MediaLab.AI, Inc.

What happened

£247,590 penalty imposed on MediaLab.AI, Inc. in respect of infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR. MediaLab operated the Imgur social media platform in the UK prior to 30 September 2025 and allowed children under the age of 13 to access the platform, purportedly subject to a requirement for parental supervision and whilst claiming to rely on the Article 6(1)(a) UK GDPR (consent) lawful basis. However, MediaLab had no means of determining the age of its users and thus no means of ensuring that it obtained parental consent in respect of users under the age of 13, as required by Article 8 UK GDPR due to the fact that MediaLab offered infrormation society services (i.e. the Imgur platform) directly to children in the UK purportedly on the basis of consent. Therefore, MediaLab did not have a valid lawful basis for processing the personal data of children under the age of 13 and thus processed their personal data unlawfully. In addition, MediaLab failed to carry out a DPIA prior to engaging in a form of high risk processing, specifically, processing the personal data of children under the age of 18 where it intended to offer online services to those children, placing MediaLab in breach of Article 35(1) UK GDPR. The period of infringement began on 27 September 2021, when MediaLab acquired Imgur, Inc. and continued until 30 September 2025, when MediaLab implemented a geo-block which prevents individuals in the UK from accessing the Imgur platform. The penalty was reduced from the £393,000 proposed in the NOI dated 10 September 2025 following consideration of MediaLab's representations and updated financial information.

Summarised from the notice published by the ICO on 4 February 2026. Read the original notice — it is the authoritative version.