Monetary penalties · Online technology and telecoms
Reddit, Inc.
£14.47mpenalty
Root cause
Children's data
Processing children's personal data without age assurance, parental consent or a lawful basis — the ICO's most active enforcement front against large platforms.
What happened
We imposed a £14,472,500.00 penalty to Reddit, Inc. for infringing Articles 5(1)(a), 6, and 8, and Article 35 of the UK GDPR.
failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13; and
failed to carry out a data protection impact assessment to assess and mitigate risks to children before January 2025.
These failures meant Reddit was using children’s data unlawfully, potentially exposing children to inappropriate and harmful content.
Summarised from the notice published by the ICO on 23 February 2026. Read the original notice — it is the authoritative version.