Reddit is facing a £14.47 million fine for unlawfully processing children’s personal information, the UK’s data protection regulator found.

The Information Commissioner’s Office’s investigation into Reddit, the online forum, found that it failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13.

It was also found to have failed to carry out a data protection impact assessment to assess and mitigate risks to children prior to January 2025.

These failures meant Reddit was using children’s data unlawfully, potentially exposing them to inappropriate and harmful content, the ICO said.

In July 2025, Reddit introduced age assurance measures that include age verification to access mature content and asking users to declare their age when opening an account. The ICO informed Reddit that relying on self-declaration presents risks to children as it is easy to bypass.

The regulator is keeping Reddit’s processing of children’s personal information under review as part of on-going work focusing on online platforms that primarily rely on self-declaration.

“It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children,” John Edwards, UK Information Commissioner said.

“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.

“Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place.

Recommended reading

• ICO: Data Protection Not An Excuse When Tackling Scams, Fraud
• ICO Investigating TikTok, Reddit, Imgur Over Child Privacy
• ICO Tackles Data Protection Compliance on UK’s Top 1,000 Websites
• Data Privacy Day: Where are We and How Did We Get Here?

“Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform.

“Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms.”

In setting the penatly amount, the ICO tookk into consideration the number of children affected by this infrigement, the degree of potential harm caused, and the duration of the failings, as well as Reddit’s global turnover.