Reddit fined £14m by UK data watchdog over age check failings

• Reddit fined £14.47m by the ICO for failing to prevent under-13s accessing adult content and unlawfully processing children's personal data

• The platform has surged to become the UK's fourth most popular social media platform in 2025, according to Ofcom rankings

• Reddit plans to appeal, arguing the ICO demands it collect "more private information on every UK user" — contradicting data minimisation principles

A £14.47m fine landed on Reddit's desk this week, and buried within the regulatory paperwork lies a question that should trouble anyone building online services: can you protect children without dismantling their privacy? The Information Commissioner's Office handed down the penalty after finding Reddit failed to implement adequate age verification, allowing under-13s onto a platform rife with adult content and unlawfully processing their personal data. But Reddit's response cuts to the heart of a growing tension in UK tech regulation.

The platform accused the ICO of demanding it collect "more private information on every UK user" — a stance seemingly at odds with every principle of data minimisation that regulators have spent years championing. This isn't an academic debate. Reddit has surged to become the UK's fourth most popular social media platform in 2025, according to Ofcom rankings, and 12th most visited site overall.

Person using smartphone displaying social media application

The verification paradox

Reddit's pre-July 2025 approach was straightforward: ask users their birthdate when creating an account, then trust them. The ICO dismissed this as "easy to bypass" — which it demonstrably was, given the regulator's estimates suggested "a large number of children under 13" were active on the platform despite terms of service prohibiting them. When Online Safety Act requirements came into force in July 2025, Reddit implemented restrictions preventing unverified users from viewing certain profiles and subreddits containing adult material.

But by then, the ICO had already begun investigating the platform in March, alongside TikTok and image-sharing site Imgur. The finding was damning: Reddit had processed children's data without lawful basis. Under UK law, companies must take particular care with child users' information because minors may lack awareness of the risks inherent in data collection and use.

To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Reddit failed to meet these expectations.

What makes this enforcement action particularly pointed is Reddit's business model. Unlike Meta or TikTok, which hoover up vast quantities of personal data to fuel advertising engines, Reddit has positioned itself as privacy-conscious — deliberately not requiring users to share identifying information. The company stated it maintains this approach "because we are deeply committed to their privacy and safety."

The ICO's position forces a reckoning with that model. Commissioner John Edwards was blunt: "To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Reddit failed to meet these expectations."

Child using digital device with parental supervision

A new regulatory era takes shape

The Reddit fine sits within a broader pattern of enforcement. The ICO confirmed it's working closely with Ofcom, which recently penalised several pornography site operators for inadequate age verification under Online Safety Act provisions. This coordinated approach signals something more substantial than isolated enforcement actions — it represents the UK's regulatory infrastructure clicking into active mode.

Whether £14.47m constitutes a meaningful deterrent for a platform of Reddit's scale remains an open question. The company hasn't disclosed UK-specific revenue figures, but the fine likely registers as significant without being existential. Perhaps that's the point: large enough to hurt, calibrated to avoid crushing.

Reddit has confirmed it intends to appeal, setting up what could become a test case for how privacy and child safety obligations interact under UK law. The platform's argument essentially challenges the regulatory premise: that robust age verification necessarily requires collecting and processing more personal data.

That's not entirely accurate. Age assurance technology has evolved beyond simple "enter your birthdate" forms or uploading passport scans. Third-party verification services, estimation tools using facial analysis, and cryptographic methods allowing age confirmation without revealing identity all exist in various stages of deployment. The ICO isn't mandating a specific technical approach.

If protecting children online requires platforms to definitively know who their users are, the internet's capacity for pseudonymity and privacy-by-default becomes collateral damage.

But here's where things get interesting: even privacy-preserving age verification methods require some data processing, and they introduce friction into user onboarding. For platforms competing on ease of access and pseudonymous participation — core features of Reddit's appeal — that friction carries real costs.

Privacy and data security concept with digital lock

What comes next

Reddit's appeal will take months to resolve, but the regulatory trajectory is already set. The Online Safety Act isn't going anywhere, and both the ICO and Ofcom have demonstrated appetite for enforcement. Other platforms operating in the UK face the same calculus: implement robust age assurance or risk substantial penalties.

The broader industry should watch this case closely, not just for the legal precedent but for the philosophical one. If protecting children online requires platforms to definitively know who their users are, the internet's capacity for pseudonymity and privacy-by-default becomes collateral damage. If platforms can avoid verification by claiming privacy concerns, child safety obligations become effectively optional.

Neither outcome feels adequate. Perhaps that discomfort is the actual signal here — that the regulatory framework is finally catching up to problems the industry has ignored for two decades, and the solutions won't be comfortable for anyone involved.

• Reddit's appeal will test whether privacy-first business models can survive robust child safety enforcement under UK law — a precedent every platform should monitor closely

• Coordinated enforcement between the ICO and Ofcom signals the Online Safety Act regime is transitioning from theory to active prosecution, making age assurance implementation no longer optional for UK-facing services

• The fundamental tension between user privacy and child protection remains unresolved: platforms must find technical solutions that satisfy both obligations or face regulatory consequences that could reshape how the internet functions