The UK's Information Commissioner's Office has fined Reddit £14.5 million ($19.6 million) for failing to adequately verify user ages, resulting in the unlawful processing of children's personal data. The penalty addresses lapses before and after Reddit's July 2025 implementation of age checks for adult content. Reddit plans to appeal, citing its commitment to user privacy.
On February 24, 2026, the UK Information Commissioner's Office (ICO) imposed a £14.5 million ($19.6 million) fine on Reddit for not implementing robust age assurance mechanisms. The ICO stated that Reddit lacked a lawful basis for processing personal information of children under 13, potentially exposing them to inappropriate and harmful content. "Our investigation found that Reddit failed to apply any robust age assurance mechanism," the ICO said in a press release.
The findings stem from Reddit's practices prior to its July 2025 rollout of age verification for UK users accessing adult content, in compliance with the Online Safety Act enforced by Ofcom. Even after this change, the ICO expressed concerns over Reddit's reliance on self-declared ages during account creation, describing it as "easy to bypass." The regulator also noted Reddit's failure to conduct a data protection impact assessment (DPIA) before January 2025 to assess risks to children.
Reddit responded by announcing an appeal. "Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety," the company stated. It highlighted its privacy policy, which collects minimal identifying information and allows anonymous browsing without an account or real name. Reddit prohibits users under 13 globally and uses vendor Persona for verifying birthdates via selfies or government IDs for restricted content, without storing the uploaded photos.
UK Information Commissioner John Edwards emphasized the responsibility of platforms: "Children under 13 had their personal information collected and used in ways they could not understand, consent to or control." He added that the ICO will continue reviewing Reddit's age assurance controls and prioritize scrutiny of services relying on self-declaration. This fine ranks as the ICO's third-largest, following penalties against British Airways and Marriott Hotels for data breaches.
The ICO previously fined Imgur owner MediaLab £247,590 for similar violations. Reddit noted that the vast majority of its UK users are adults and provides tools for reporting underage accounts.
