, were “easy to bypass”, the regulator said.

“Let me be clear,” Edwards said. “Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. 

“Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform.”

Reddit said it prohibits and removes users under the age of 13.

A Reddit spokesperson said: “Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety.

“The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety. We intend to appeal the ICO’s decision.”