ICO Fines Reddit for UK GDPR Violations
Summary
The UK's Information Commissioner's Office (ICO) has fined Reddit, Inc. £14.4 million for violating UK GDPR. The penalty stems from failures in age assurance mechanisms and data protection impact assessments, which unlawfully processed children's data and potentially exposed them to harmful content.
What changed
The Information Commissioner's Office (ICO) has issued a £14,472,500.00 penalty to Reddit, Inc. for infringements of Articles 5(1)(a), 6, 8, and 35 of the UK GDPR. Specifically, the ICO found that Reddit failed to implement robust age verification for users under 13, lacking a lawful basis for processing their personal data. Additionally, Reddit did not conduct a data protection impact assessment before January 2025 to evaluate and mitigate risks to children's data.
These findings indicate that Reddit unlawfully processed children's data, potentially exposing them to inappropriate and harmful content. Regulated entities, particularly online platforms processing data of minors, should review their age verification processes and data protection impact assessment procedures to ensure compliance with UK GDPR requirements. Failure to comply could result in significant financial penalties and reputational damage.
What to do next
- Review and enhance age assurance mechanisms for users under 13.
- Conduct data protection impact assessments for processing children's data.
- Ensure lawful basis for all personal data processing activities.
Penalties
£14,472,500.00 penalty
Source document (simplified)
Reddit, Inc.
- Date 23 February 2026
- Type Enforcement notices
Sector Online technology and telecoms
We imposed a £14,472,500.00 penalty to Reddit, Inc. for infringing Articles 5(1)(a), 6, and 8, and Article 35 of the UK GDPR. We found that Reddit, Inc.:failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13; and
failed to carry out a data protection impact assessment to assess and mitigate risks to children before January 2025.
These failures meant Reddit was using children’s data unlawfully, potentially exposing children to inappropriate and harmful content.
Named provisions
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Privacy & Cybersecurity alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when ICO Enforcement publishes new changes.