UK agency alleges “Reddit failed to apply any robust age assurance mechanism.”
Credit: Getty Images | picture alliance
A UK regulator today fined Reddit £14.5 million ($19.6 million) for not verifying the ages of users. The UK Information Commissioner’s Office (ICO) alleged that the failure to check ages resulted in Reddit illegally using children’s personal information.
“Our investigation found that Reddit failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13… These failures meant Reddit was using children’s data unlawfully, potentially exposing them to inappropriate and harmful content,” an ICO press release said.
The ICO findings are based on Reddit’s actions prior to its July 2025 rollout of a system that verifies UK users’ ages before letting them view adult content. But the ICO said it is still concerned about Reddit’s post-July 2025 system because the company relies on users to declare their ages when opening an account.
Reddit today said it will appeal the fine and criticized the ICO for demanding more collection of private information. “Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety,” Reddit said in a statement provided to Ars. “The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety. We intend to appeal the ICO’s decision.”
Reddit pointed to its privacy policy, which says, “We collect minimal information that can be used to identify you by default. If you want to just browse, you don’t need an account. If you want to create an account to participate in a subreddit, we don’t require you to give us your real name. We don’t track your precise location. You can even browse anonymously. You can share as much or as little about yourself as you want when using Reddit.”
The ICO issued provisional findings against Reddit on July 8, 2025, and gave Reddit time to weigh in on the findings before issuing the £14.5 million penalty today. The fine also covers Reddit’s alleged failure “to carry out a data protection impact assessment (DPIA) to assess and mitigate risks to children before January 2025.” The ICO previously fined Imgur owner MediaLab £247,590 ($334,292) for a similar alleged violation.
Reddit age checks still under scrutiny
Reddit announced on July 14 that it started verifying UK users’ ages before letting them view adult content in order to comply with the country’s Online Safety Act, which is enforced by regulatory agency Ofcom. Reddit has been using age-verification vendor Persona, which is in the middle of a controversy over its handling of private data following a monthlong trial with Discord.
The ICO said today that Reddit should take further action to verify users’ ages:
In July 2025, Reddit introduced age assurance measures that include age verification to access mature content and asking users to declare their age when opening an account. The ICO informed Reddit that relying on self-declaration presents risks to children as it is easy to bypass. The regulator is keeping Reddit’s processing of children’s personal information under review as part of on-going work focusing on online platforms that primarily rely on self-declaration—an area of focus for the ICO, as set out in its December 2025 children’s privacy progress update.
The linked document said relying on users to declare their ages makes it too easy for children to bypass age checks. “Self-declaration used in isolation is not appropriate for services likely to pose high risks to children,” the ICO said.
Reddit and other platforms that use self-declaration will undergo further regulatory scrutiny. “To address this, we will be prioritizing high-risk services for further regulatory engagement,” the ICO said. “Those who continue to rely primarily on self-declaration will be a key focus in our next phase of work, as we seek to drive the adoption of more robust and proportionate age assurance methods.”
Reddit told Ars today that “the vast majority of Reddit users in the UK are adults” and that “globally, Reddit prohibits and removes users under the age of 13.” Reddit provides a form for reporting possible underage users.
In the UK, Reddit users who try to access restricted content are asked to verify their birthdates through Persona. Reddit did not answer our questions today about whether it will continue its use of Persona’s age-verification system and whether it will expand it to other countries but pointed to its July 2025 statement that told users it may have to verify ages in countries other than the UK if new laws are enacted.
Reddit said at the time that Persona “performs the verification on either an uploaded selfie or a photo of your government ID. Reddit will not have access to the uploaded photo, and Reddit will only store your verification status along with the birthdate you provided so you won’t have to re-enter it each time you try to access restricted content.” (Emphasis theirs)
Disclosure: Advance Publications, which owns Ars Technica parent Condé Nast, is the largest shareholder in Reddit.
Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry.
