Cybersecurity Policy Report, Reddit Fined Over Failure to Identify Underage Users in U.K., (Feb 24, 2026)
Reddit, Inc., faces a fine of 14.47 million pounds sterling ($19.6 million) in the United Kingdom over inadequate privacy safeguards that allowed children under the age of 13 to use the platform, the U.K.’s Information Commissioner’s Office (ICO) announced today.
“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine,” Information Commissioner John Edwards said in a news release.
Reddit said it would appeal the fine. “Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety. The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety,” a company spokesperson told CPR via e-mail.
The ICO said it warned Reddit last year that its reliance on users’ to self-report their ages wasn’t enough to comply with the U.K.’s Data Protection Act and age-appropriate design code.
“In July 2025, Reddit introduced age assurance measures that include age verification to access mature content and asking users to declare their age when opening an account. The ICO informed Reddit that relying on self-declaration presents risks to children as it is easy to bypass,” it said.
“Where children under a certain age are not allowed to use a service, organisations must focus on preventing access and enforce their minimum age requirements using robust age assurance methods,” it added.
The ICO said it would continue monitoring age-verification compliance at Reddit and other online platforms.
“Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place,” Mr. Edwards said.
“Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method,” he added. “I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms.”
News: InternationalLegislation DataPrivacy LitigationEnforcement