Reddit's £14.5 Million Lesson

Turns out "just say you're 13" isn't a privacy strategy.

TL;DR: The UK's Information Commissioner's Office fined Reddit £14.47 million ($19.6 million) on February 24, 2026 for failing to protect children's data. Reddit's terms of service banned users under 13, but the company had no real way to enforce it until July 2025. Kids just clicked past the age gate. Their data got collected, sold for advertising, and used to serve them content they shouldn't see. Reddit calls the fine "counterintuitive" and plans to appeal. The ICO calls it what it is: unlawful processing of children's personal information.

What Reddit Did Wrong

Reddit's terms of service say users must be 13 or older. Simple enough.

The problem: Reddit relied on users to declare their own age. No verification. No checks. No consequences for lying.

The UK Information Commissioner's Office investigated and found:[1]

  • No age verification until July 2025: Kids could create accounts for years without any real barrier
  • No Data Protection Impact Assessment until January 2025: Reddit didn't even assess the risks of processing children's data until regulators came knocking
  • "A large number of children under 13" on the platform: The ICO didn't release exact figures, but clearly enough to matter
  • Children exposed to harmful content: Without age verification, kids accessed everything adults could

UK Information Commissioner John Edwards put it bluntly: "Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control."[2]

The Third-Largest ICO Fine Ever

At £14.47 million ($19.6 million), this is the ICO's third-largest penalty:[3]

  1. British Airways: £20 million (2020) for failing to detect a breach for two months
  2. Marriott Hotels: £18.4 million (2020) for exposing 300+ million customer records
  3. Reddit: £14.47 million (2026) for children's privacy failures

The fine could have been larger. The ICO reduced it from an initial £24 million after Reddit cooperated and implemented changes.[4]

Reddit's Response: "Collect More Data?"

Reddit isn't accepting the ruling quietly. The company called the fine "counterintuitive":

"The ICO's insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users' online privacy and safety."

Reddit argues that age verification requires collecting more personal data (ID documents, biometrics, etc.), which creates new privacy risks.

It's a real tension. But the ICO's position is clear: if you can't verify ages, you can't claim you're not serving children. And if you are serving children, you need to protect them differently.

Reddit says it now uses Persona for third-party identity verification when users try to access mature content. The company plans to appeal.[2]

What Reddit Changed (Eventually)

After the ICO started investigating, Reddit made changes:

  • July 2025: Introduced age verification for accessing mature (18+) content
  • January 2025: Conducted first Data Protection Impact Assessment
  • Self-declaration at registration: Still the primary age gate for the platform overall

The core problem remains: self-declaration is what the ICO specifically said isn't enough. Clicking "I am 13" doesn't verify anything.

Why This Matters Beyond Reddit

This fine signals where UK regulators are heading. The ICO's Children's Code (Age Appropriate Design Code) requires platforms to:[5]

  • Implement age-appropriate privacy settings by default
  • Minimize data collection from children
  • Provide clear, age-appropriate privacy information
  • Know the ages of users with reasonable confidence

That last point is the killer. "Reasonable confidence" means more than self-declaration. Platforms that serve UK users (which is most major platforms) need to figure out age verification or face fines.

The same week Reddit got fined, the ICO also penalized OnlyFans operator Fenix International and three pornography sites (Aylo, MG Freesites, and WGCZ) for similar failures.[6]

What This Means for US Users

The UK fine doesn't directly affect American users. But it suggests where enforcement is headed globally.

The FTC finalized major updates to COPPA (Children's Online Privacy Protection Act) in 2025, with full compliance required by April 22, 2026. Those updates include:[7]

  • Stricter requirements for verifiable parental consent
  • New acceptable consent methods (video verification, face-match ID)
  • Limits on data retention
  • Restrictions on targeted advertising to children

FTC Chairman Andrew Ferguson has publicly stated that COPPA enforcement will be a priority. If Reddit's UK fine is any indication, platforms treating "click here if you're 13" as a compliance strategy are in trouble.

What Parents Can Do

Assume Self-Declaration Fails

If a platform "verifies" age by asking users to confirm they're old enough, assume kids can bypass it. Because they can.

Use Parental Controls

Device-level controls (Screen Time, Family Link) work better than platform-level age gates. Control access at the phone, not the app.

Check Privacy Settings

Reddit's default settings aren't privacy-focused. If teens use Reddit: turn off personalized ads, limit data sharing, disable location.

Talk About What They See

Reddit has everything. Good communities, toxic ones, and content that shouldn't exist. No age gate replaces conversation.

The Bottom Line

Reddit built a platform accessible to everyone, including children it claimed to exclude. For years, the company collected kids' data without legal basis, served them content without safeguards, and profited from their engagement.

£14.5 million is a rounding error for a company valued at $6.4 billion after its 2024 IPO. The fine isn't punishment. It's a cost of doing business.

But regulators are getting more aggressive. The UK's Children's Code has teeth. The FTC is updating COPPA. Platforms that rely on performative age gates ("just click this button") are running out of time.

Reddit's appeal will be worth watching. If they lose, every platform serving UK users will need to reconsider what "age verification" actually means.

References

  1. ICO - Reddit Issued with £14.47m Fine for Children's Privacy Failures (February 24, 2026)
  2. The Register - ICO Fines Reddit £14.47M for Letting Kids Slip Past the Gate (February 2026)
  3. Engadget - Reddit Fined $19.6 Million Over Age Verification Checks in the UK (February 2026)
  4. Biometric Update - ICO Hits Reddit with £14.5M Fine for Not Implementing Robust Age Assurance (February 2026)
  5. ICO - Children's Code Hub
  6. Malwarebytes - Reddit, Porn Sites Fined by UK Regulators Over Children's Safety and Privacy (February 2026)
  7. FTC - Complying with COPPA: Frequently Asked Questions