Reddit's £14.47 million fine: Lessons for businesses on children's data protection

On 24 February 2026, the UK Information Commissioner's Office (ICO) fined Reddit, Inc. £14.47 million for failures in protecting children's personal information online. The penalty serves as a stark reminder to all businesses operating online services of their obligations under UK data protection law.

What happened?

The ICO's investigation found that Reddit had committed two significant breaches of UK data protection law. First, Reddit failed to apply any robust age assurance mechanism to its platform and therefore lacked a lawful basis for processing the personal information of children under the age of 13. Second, Reddit failed to carry out a data protection impact assessment (DPIA) to assess and mitigate the risks to children before January 2025.

Although Reddit's terms of service prohibited children under 13 from using its platform, the company did not have measures in place to verify the age of users accessing the service until July 2025. The ICO's estimates indicated that a large number of children under 13 were present on the platform despite this prohibition. By using these children's personal information without a lawful basis and without having properly considered the risks to children more generally, they were exposed to the risk of inappropriate and harmful content.

When Reddit did eventually introduce age assurance measures in July 2025, these included age verification to access mature content and asking users to declare their age when opening an account. However, the ICO made clear that relying on self-declaration alone presents serious risks to children, as it is easily bypassed. The regulator has stated that it is keeping Reddit's current measures under review and is focusing more broadly on platforms that primarily rely on self-declaration.

In determining the penalty amount, the ICO took into account the number of children affected, the degree of potential harm caused, the duration of the failings, and Reddit's global turnover.

The wider regulatory context

This fine forms part of a broader ICO intervention to improve the safety of children's personal information online, following a separate penalty issued to MediaLab. UK Information Commissioner John Edwards was forthright in his comments, stating that it is "concerning" for a company of Reddit's size to have failed in its legal duty to protect UK children's personal data.

The ICO's Age Appropriate Design Code, commonly known as the Children's Code, sets out design standards for online services likely to be accessed by under-18s. This includes considering children's best interests in all aspects of the design of online services and providing them with a high level of privacy by default. The ICO has confirmed it will continue to work closely with Ofcom to ensure coordinated enforcement alongside the Online Safety Act.

The ICO guidance

The message from the ICO is clear: protecting children's privacy online is a regulatory priority, and businesses that fail to act will face significant consequences. In April 2024, the ICO launched the Children’s Code strategy to look closely at social media and video sharing platforms. It has advised that it will continue to pursue changes where platforms do not comply with the law or conform to the Children’s Code as well as work closely with Ofcom (who has responsibility for enforcing the Online Safety Act) to ensure efforts are coordinated.

If you would like advice or assistance on issues raised in this blog, please contact our Data Protection team on 0113 207 0000.