The UK’s data protection regulator has fined social media platform Reddit £14.47 million after finding serious shortcomings in how the company protected children’s personal information online.
The penalty was issued by the Information Commissioner’s Office (ICO), which said Reddit failed to properly verify the ages of users accessing its platform. According to regulators, this allowed underage children to potentially encounter inappropriate material and exposed their personal data to unnecessary risks.
Regulator Raises Concerns Over Child Safety Online
UK Information Commissioner John Edwards described the findings as troubling, noting that large technology companies have a legal responsibility to ensure children’s safety when collecting and using personal data.
He said organisations operating online services that attract younger audiences must take stronger steps to confirm users’ ages and introduce safeguards designed specifically for children.
The ICO concluded that Reddit relied too heavily on users simply entering their date of birth when signing up — a method regulators said could easily be bypassed.
Officials believe this weakness allowed a significant number of children under 13, who are not permitted to use the platform under its own rules, to access services.
Investigation Linked to Wider Online Safety Push
The investigation began in March last year as part of broader scrutiny into how major online platforms handle children’s information. The ICO examined several companies during the probe, including TikTok and Imgur, amid growing concerns about youth exposure to harmful online content.
UK authorities say companies must establish a lawful basis before processing children’s data. Because Reddit could not reliably confirm user ages at the time, regulators determined that children’s information may have been collected without adequate legal justification.
Reddit Defends Privacy Approach and Plans Appeal
In response, Reddit said it historically avoided collecting extensive identity information from users because of its commitment to privacy.
A spokesperson argued that forcing platforms to gather more personal data from every user could conflict with online privacy principles.
The company also confirmed it intends to appeal the financial penalty.
Reddit began introducing stronger age-verification measures in July 2025 following requirements under the Online Safety Act, a major UK law designed to protect children from harmful online material.
Since then, users who have not verified their age have faced restrictions when trying to access adult-themed communities or sensitive content areas.
Growing Regulatory Pressure Across the UK Tech Sector
The ICO said it will continue working alongside communications regulator Ofcom, which enforces online safety rules under the same legislation.
Ofcom has already taken enforcement action against several adult-content websites that failed to introduce effective age checks, signalling a tougher regulatory environment for digital platforms operating in the UK.
Experts say the combined efforts of both regulators show a coordinated push to reshape online safety standards.
Social media analyst Matt Navarra described the situation as a “turning point” for how authorities treat major online communities.
According to Navarra, Reddit is no longer viewed as simply an informal discussion forum but as a large social media platform with significant responsibilities toward users — especially minors.
Why Age Verification Matters for Online Platforms
Children are considered particularly vulnerable online because they may not fully understand how personal data is collected, tracked, or shared.
UK data protection law requires companies to:
-
Reduce unnecessary data collection from children
-
Provide stronger privacy settings by default
-
Prevent exposure to harmful or adult content
Regulators say effective age assurance systems — such as secure verification tools or behavioural checks — are essential to meeting those obligations.
What the Fine Means for Users and the Industry
The enforcement action reflects growing global pressure on technology companies to balance privacy with safety.
For users, it could mean stricter age checks and new access limits across social media platforms operating in the UK and Europe.
For companies, the case sends a clear warning that relying on self-declared ages alone may no longer meet regulatory expectations.
As online communities continue to expand rapidly, authorities are expected to introduce further oversight to ensure children’s personal data is handled responsibly.
