Reddit fined $19.5 million for failing to protect children’s personal data

The UK’s Information Commissioner’s Office (ICO) has fined Reddit $19.5 million after finding that the company failed to use children’s personal information lawfully, exposing them to inappropriate and harmful content.

The investigation found that Reddit did not apply an age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under 13. The company also failed to carry out a data protection impact assessment to assess and mitigate risks to children before January 2025.

“Children under 13 had their personal information collected and used in ways they could not understand, consent to, or control. That left them potentially exposed to content they should not have seen,” John Edwards, UK Information Commissioner, explained.

In July 2025, Reddit introduced age assurance measures that include age verification for accessing mature content and asking users to declare their age when opening an account. The ICO told Reddit that relying on self-declaration presents risks to children because it is easy to bypass.

Edwards continued, “Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method. I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms.”

The Information Commissioner’s Office based the penalty on the number of children affected by the infringement, the risk of harm, the duration of the failings, and Reddit’s global turnover. The ICO is keeping Reddit’s processing of children’s personal information under review as part of its ongoing work on platforms that rely mainly on self-declaration.