UK ICO Fines Reddit £14.47M Over Children's Data Privacy Failures

Overview of the ICO Enforcement Action

The UK Information Commissioner’s Office (ICO) has issued a significant monetary penalty of £14.47 million (approximately $19.5 million) against Reddit Inc. for several high-profile breaches of the UK General Data Protection Regulation (UK GDPR). This enforcement action focuses on the platform’s systemic failure to protect the privacy of children under the age of 13 between May 2018 and July 2023. According to BleepingComputer, the ICO determined that Reddit processed the personal data of approximately 1.5 million UK children without obtaining the necessary parental consent or implementing sufficient age verification measures.

Technical and Regulatory Failures

The ICO’s investigation identified specific architectural and procedural failures within Reddit’s data processing lifecycle. Under Article 8 of the UK GDPR, the processing of personal data for a child is only lawful if the child is at least 13 years old. For children below this threshold, the platform must obtain authorization from a parent or guardian.

Inadequate Age Verification Mechanisms

Reddit’s primary compliance failure involved its reliance on ineffective ‘age gates’—simple self-declaration forms that are easily bypassed. The ICO found that the platform did not make ‘reasonable efforts’ to verify user ages, despite having access to data points that could indicate the presence of underage users. From a technical standpoint, the regulator noted that Reddit failed to utilize behavioral analytics or available third-party age assurance technologies to identify and restrict accounts belonging to children.

Transparency and Information Standards

Beyond the lack of lawful consent, the ICO identified a failure in Reddit’s obligation to provide transparent information about data processing. Article 12 of the GDPR requires that privacy information addressed to children be provided in a concise, intelligible, and easily accessible format, using clear and plain language. The investigation concluded that Reddit’s privacy notices were not tailored for a younger audience, making it difficult for children or their parents to understand how their data was being harvested for advertising and profiling purposes.

Broader Implications for Social Platforms

This penalty follows a regulatory trend of prioritizing ‘Privacy by Design’ for minors, similar to recent actions taken against other major social media entities. It serves as a warning that passive age-gating is no longer considered a sufficient defense against GDPR violations. For security and privacy professionals, this highlights a shifting risk landscape where regulatory non-compliance carries financial and reputational impacts comparable to a major data breach.

The final fine was reduced from an initial proposal after Reddit demonstrated improvements to its age assurance processes. However, the core violation remains: the unauthorized collection of data for behavioral advertising without a valid legal basis.

Recommendations for Compliance and Privacy Teams

To mitigate the risk of regulatory enforcement under UK GDPR, organizations operating public-facing platforms should implement the following strategies:

• Deploy Robust Age Assurance: Move beyond self-declaration by integrating third-party age verification APIs or AI-driven behavioral analysis to flag accounts likely belonging to minors.
• Enforce Data Minimization: If a user is suspected of being underage, platforms should automatically cease tracking for non-essential purposes, particularly for targeted advertising and profiling.
• Privacy-First Default Settings: Implement the highest privacy settings by default for all users until age can be verified, ensuring that sensitive data points (like location or browsing history) are not collected by default.
• Audit Data Deletion Processes: Ensure that when an account is flagged as underage, all associated metadata and PII are purged from both production databases and backup archives to comply with ‘right to be forgotten’ requirements.