The UK’s data protection watchdog has taken aggressive action against Reddit, imposing a £14.5 million ($19.6 million) fine for what it calls a systemic failure to protect children’s personal information. The penalty stems from an investigation that found the platform had no robust way to verify user ages before January 2025, leaving under-13 users exposed to data collection and potentially harmful content without meaningful safeguards.
The ruling underscores the growing tension between online platforms and regulators over age verification—a topic that has become a lightning rod for privacy concerns, especially after high-profile leaks tied to verification systems like those used by Discord. While Reddit has since introduced age declaration measures, the regulator argues these are easily bypassed and insufficient for compliance with the UK’s Online Safety Act, which took effect in 2025.
- No Age Verification: Reddit lacked any effective mechanism to confirm user ages before January 2025, despite legal obligations to protect minors.
- Data Risks: Children under 13 had their personal data processed without consent or understanding, increasing exposure to inappropriate content.
- Self-Declaration Flaws: Post-2025 age checks rely on user self-declaration, which the ICO warns is trivial to circumvent and fails to meet regulatory standards.
- Ongoing Scrutiny: The ICO will continue monitoring Reddit’s age verification controls, particularly those tied to accessing mature content.
The fine reflects broader struggles with the Online Safety Act, which mandates strict age verification for platforms handling user-generated content. While the law aims to shield children from harmful material—ranging from explicit content to pro-suicide discussions—its implementation has sparked backlash over privacy risks. Discord, for instance, delayed its global rollout of age verification after public outcry over data leaks and ties to controversial verification vendors.
Reddit’s response emphasizes its commitment to user privacy, arguing that mandatory age collection contradicts its approach. The company maintains that the vast majority of UK users are adults and that its terms of service already prohibit under-13 access. However, the ICO’s decision suggests that self-declared age checks—even when paired with content restrictions—are no longer sufficient under UK law.
For platforms, the ruling serves as a warning: age verification is no longer optional. The challenge lies in balancing compliance with user privacy, especially as verification systems increasingly rely on third-party tools with questionable security track records. With the ICO keeping Reddit’s controls under review, the pressure is on tech companies to rethink how they handle one of the most sensitive user demographics—children.
