In a significant move to safeguard children’s online privacy, Reddit has been hit with a £14.47 million fine by the UK’s Information Commissioner’s Office (ICO). This penalty comes after Reddit was found to have failed in meeting strict requirements designed for children’s data protection. This blog looks at the decision and what this means going forward.
The ICO enforces rules under the UK General Data Protection Regulation (UK GDPR) and the Children’s Code (also known as the Age-Appropriate Design Code). These laws are designed to ensure that online platforms take extra care when handling the personal data of children under 18. Reddit, as a popular online platform, is required to follow these rules, but the ICO found that it fell short in several key areas.
What is the Children’s Code?
The Children’s Code is a set of 15 standards that online services must follow to protect children’s privacy. It requires platforms to:
- Design services that are age-appropriate;
- Provide clear and easy-to-understand privacy notices for children; and
- Avoid practices like targeted advertising and profiling children without proper safeguards.
Essentially, the Code ensures that children’s data is handled responsibly and transparently, recognising that children may not fully understand the risks of sharing personal information online.
Why was Reddit fined?
Reddit’s terms of service explicitly ban children under 13 from using the platform, yet it failed to introduce any meaningful age‑verification measures to enforce the ban until July 2025. ICO estimates later revealed that a substantial number of under‑13s had been accessing the site, meaning that Reddit had been processing their personal data without a lawful basis. In addition to this, Reddit had not completed a Data Protection Impact Assessment focused on the risks associated with handling children’s information before January 2025, despite allowing teenagers aged 13 to 18 to create accounts and use the platform. This failure to both understand and address the heightened vulnerabilities of young users meant that children were left exposed not only to unlawful data practices but also to the possibility of encountering inappropriate or harmful content on the platform.
When determining the quantum of the £14.47m penalty, the ICO emphasised the scale and seriousness of the infringement, the number of children affected, the potential harm involved, the prolonged duration of Reddit’s failings and the company’s significant global turnover. Having considered these aspects, the ICO decided that the £14.47m penalty.
Notably, the UK Information Commissioner, John Edwards stated that it was concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children. He further noted that Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Relying on users to declare their age themselves is not enough when children may be at risk. Reddit failed to meet these expectations.
How does the ICO enforce these rules?
The ICO has strong enforcement powers, including the ability to issue fines of up to £17.5 million or 4% of a company’s global annual turnover. In this case, the £14.47 million fine reflects the seriousness of Reddit’s failure to protect children’s privacy. The ICO’s action against Reddit sends a clear message to other online platforms. It signifies that protecting children’s data is not optional and should be treated with the utmost care and caution.
Why is this important?
Children are particularly vulnerable online because they may not fully understand how their personal data is collected, used or shared. That’s why the UK GDPR and the Children’s Code require companies to take extra precautions when designing services that children are likely to use. This case highlights the importance of these protections and the consequences for companies that fail to comply.
What can other platforms learn?
The fine dealt to Reddit serves as a wake-up call for all online platforms. It has reinforced the position that companies must prioritise children’s privacy by:
- Building services with privacy protections from the start;
- Ensuring their services are suitable for children and provide clear information about data use; and
- Avoiding practices that exploit children’s data, such as targeted advertising or profiling.
How can we help?
Giacomo Ciccognani is a solicitor in our expert Dispute Resolution team.
If you have concerns about children’s data protection, please contact Giacomo or a member of our expert team in Derby, Leicester, or Nottingham on 0808 239 3916 or via our online enquiry form.
Contact usIf this article relates to a specific case/cases, please note that the facts of this case/cases are correct at the time of writing.