GDPR Weekly Dispatch: UK ICO Fines Reddit £14.47 Million over Children's Privacy Violations

🚨 Headline Story: UK ICO Fines Reddit £14.47 Million over Children's Privacy Violations

The UK Information Commissioner's Office (ICO) has issued a significant £14.47 million fine against the social media platform Reddit for failing to adequately protect children's privacy. An investigation by the regulator revealed that Reddit relied almost entirely on user self-declaration for age verification, thereby lacking the robust age assurance mechanisms necessary to keep minors safe. Consequently, the platform unlawfully processed the personal information of users under the age of 13. Furthermore, Reddit was cited for failing to conduct adequate Data Protection Impact Assessments (DPIAs) to address and mitigate the specific risks posed to children accessing its platform.

Why it matters:
This enforcement action firmly underscores that regulators across Europe will not tolerate superficial compliance when children's privacy is at stake. The ICO explicitly reiterated that relying solely on self-declaration of age is a fundamentally insufficient mechanism. For privacy professionals and tech executives, this signals an urgent need to re-evaluate user onboarding flows and genuinely invest in age-gating technologies where relevant. The fine also emphasizes the critical importance of robust DPIAs—failing to document and mitigate foreseeable risks before launching or maintaining interactive features is a direct route to substantial regulatory penalties. Businesses operating digital platforms must operate with the assumption that regulators expect proactive, demonstrative compliance rather than reactive, nominal defenses.