UrsaClimb Logo

UK fines Reddit $19 million for using children’s data unlawfully

Bleeping Computer
by Sergiu Gatlan
February 24, 2026
AI-Generated Deep Dive Summary
The UK Information Commissioner's Office (ICO) has fined Reddit £14.47 million (over $19.5 million) for failing to protect the personal data of children under 13. The fine was imposed due to Reddit's lack of adequate safeguards and its delayed implementation of a meaningful age-verification system, despite prohibiting users under 13 in its terms of service. The ICO highlighted that Reddit collected and processed data from underage users without proper legal justification, potentially exposing them to harmful content. Although Reddit introduced age assurance measures in July 2025, including an age verification system for mature content and self-declaration prompts for new accounts, the regulator criticized these efforts as insufficient and easily bypassable. The ICO emphasized that companies must prioritize robust age-verification systems to meet UK data protection standards, especially when dealing with children's information. John Edwards, the UK Information Commissioner, stressed that relying solely on user declarations for age verification is inadequate and puts minors at risk. He urged the industry to review their practices and improve platform safety measures. Reddit has pushed back against the decision, stating in a press release that "the vast majority" of its UK users are adults and arguing that requiring additional personal information conflicts with its commitment to privacy. This fine follows a growing trend of regulatory actions targeting platforms that mishandle children's data. Earlier this year, MediaLab, the owner of Imgur, faced a similar penalty for failing to protect minors' privacy. The case underscores the importance of proactive measures to safeguard young users and align with strict data protection laws. For security professionals and tech enthusiasts, this highlights the critical need for companies to implement reliable age-verification systems and prioritize children's online safety in their data practices. The incident also raises questions about the adequacy of self-declaration methods and the potential risks associated with platforms that rely on user honesty without additional verification. As digital platforms continue to evolve, ensuring compliance with data protection regulations and prioritizing minors'
Verticals
securitytech
Originally published on Bleeping Computer on 2/24/2026