The Information Commissioner’s Office, a regulatory body charged with regulating and enforcing online privacy matters in the UK, has fined Reddit £14.5 million ($19.6 million) after an investigation found that the platform had “failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13.” Reddit says it will appeal the ruling.
Reddit “failed to carry out a data protection impact assessment (DPIA) to assess and mitigate risks to children before January 2025,” ICO said in a press release (via Ars Technica). “These failures meant Reddit was using children’s data unlawfully, potentially exposing them to inappropriate and harmful content.”
Reddit introduced “age assurance measures” in July 2025 “that include age verification to access mature content and asking users to declare their age when opening an account,” the ICO continued, but that may not be adequate: “The ICO informed Reddit that relying on self-declaration presents risks to children as it is easy to bypass. The regulator is keeping Reddit’s processing of children’s personal information under review as part of on-going work focusing on online platforms that primarily rely on self-declaration.”
“It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children,” UK Information Commissioner John Edwards said. ““Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.
“Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform.”
In a statement provided to PC Gamer, a Reddit spokesperson said the platform intends to appeal the fine. “Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety,” the spokesperson said. “The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety.”
In fact, Reddit’s privacy policy includes a line that sounds very much like what Discord was doing—that is, estimating a user’s age based on other information and activity: “We infer attributes such as age range, gender, and/or preferred language(s) based on the information we have about you.” I guess this is just how things are now.
Read the full article here
