Reddit fined £14.47m for age check failures

The UK's data regulator has just sent a clear message to social media platforms: honour systems are dead. Reddit's £14.47m penalty for failing to properly verify users' ages represents the opening shot in what Information Commissioner John Edwards describes as a focused campaign against platforms 'primarily using' self-declared age checks. The fine stems from an investigation that found Reddit operated without any robust age assurance mechanism despite its terms of service explicitly banning under-13s.

With 121 million daily users, the platform processed children's personal data unlawfully for years, only implementing actual verification measures in July 2025. That multi-year gap between policy and practice is what should concern Reddit's peers. Edwards didn't mince words.

Relying on users to declare their age themselves is not enough when children may be at risk. We are focusing now on companies that are primarily using this method.

The honour system's expensive failure

The scale of Reddit's compliance failure is striking. Beyond the absence of age verification, the company didn't conduct a data protection impact assessment to evaluate risks to children until January 2025. These are basic regulatory requirements under existing data protection law, not new obligations introduced by recent legislation.

What makes this particularly significant is the timing. The £14.47m fine applies under current data protection frameworks, before the Online Safety Act's child protection provisions are fully in force. That legislation, which places additional duties on platforms to protect children from harmful content, suggests future penalties could climb higher.

The ICO's framing that children had 'their personal information collected and used in ways they could not understand, consent to or control' and were 'potentially exposed to content they should not have seen' emphasises risk rather than documented harm. The regulator hasn't cited specific incidents of children accessing inappropriate material. But from a compliance perspective, that distinction matters little.

Who's next in the firing line

The ICO's explicit focus on platforms using self-declaration creates exposure across the industry. X, formerly Twitter, has faced repeated questions about its age verification practices since Elon Musk's takeover stripped back content moderation infrastructure. Discord, popular with gaming communities that skew young, similarly relies largely on users attesting their age.

Reddit's belated implementation of age assurance in July 2025 raises an obvious question: what took so long? The company had the technical capability and presumably the budget. The inference is that enforcement was simply never a priority until regulatory pressure mounted.

For platforms operating in the UK market, the cost equation has shifted dramatically. Implementing robust age verification isn't cheap. Technologies range from credit card checks to facial age estimation, document verification, and third-party assurance services. Each approach carries trade-offs around accuracy, user friction, privacy implications, and expense.

Those costs must now be weighed against penalties approaching £15m, reputational damage, and the prospect of ongoing regulatory attention.

The regulatory ratchet tightens

Edwards's statement that the ICO is 'continuing to consider the age assurance controls now implemented' by Reddit suggests the regulator isn't satisfied with a simple fine-and-forget approach. Reddit remains under watch, and the adequacy of whatever system it deployed last July is still being evaluated. This represents a shift in regulatory posture.

The ICO has moved from issuing guidance and expressing concerns to active enforcement with substantial financial penalties. The choice of Reddit as the first major platform to face this level of sanction for age verification failures sends a deliberate signal about priorities. The implications extend beyond child safety into broader platform economics.

Effective age assurance reduces addressable audiences and complicates user acquisition. Anonymous browsing becomes more difficult. Conversion rates typically drop when registration friction increases. These aren't trivial concerns for platforms built on network effects and advertising revenue.

But the alternative is regulatory action that makes those concerns look minor. A £14.47m fine represents a rounding error for Meta or Google, but the precedent and the enforcement trend matter more than the absolute figure. The UK's data protection regulator has fined social media giant Reddit £14.47 million over its use of children's data, building a track record that raises the cost of non-compliance beyond the immediate penalty.

The regulator's closing exhortation that 'industry take note, reflect on their practices and urgently make any necessary improvements' reads less like advice and more like a countdown. Reddit's fine is the example. The broader enforcement campaign is just beginning. Platforms that haven't already begun implementing robust age verification would be wise to accelerate those timelines.