UK Watchdog Slaps Reddit With £14.47M Penalty for Child Data Lapses

_{ICO says platform processed under-13s’ data without lawful basis. (Image: ICO/Linkedin)} 

Reddit has been fined £14.47 million by the UK’s data protection watchdog after an investigation found the social media platform unlawfully processed children’s personal information and failed to properly assess the risks to young users.

The Information Commissioner’s Office said its probe uncovered breaches of Articles 5(1)(a), 6, 8 and 35 of the UK General Data Protection Regulation. The regulator concluded that Reddit did not have appropriate age verification measures in place, despite prohibiting children under 13 from using the platform in its terms of service.

According to the ICO, Reddit relied on users to self-declare their age until July 2025. Internal estimates indicated that a “large number” of children under 13 were using the service during that period. The regulator said the company lacked a lawful basis to process those children’s personal data.

The ICO also found that Reddit failed to carry out a data protection impact assessment focused on risks to children’s data before January 2025, even though users aged 13 to 17 were permitted to join.

The regulator concluded that by processing under-13s’ personal information without a lawful basis, and without fully considering the broader risks to children, young users were left potentially exposed to inappropriate and harmful content.

‘This Is Unacceptable,’ Says Information Commissioner

John Edwards, the UK Information Commissioner, said the scale of the failure was troubling.

“It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children.

“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”

Edwards stressed that online platforms likely to be accessed by children must take active steps to understand who is using their services and tailor protections accordingly.

“Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place.”

He added that the ICO is continuing to assess the age assurance systems Reddit has since introduced, and warned other companies not to rely solely on self-declared ages.

“Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms.”

What The Children’s Code Requires

The ICO’s enforcement action sits alongside its statutory Children’s code, formally known as the Age Appropriate Design Code. The code sets out how information society services likely to be accessed by children must protect their data.

Age assurance plays a central role. The ICO defines it as tools or approaches that estimate or verify a user’s age, allowing services to tailor content, apply safeguards, or restrict access where required.

Under the UK GDPR, organisations must have a lawful basis to process personal data. Article 8 places specific conditions on processing children’s data in relation to information society services, requiring parental consent for users under 13 in the UK. Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to individuals’ rights and freedoms.

The ICO has updated its age assurance guidance following the Data (Use and Access) Act, which came into law on 19 June 2025. The regulator said further updates may follow as the framework evolves.

Why Casino Operators Should Pay Attention

For online casino operators and other gambling businesses, the message is clear: age gates that rely on a simple tick box are unlikely to satisfy regulators where children could access services.

Online gambling operators in the UK are already required by the UK Gambling Commission to prevent underage gambling, including robust age and identity verification before customers can deposit or gamble. They are also subject to the Children’s code if their services are likely to be accessed by children, even inadvertently.

The ICO’s action against Reddit underscores a broader regulatory trend. Data protection compliance is no longer limited to privacy policies and cookie banners. It extends to how platforms design onboarding journeys, assess risk to minors, and implement proportionate age assurance.

For gambling brands, failure to get this right carries dual risk: enforcement from the ICO for data breaches and potential action from the Gambling Commission for underage gambling failures.

The £14.47 million fine signals that regulators expect large digital platforms to proactively assess child safety risks, not react after harm occurs. For an industry built on age-restricted access, that expectation is even higher.

The news drew a lot of comments online including HE Professional Andrew Lambert who said: "If platforms failed to protect children, fine them. Enforce the law.

"But why is the solution to force millions of adults to hand over personal data just to prove they are grown up?

_{Andrew Lambert made his views clear on Linkedin. (Image: Andrew Lambert/Linkedin)}

"Mandatory age verification means more data collection, more identity checks, more centralised stores of sensitive information. That is disproportionate. It creates new risks while claiming to reduce others.

"You cannot fix data misuse by demanding even more data.

"Where is the necessity test. Where is the proportionality. Where is the impact assessment on the privacy and security risk to adults.
Protect children. Yes. But do not normalise mass identity checks as the price of being online."