UK fines Reddit for not checking user ages aggressively enough

Source: Ars Technica

UK regulator fines Reddit £14.5 million

UK agency alleges “Reddit failed to apply any robust age assurance mechanism.”

Credit: Getty Images | picture alliance

A UK regulator today fined Reddit £14.5 million (≈ $19.6 million) for not verifying the ages of users. The UK Information Commissioner’s Office (ICO) alleged that the failure to check ages resulted in Reddit illegally using children’s personal information.

“Our investigation found that Reddit failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13… These failures meant Reddit was using children’s data unlawfully, potentially exposing them to inappropriate and harmful content,”
— ICO press release, 2026‑02‑link

The ICO’s findings are based on Reddit’s actions prior to its July 2025 rollout of a system that verifies UK users’ ages before allowing them to view adult content. However, the ICO remains concerned about the post‑July 2025 system because the company still relies on users to self‑declare their ages when opening an account.

Reddit said it will appeal the fine and criticized the ICO for demanding more collection of private information:

“Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety,” Reddit told Ars.
“The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety. We intend to appeal the ICO’s decision.”

Reddit pointed to its privacy policy, which states:

“We collect minimal information that can be used to identify you by default. If you want to just browse, you don’t need an account. If you want to create an account to participate in a subreddit, we don’t require you to give us your real name. We don’t track your precise location. You can even browse anonymously. You can share as much or as little about yourself as you want when using Reddit.”

Reddit age checks still under scrutiny

Reddit announced on July 14 that it started verifying UK users’ ages before letting them view adult content in order to comply with the country’s Online Safety Act, which is enforced by regulatory agency Ofcom. Reddit has been using age‑verification vendor Persona, which is currently embroiled in a controversy over its handling of private data following a month‑long trial with Discord.

ICO statement (2025‑12‑xx)
In July 2025, Reddit introduced age‑assurance measures that include age verification to access mature content and asking users to declare their age when opening an account. The ICO informed Reddit that relying on self‑declaration presents risks to children as it is easy to bypass. The regulator is keeping Reddit’s processing of children’s personal information under review as part of ongoing work focusing on online platforms that primarily rely on self‑declaration—an area of focus for the ICO, as set out in its December 2025 children’s privacy progress update.

The linked document says that relying on users to declare their ages makes it too easy for children to bypass age checks.

“Self‑declaration used in isolation is not appropriate for services likely to pose high risks to children,” the ICO said.

Reddit and other platforms that use self‑declaration will undergo further regulatory scrutiny.

“To address this, we will be prioritising high‑risk services for further regulatory engagement. Those who continue to rely primarily on self‑declaration will be a key focus in our next phase of work, as we seek to drive the adoption of more robust and proportionate age‑assurance methods.”

Reddit told Ars Technica that “the vast majority of Reddit users in the UK are adults” and that “globally, Reddit prohibits and removes users under the age of 13.” Reddit provides a form for reporting possible under‑age users.

In the UK, users who try to access restricted content are asked to verify their birthdates through Persona. Reddit did not answer our questions about whether it will continue its use of Persona’s age‑verification system or expand it to other countries, but pointed to its July 2025 statement that warned it may have to verify ages in additional jurisdictions if new laws are enacted.

Reddit said at the time that Persona “performs the verification on either an uploaded selfie or a photo of your government ID. Reddit will not have access to the uploaded photo, and Reddit will only store your verification status along with the birthdate you provided so you won’t have to re‑enter it each time you try to access restricted content.” (Emphasis theirs)

Disclosure: Advance Publications, which owns Ars Technica parent Condé Nast, is the largest shareholder in Reddit.

Author

Jon Brodkin – Senior IT Reporter for Ars Technica. He covers the telecom industry, FCC rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry.

45 Comments