The UK’s information regulator has fined social news service Reddit £14.5 million for illegally using the data of children under 13 and potentially exposing them to inappropriate and harmful content.
The hefty punishment from the Information Commissioner’s Office (ICO) is the largest fine yet for a breach of children’s privacy and comes after the US-based company introduced age checks in July, including age verification for accessing adult content. Prior to this, the ICO said, there were “a large number of children under the age of 13 on the platform and Reddit had no legal basis to process their personal information.”
Reddit asks users to declare their age when opening an account, but the ICO said relying on self-declaration posed risks for children as it was easy to circumvent. The regulator also found that Reddit did not carry out a data protection impact assessment to assess and mitigate risks to children before January 2025.
“Personal information from children under 13 was collected and used in ways they could not understand, consent to or control,” said John Edwards, the information commissioner. “This left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”
It is the third largest financial punishment the ICO has issued, following a £20m fine for a British Airways data breach affecting more than 400,000 customers in 2018, and an £18.4m fine for hotel group Marriott when more than 300m customer records were affected in a 2014 attack.
Reddit said it would appeal the decision. “The ICO’s insistence that we collect more private information about every UK user is contradictory and contradicts our strong belief in the online privacy and security of our users,” a spokesperson said.
The company said no. require users to share information about their identities, regardless of their age, “because we are deeply committed to their privacy and security.” It says it removes users under 13 because they are not allowed. Your user agreement states that “by using the services, you represent that you are at least 13 years.
Since last July, Reddit began requiring UK users who want to view adult content, such as pornography, to prove they are over 18 by uploading a selfie or a photo of their government ID, to comply with the Online Safety Act.
Edwards said: “Companies that operate online services that are likely to be accessed by children have a responsibility to protect those children by ensuring that they are not exposed to risks through the way their data is used. To do this, they must be sure that they know the age of their users and have appropriate and effective age assurance measures in place. Reddit has failed to meet these expectations.”
