The UK’s data protection regulator has fined Reddit £14.5 million ($19.6m) for failing to properly verify users’ ages. Authorities say the lapse exposed children to potential harm and led to unlawful use of their personal information.

The Information Commissioner's Office (ICO) announced the fine, alleging that Reddit did not apply any robust age assurance mechanism before allowing users to access its platform.

According to the regulator, this failure meant the company did not have a lawful basis to process the personal information of children under 13.

“Our investigation found that Reddit failed to apply any robust age assurance mechanism,” the ICO said in a press release. It added that these shortcomings potentially exposed children to inappropriate and harmful content.

Findings based on pre–July 2025 practices

The ICO’s conclusions focus primarily on Reddit’s actions before July 2025, when the platform rolled out a new age-verification system for UK users seeking to access adult content.

However, the regulator said concerns remain even after the update. Reddit still relies on users to declare their age when opening an account — a method the ICO believes presents risks because it is easy to bypass.

The ICO also penalized Reddit for allegedly failing to carry out a Data Protection Impact Assessment (DPIA) to assess risks to children before January 2025.

Earlier, the watchdog fined MediaLab £247,590 for a similar violation involving image-sharing platform Imgur.

Reddit says it will appeal

Reddit confirmed it plans to challenge the decision.

In a statement provided to Ars Technica, the company criticized the regulator’s approach, arguing that stronger age verification would require collecting more private data from users.

“Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety,” the company said.

Reddit pointed to its privacy policy, which emphasizes minimal data collection. Users can browse anonymously, do not need to provide their real names, and are not required to share precise location data.

On July 14, 2025, Reddit began verifying the ages of UK users attempting to access adult content to comply with the UK’s Online Safety Act, enforced by Ofcom.

The platform partnered with age-verification vendor Persona to carry out checks. Persona verifies users through either a selfie or a government-issued ID.

Reddit has stated that it does not receive the uploaded photo and only stores verification status along with the user-provided birthdate.

Self-declaration under regulatory scrutiny

Despite the new measures, the ICO remains critical of self-declaration systems.

In its December 2025 children’s privacy progress update, the watchdog warned that relying solely on users to declare their age is not appropriate for high-risk services. It said self-declaration makes it too easy for children to bypass safeguards.

The regulator confirmed that Reddit and other platforms depending primarily on self-declaration will face continued scrutiny.

“To address this, we will be prioritizing high-risk services for further regulatory engagement,” the ICO said.

Reddit said the vast majority of its UK users are adults and emphasized that it globally prohibits and removes users under the age of 13. The company also provides a reporting form for suspected underage accounts.

When asked whether it would expand age verification to other countries, Reddit pointed to its earlier statement indicating it may do so if similar laws are enacted elsewhere.