Introduction

The UK’s Information Commissioner’s Office (ICO) has imposed a significant fine of $19.5 million on Reddit for its failure to protect children’s personal data. This move comes after an investigation revealed that the company did not apply an age assurance mechanism, thereby exposing children under 13 to inappropriate and harmful content.

Failure to Implement Age Assurance Mechanism

The investigation found that Reddit did not have a lawful basis for processing the personal information of children under 13. Moreover, the company failed to carry out a data protection impact assessment to assess and mitigate risks to children before January 2025. As a result, children’s personal information was collected and used in ways they could not understand, consent to, or control.

Consequences of Inaction

According to John Edwards, UK Information Commissioner, ‘Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control. That left them potentially exposed to content they should not have seen.’ This raises serious concerns about the potential harm that children may have been exposed to due to Reddit’s inaction.

Introduction of Age Assurance Measures

In July 2025, Reddit introduced age assurance measures, including age verification for accessing mature content and asking users to declare their age when opening an account. However, the ICO has expressed concerns that relying on self-declaration presents risks to children, as it is easy to bypass.

Call to Action for Industry

Edwards emphasized, ‘Relying on users to declare their age themselves is not enough when children may be at risk, and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices, and urgently make any necessary improvements to their platforms.’ This serves as a warning to other companies to review their age assurance mechanisms and make necessary improvements.

Penalty and Ongoing Review

The Information Commissioner’s Office based the penalty on the number of children affected by the infringement, the risk of harm, the duration of the failings, and Reddit’s global turnover. The ICO will continue to keep Reddit’s processing of children’s personal information under review as part of its ongoing work on platforms that rely mainly on self-declaration.

Conclusion and Call to Action

In conclusion, Reddit’s failure to protect children’s personal data has resulted in a significant fine. The company’s introduction of age assurance measures is a step in the right direction, but more needs to be done to ensure that children are protected from harmful content. We urge all companies to review their age assurance mechanisms and make necessary improvements to prioritize the safety and well-being of children online.

Frequently Asked Questions

1. What was the reason for the fine imposed on Reddit? The fine was imposed due to Reddit’s failure to protect children’s personal data by not applying an age assurance mechanism.
2. How much was the fine imposed on Reddit? The fine imposed on Reddit was $19.5 million.
3. What measures has Reddit introduced to address the issue? Reddit has introduced age assurance measures, including age verification for accessing mature content and asking users to declare their age when opening an account.
4. What is the ICO’s stance on self-declaration as an age assurance mechanism? The ICO has expressed concerns that relying on self-declaration presents risks to children, as it is easy to bypass.
5. What is the next step for Reddit and other companies? The ICO will continue to keep Reddit’s processing of children’s personal information under review, and other companies are encouraged to review their age assurance mechanisms and make necessary improvements.