In one of the most high-profile social media crackdowns in history, the UK's Information Commissioner's Office (ICO) has fined Reddit £14.47 million (more than $19.5 million) for collecting and processing personal data from children under 13 without adequate safeguards. The decision has reignited the debate over the responsibilities of major digital platforms towards underage users and their compliance with the UK's strict data protection framework.
According to the regulator's announcement, Reddit did not have a meaningful age verification mechanism in place until July 2025, despite the fact that its terms of use explicitly prohibited the creation of accounts by children under 13. The absence of effective control meant, in practice, that compliance relied almost exclusively on users' self-declaration.
See also: Zuckerberg and Cook discussed "the well-being of teenagers and children"
Concerns about mass use by minors
The ICO estimates that a significant number of children were using the platform before the new measures were implemented in the summer of 2025. During the investigation, it was found that the company was processing minors' data without sufficient legal basis, which may have exposed them to content inappropriate for their age.
The UK Information Commissioner, John Edwards, said the collection and use of personal data from children under 13 was carried out in ways they could not understand or control, leaving them potentially exposed to harmful content, which he called “unacceptable” for a company of its size and influence.
The measures that came late
In July 2025, Reddit introduced an age verification system for accessing adult content, as well as a self-declaration for new accounts. However, the ICO ruled that these measures did not meet UK data protection standards, noting that they could be easily circumvented.
Particular emphasis was placed on the fact that simple self-declaration is not enough when it comes to child safety. The regulator made it clear that it is now turning its attention to companies that rely primarily on this method, calling on the entire industry to urgently review its practices.
Reddit's response and intention to appeal
In a statement to tech outlet BleepingComputer, Reddit said it intends to appeal the decision. A spokesperson for the company said that, based on external market research, the vast majority of its users in the UK are adults.
See also: Britain: Banning social media for children under 16?
The company also said it does not require users to share any identifying information, regardless of age, underlining its commitment to privacy. In its view, the ICO's requirement to collect more personal information from all users in the UK goes against its philosophy of data minimisation and anonymity protection.
A platform with enormous reach in the microscope
The case is even more compelling when you consider the platform’s size. Reddit claims to have 121 million daily active users and over 471 million weekly users, spread across more than 100,000 active communities. It’s an ecosystem of discussions spanning everything from technology and science to entertainment and politics, with enormous influence in shaping the digital public sphere.
This scale makes any failure to verify age a multiplier risk, as even a small percentage of underage users translates into hundreds of thousands of children potentially exposed to inappropriate content or data processing practices they do not understand.
In the same pattern: Fine also at MediaLab
The decision comes just weeks after a similar penalty was imposed on MediaLab, the owner of the Imgur, for violations also related to children's privacy. The pattern is clear: British authorities are stepping up controls on platforms that host user-generated content and do not have strong filters to protect minors.
The broader message to the industry
Beyond the financial burden, the fine serves as a warning to the entire technology industry. The era of “lax” oversight appears to be a thing of the past, as regulators now demand documented compliance and proactive protection measures.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Roblox: 9-year-olds will use selfie videos for age verification
For major platforms, the dilemma between privacy and strict user identification is becoming increasingly complex. Reddit’s case highlights that invoking anonymity is not enough when the safety of children. The coming period will be interesting, as the company’s appeal may become a reference point for how Europe – and especially the United Kingdom – will balance innovation, privacy and the effective protection of minors online.
Source: www.bleepingcomputer.com
