Reddit Fined £14.47M After Letting Children Bypass Age Checks for Years

The Largest Children's Privacy Fine in UK History

On February 24, 2026, the UK's Information Commissioner's Office fined Reddit £14.47 million, approximately $19.6 million, for failing to protect children's personal information. It is the largest fine the ICO has ever issued in relation to children's privacy.

The ICO found two fundamental failures. First, Reddit did not apply any robust age assurance mechanism until July 2025, meaning it had no lawful basis for processing the personal information of children under 13. Second, the company failed to carry out a data protection impact assessment to evaluate the risks of processing children's data before January 2025, despite allowing teenagers aged 13 to 17 to use the platform.

A Checkbox Was the Only Protection

Reddit's terms of service prohibited children under 13 from using the platform. But for years, the only enforcement mechanism was the terms themselves. There was no age verification, no identity check, no meaningful barrier. Any child who could type a birth date could create an account.

In July 2025, Reddit introduced age assurance measures including age verification to access mature content and a self declaration prompt when opening an account. But the ICO noted that self declaration "presents risks to children as it is easy to bypass" and is continuing to monitor Reddit's compliance.

The ICO's own estimates indicated that a large number of children under 13 were actively using the platform throughout this period, exposing them to content ranging from graphic violence to explicit sexual material without any meaningful safeguards.

No Risk Assessment for Years

Under UK data protection law, organizations that process children's data are required to conduct a data protection impact assessment, a formal evaluation of how that data is used and what risks exist. Reddit did not complete one focused on children until January 2025.

This means Reddit was collecting, storing, and processing the personal data of millions of minors, including their browsing habits, community memberships, upvotes, comments, and IP addresses, without ever formally considering how that data could harm them.

The failure is not just regulatory. Without a risk assessment, there was no systematic process for identifying how children's data could be misused, whether by advertisers, data brokers, or malicious actors who might target young users.

Part of a Broader Crackdown

Reddit is not the only platform facing enforcement action over children's data. The same week, UK regulator Ofcom fined an adult content company £1.8 million for failing to verify user ages. Discord has also faced scrutiny over its age verification practices, particularly after a 2025 breach exposed 70,000 users' government ID photos.

The pattern is clear: regulators across the UK and EU are moving aggressively against platforms that treat age verification as an afterthought. The ICO's £14.47 million fine sends a message that relying on self declaration is no longer acceptable when children's safety is at stake.

Reddit Plans to Appeal

Reddit has announced it intends to appeal the decision. The company argues that its July 2025 age assurance measures adequately address the ICO's concerns and that the fine is disproportionate.

But the ICO's findings cover the period before those measures were implemented. The fine addresses years of inaction, not the current state of Reddit's age verification. The question for the appeal will be whether Reddit's historical failure to protect children's data justifies the penalty, regardless of what changes it has since made.

The Data Behind the Fine

The ICO calculated the £14.47 million penalty based on several factors: the number of children affected, the potential degree of harm from exposure to inappropriate content, the duration of the violations, and Reddit's global turnover.

For parents and guardians, the fine is a reminder that platform terms of service are not the same as actual protection. If a platform says "no users under 13" but does nothing to enforce that rule, children are on their own. The data they generate, the communities they join, and the content they consume are all being processed without the safeguards that the law requires.

Reddit is the third largest social platform in the English speaking world. For years, the only thing standing between millions of children and a platform full of adult content was a checkbox that said "I am 13 or older." The ICO decided that is not good enough.