Reddit hit with £14M+ penalty for violating children’s privacy rules

The Information Commissioner’s Office has imposed a record fine of more than £14 million on Reddit for mishandling children’s personal information, marking the largest penalty the regulator has ever issued over children’s privacy concerns.

An ICO investigation revealed that Reddit collected and processed data from children under 13 without proper safeguards. The platform lacked effective age verification systems, putting young users at risk, and failed to carry out a Data Protection Impact Assessment (DPIA) before January 2025, a key step to identify and mitigate potential risks to children.

UK Information Commissioner John Edwards said the breaches were “concerning” for a company of Reddit’s scale. He explained that children’s information was being used in ways they could not understand or control, exposing them to inappropriate content and violating their privacy rights.

Edwards emphasized that online services likely to attract children have a legal duty to know the age of their users and implement robust age assurance measures. He criticized Reddit for relying solely on users to self-declare their age and urged the wider industry to review and strengthen their platforms to better protect children.

The ICO is continuing to evaluate Reddit’s current age verification measures and expects urgent improvements to prevent similar issues in the future.