The United Kingdom’s Information Commissioner’s Office fined Reddit £14.5 million on February 24, 2026, after finding that the platform unlawfully used personal data belonging to children under 13. The regulator said the company’s practices also risked exposing young users to content that was inappropriate or harmful.
According to the ICO, large numbers of under-13s had used Reddit even though the service’s terms require users to be at least 13. The platform asked people opening accounts to state their age, but the regulator concluded that self-declaration was easy to bypass and did not provide effective assurance. It also found that Reddit had not completed a data-protection impact assessment focused on children’s risks before January 2025.
Information Commissioner John Edwards said children’s information had been collected and used without controls they could understand, consent to or manage. He argued that online services likely to attract children must have suitable ways to assess age and reduce risks created by their data practices. The penalty was described as the ICO’s largest for a children’s privacy breach and its third-largest financial sanction overall.
Reddit disputed the decision and said it would appeal. A company spokesperson argued that requiring more identity information from every UK user would conflict with its approach to privacy and safety. Reddit said it does not generally require users to disclose identity information and removes accounts when it determines that their holders are under 13.
The dispute highlights a tension in age assurance: platforms are expected to keep young children out of unsuitable services while limiting the additional personal information collected from everyone else. The ICO’s decision held that Reddit’s earlier reliance on a declared age did not adequately manage that problem. Reddit’s planned appeal meant the company contested both the regulator’s reasoning and the resulting penalty.
By the time of the fine, Reddit had introduced stronger checks for a different age threshold. Since July 2025, UK users seeking mature content, including pornography, had been required to demonstrate that they were over 18 using a selfie or government identification. That measure was introduced in response to the Online Safety Act and did not erase the regulator’s findings about earlier processing involving children under 13.
The case concerned data protection rather than a blanket prohibition on children using social platforms. Campaigners at the 5Rights Foundation said relevant safeguards had existed since 2018 and criticised the time taken to enforce them. The final legal position remained unsettled because of Reddit’s appeal, but the February 24 action established the ICO’s findings and the scale of the sanction imposed.
