The UK Information Commissioner’s Office has issued Reddit a provisional notice of intent to fine the company £14 million, alleging it failed to use children’s personal information lawfully and did not do enough to assess whether users were under 18. The regulator said the platform fell short of UK data protection requirements tied to children’s privacy and age assurance.
The proposed penalty is not final. Under UK enforcement procedure, Reddit can respond to the ICO’s findings before any fine is confirmed. Reddit said it would review the notice and engage with the regulator.
The case centers on privacy compliance rather than a breach or cyberattack, but it carries wider security implications. UK rules, including the Children’s Code, expect services likely to be accessed by minors to build in stronger safeguards by default. That includes limiting data collection, setting higher privacy protections for younger users, and using age checks that are effective without becoming overly intrusive.
That last point is where the enforcement action is likely to resonate beyond Reddit. Regulators want platforms to identify children and restrict certain risks, yet age verification systems can introduce new privacy concerns if they rely on identity documents, biometric scans, or broad data sharing with third parties. For companies under pressure to tighten controls, the challenge is proving age in a way that meets both safety and privacy standards.
The ICO’s move signals that mainstream social platforms cannot assume child privacy rules apply only to services aimed directly at children. It also adds pressure on firms to revisit age-gating, profiling, and default account settings for younger users. As platforms test new controls, some may push users toward more identity-heavy checks or third-party verification providers, creating fresh questions about data minimization and how sensitive records are stored. Users concerned about online tracking often turn to tools such as a VPN, but network privacy tools do not solve the underlying issue of how platforms collect and process age-related data.
For Reddit, the immediate risk is a sizable financial penalty if the ICO finalizes its decision. For the broader market, the message is clearer: age assurance is becoming a compliance issue, and weak child privacy controls can now trigger major regulatory action.
