Reddit fined £14.5m in UK over use of under-13s’ data | Reddit
The UK information regulator has fined social news service Reddit £14.5 million for illegally using data from children under 13 and potentially exposing them to inappropriate and harmful content.
The hefty fine from the Information Commissioner’s Office (ICO) is the largest ever for a breach of children’s privacy and comes after the US-based company introduced age checks in July, including age verification for accessing adult content. The ICO had previously stated that “there are a large number of children under the age of 13 on the platform and Reddit has no legal basis to process the personal information of these children.”
Reddit asks users to declare their age when opening an account, but the ICO said relying on self-reporting poses a risk to children as it is easy to circumvent. The regulator also found that Reddit had not carried out a data protection impact assessment to assess and mitigate risks to children before January 2025.
“Personal information from children under the age of 13 has been collected and used in ways they cannot understand, consent to or control,” information commissioner John Edwards said. “This potentially exposed them to content they should not have seen. This is unacceptable and has resulted in a fine today.”
This is the third-largest financial penalty imposed by the ICO, after the £20 million fine imposed for the British Airways data breach in 2018, which affected more than 400,000 customers, and the £18.4 million fine imposed on the Marriott Hotel group, where more than 300 million customer records were affected in the 2014 attack.
Reddit said it would appeal the decision. “The ICO’s insistence that we collect more private information about every user in the UK is unreasonable and contradicts our strong belief in the privacy and security of our users online,” a spokesman said.
The company said it wasn’t users require “Because we are deeply committed to their privacy and security,” sharing information about their identities, regardless of their age. It says it removes users under 13 because they are not allowed. In the user agreement “by using the services, at least 13 years old”.
Since last July, Reddit began requiring users in the United Kingdom who wish to view adult content such as pornography to show they are over 18 by uploading a selfie or a photo of their official ID to comply with the Online Safety Act.
Edwards said: “Companies that operate online services accessible to children have a responsibility to protect those children by ensuring they are not exposed to risks because of the way their data is used. To do this, they need to make sure they know the age of their users and have appropriate, effective age assurance measures in place. Reddit has failed to meet these expectations.”
Online child rights advocates said the regulation needed to prevent the risk posed by Reddit has been in place since 2018.
Colette Collins-Walsh, head of UK affairs at the 5Rights Foundation, said: “For years, a major global platform has relied on little more than a checkbox to declare its own age, leaving its youngest users unprotected.
“While the government is discussing raising age limits on the internet, the regulation needed to prevent exactly this kind of failure has been in place and unenforced since 2018. New rules mean little unless the existing rules are upheld.”
