Reddit fined nearly $20 million by UK online privacy regulator for 'using children’s data unlawfully, potentially exposing them to inappropriate and harmful content'

The Information Commissioner's Office, a regulatory body charged with regulating and enforcing online privacy matters in the UK, has fined Reddit £14.5 million ($19.6 million) after an investigation found that the platform had "failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13." Reddit says it will appeal the ruling.

Reddit "failed to carry out a data protection impact assessment (DPIA) to assess and mitigate risks to children before January 2025," ICO said in a press release (via Ars Technica). "These failures meant Reddit was using children’s data unlawfully, potentially exposing them to inappropriate and harmful content."

Reddit introduced "age assurance measures" in July 2025 "that include age verification to access mature content and asking users to declare their age when opening an account," the ICO continued, but that may not be adequate: "The ICO informed Reddit that relying on self-declaration presents risks to children as it is easy to bypass. The regulator is keeping Reddit’s processing of children’s personal information under review as part of on-going work focusing on online platforms that primarily rely on self-declaration."

"It's concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children," UK Information Commissioner John Edwards said. "“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.

"Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform."

The UK has imposed tight age verification rules for online content through the Online Safety Act, which came into effect in 2025. The idea, as always, is to protect children from "harmful content," covering a range of content from pornography and the promotion of suicide to eating disorders and bullying.

Predictably, it's been something of a mess: Privacy issues are the foremost concern (and justifiably so, as demonstrated by the leak of thousands of age verification ID photos and other data in 2025, and also just as a matter of principle), and even when security flaws aren't exposing data to unscrupulous hackers, worries that it could end up in the hands of someone far worse are very real.

The UK government said in July 2025 that it had no intention of repealing the Online Safety Act despite pushback from the public, but that backlash is having an impact elsewhere: Discord announced today that it's delaying the global rollout of its age verification system, and cutting ties with the Peter Thiel-affiliated age verification platform Persona, because of widespread public worries about its privacy policies.

In a statement provided to PC Gamer, a Reddit spokesperson said the platform intends to appeal the fine. "Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety," the spokesperson said. "The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users' online privacy and safety."

The rep also said that research indicates the vast majority of Reddit users in the UK are adults, and that Reddit's user agreement explicitly forbids people under the age of 13 from accessing or using the site. Reddit does have an age verification system for users who want to access mature content in the UK, launched in 2025, which ironically makes use of Persona, the age verification service that caused Discord such headaches because of its ties to Peter Thiel.

In fact, Reddit's privacy policy includes a line that sounds very much like what Discord was doing—that is, estimating a user's age based on other information and activity: "We infer attributes such as age range, gender, and/or preferred language(s) based on the information we have about you." I guess this is just how things are now.