The UK’s data and privacy watchdog has issued a major penalty to the social site after a probe found that the firm had not properly assured the age of users

The Information Commissioner’s Office has fined Reddit £14.5m for failing to properly carry out age verification.

An investigation concluded that the the social media platform failed to apply an age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13. It also failed to carry out a data protection impact assessment to assess the risks to children, the ICO found.

The data protection regulator said these failures meant Reddit – which has said it will appeal the decision – was using children’s data unlawfully and potentially exposing them to harmful content.

Commissioner John Edwards said: “It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children. Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”

Related content

• Capita given penalty £14m over cyberattack despite urging ICO to apply non-fining public-sector approach
• Government to create new data protection team to ‘set consistent standards and respond swiftly to risks’
• New working arrangement with ICO could help government ‘rebuild public trust’

The ICO said Reddit’s terms of service prohibited children under 13 using its platform but, despite this, the online platform did not have measures in place to check the age of users accessing the site until July 2025.

Age-assurance measures introduced at this point, including age verification to access mature content, were “easy to bypass”, the regulator said.

“Let me be clear,” Edwards said. “Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform.”

Reddit said that it prohibits and removes users under the age of 13.

A spokesperson for the firm said: “Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety. The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety. We intend to appeal the ICO’s decision.”