Britain’s data protection regulator has imposed a hefty fine on social media platform Reddit after finding serious violations related to children’s personal data. The UK Information Commissioner’s Office (ICO), the country’s privacy watchdog, announced in February 2026 that it had fined Reddit £14.47 million (around $20 million) for failing to adequately protect the personal information of children using its platform. The penalty marks one of the largest fines issued by the regulator for breaches involving children’s online privacy and highlights growing scrutiny of technology companies’ responsibilities toward young internet users.
The fine followed a lengthy investigation by the ICO into Reddit’s handling of user data, particularly involving minors under the age of 13. According to the regulator, Reddit unlawfully processed children’s personal information and did not implement sufficient systems to verify the age of users. This failure meant that children were able to create accounts and use the platform despite Reddit’s own terms of service prohibiting users under the age of 13. As a result, the regulator concluded that the company had no lawful basis for collecting and using the personal data of these young users.
The investigation revealed that Reddit relied largely on a simple system that asked users to declare their age when creating an account. However, the ICO found that such self-declaration methods were easy to bypass and did not provide effective protection for children online. Without proper age verification systems, many under-13 users were able to access the platform, where their personal data could be processed and they might be exposed to content not suitable for minors. The regulator said this created significant risks to children’s safety and privacy.
UK Information Commissioner John Edwards criticized the company’s practices, stating that children’s data had been collected and used in ways they could not understand or control. According to the regulator, these failures potentially exposed young users to harmful or inappropriate material on the platform. Edwards emphasized that large technology companies must take stronger steps to protect minors and comply with data protection laws, especially when their services are widely accessible to children.
Another major issue identified during the investigation was Reddit’s failure to conduct a Data Protection Impact Assessment (DPIA) before processing children’s data. Under UK data protection rules, companies must assess and mitigate risks to users’ privacy, especially when services are likely to be used by minors. The ICO said Reddit did not carry out such an assessment before January 2025, further violating legal requirements intended to protect children’s personal information.
The violations reportedly occurred over several years, from May 2018 to July 2025, when Reddit had no robust mechanism to ensure that under-age users were prevented from joining the platform. During that period, the regulator believes a large number of children may have been using the service without adequate safeguards. The ICO noted that the lack of proper controls meant children’s data could be collected, stored, and used by the company without parental consent or a lawful basis.
In response to regulatory pressure, Reddit began introducing new age-verification measures in mid-2025. These included checks to limit access to mature content and additional prompts asking users to confirm that they are at least 13 years old when creating an account. However, the ICO said these changes were implemented too late to prevent the penalty and may still not be sufficient if they rely solely on self-reported information.
Reddit has said it intends to appeal the fine. A spokesperson for the company argued that the regulator’s demands could force the platform to collect more personal information from users, which might conflict with Reddit’s approach of minimizing data collection to protect privacy. The company also stated that it has been working to improve safety measures and ensure compliance with international data protection standards.
The case forms part of a broader effort by the UK government and regulators to strengthen online protections for children. With new digital safety regulations and increased scrutiny of social media platforms, companies are under growing pressure to implement stronger age-verification systems and protect minors from harmful online content. Regulators say the Reddit fine sends a clear message to technology firms that children’s privacy must be taken seriously and that failure to comply with data protection laws will result in significant penalties.
Experts say the decision could have wider implications for the tech industry. As governments worldwide tighten rules around children’s online safety, platforms may need to redesign how they verify users’ ages and manage personal data. The UK regulator has also indicated that it is examining other online services and will continue enforcing strict rules to ensure that children’s privacy and safety remain a priority in the digital age.
