Britain’s data protection regulator has fined Reddit £14.47 million, accusing the social media platform of failing to adequately safeguard the personal information of children under 13 and allowing them to access the site despite its own age restrictions. Reddit said it will appeal the decision.
A Regulatory Rebuke
Britain’s Information Commissioner’s Office has fined Reddit £14.47 million — more than $19.5 million — for what regulators described as the unlawful collection and use of personal data belonging to children under 13.
In a statement issued Tuesday, the agency said the social media company had failed to implement meaningful age-verification measures before July 2025, even though its own terms of service prohibited users younger than 13 from joining the platform. As a result, the regulator concluded, a significant number of underage children were able to use Reddit, and their personal information was processed without a lawful basis.
The decision marks one of the most prominent enforcement actions taken by British authorities against a major online platform over children’s privacy. It reflects a broader regulatory push in the United Kingdom to require technology companies to demonstrate that their platforms are designed with children’s safety and data protection in mind.
“It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children,” John Edwards, the U.K. information commissioner, said in a statement. Children under 13, he added, had their information “collected and used in ways they could not understand, consent to or control,” leaving them potentially exposed to content they should not have seen. “This is unacceptable and has resulted in today’s fine.”
FCRF Launches Flagship Certified Fraud Investigator (CFI) Program
Reliance on Self-Declaration
At the center of the regulator’s findings was Reddit’s reliance on users to declare their own age. According to the Information Commissioner’s Office, simply asking users to state their age is insufficient when children may be at risk. The regulator criticized companies that depend primarily on self-declaration methods and signaled that such practices will face increasing scrutiny.
“Relying on users to declare their age themselves is not enough when children may be at risk,” Mr. Edwards said, urging companies to reflect on their practices and make necessary improvements.
The regulator estimated that a significant number of underage children were using Reddit before July 2025. During that period, the agency said, Reddit processed their data without adequate safeguards and potentially exposed them to harmful content.
In July 2025, Reddit implemented what it described as age-assurance measures, including an age-verification system for accessing mature content and a self-declaration prompt for new accounts. But regulators said those measures did not satisfy U.K. data protection standards and noted that children could easily bypass them.
The agency’s findings suggest that, in its view, Reddit’s changes came too late and fell short of ensuring meaningful compliance.
Reddit’s Response
Reddit said it plans to appeal the fine. In a statement, a company spokesperson said that Reddit does not require users to share information about their identities, regardless of age, because it is “deeply committed to their privacy and safety.” The spokesperson characterized the regulator’s insistence that Reddit collect more private information on every U.K. user as “counterintuitive and at odds with our strong belief in our users’ online privacy and safety.”
The company also cited external market research suggesting that the vast majority of Reddit users in the United Kingdom are adults. Reddit’s position underscores a central tension in the dispute: how platforms can verify users’ ages without collecting additional personal data that might itself raise privacy concerns. The company’s appeal is likely to test how British regulators balance those competing principles.
Reddit is one of the world’s largest social media platforms, reporting 121 million daily active users and more than 471 million weekly active users across more than 100,000 active communities. Its scale and global reach have made it a central forum for discussion on topics ranging from hobbies and entertainment to politics and public health.
The case places the company among a growing list of technology firms facing heightened oversight in Britain.
A Broader Pattern of Enforcement
The fine against Reddit follows a similar penalty issued on February 5 against MediaLab, the owner of the image-sharing platform Imgur, over children’s privacy failures.
Taken together, the actions reflect an assertive approach by British regulators toward companies that operate large online communities and process significant volumes of personal data. Regulators have emphasized that platforms must build safeguards into their systems rather than rely on users to navigate risks on their own.
The Information Commissioner’s Office framed its decision as part of an ongoing effort to ensure that companies comply with U.K. data protection standards, particularly when children are involved. By highlighting both the absence of meaningful age verification before July 2025 and the alleged shortcomings of measures implemented afterward, the regulator signaled that incremental or easily circumvented systems may not be sufficient.
For Reddit, the fine represents both a financial penalty and a reputational challenge. While £14.47 million is a fraction of the company’s global operations, the case raises broader questions about how social media platforms verify age, protect minors and reconcile data minimization with regulatory demands.
