UK ICO Fines Reddit £14.47 Million for Children's Privacy Failures, February 2026

The UK Information Commissioner's Office issued a monetary penalty notice against Reddit, Inc. on 24 February 2026, imposing a fine of £14,470,000 under the UK General Data Protection Regulation and the Data Protection Act 2018. The ICO found that Reddit had processed personal data of children under the age of 13 without a lawful basis and had failed to conduct a Data Protection Impact Assessment before January 2025, when Reddit began operating an age assurance mechanism on its platform.

The enforcement action rests on Article 5(1)(a) of UK GDPR, which requires personal data to be processed lawfully, fairly, and transparently, and on Article 6, which sets out the exhaustive list of lawful bases for processing. The ICO determined that Reddit lacked a valid lawful basis under Article 6 for the personal data it collected from users who were or appeared to be under 13. The penalty notice also invokes Article 35 of UK GDPR, which requires a DPIA before processing that is likely to result in high risk to individuals, including children. Reddit did not complete a DPIA covering its UK operations until January 2025.

The ICO's enforcement applies the Children's Code (Age Appropriate Design Code), issued under section 123 of the Data Protection Act 2018, which sets 15 standards that online services likely to be accessed by children must meet. Reddit's failure to deploy age assurance before July 2025 meant that children could access the platform and have their data processed without the protections the Children's Code requires. Operators of online platforms, social media services, and user-generated-content sites accessible to UK users must maintain a DPIA, implement age assurance proportionate to the risk, and identify a lawful basis before collecting data from users who may be under 13.

Reddit introduced age assurance in July 2025 and has been cooperating with the ICO's review. The ICO confirmed it continues to review Reddit's compliance practices. The fine will be paid into the UK Consolidated Fund in accordance with section 157 of the Data Protection Act 2018. Reddit retains the right to appeal the penalty notice to the First-tier Tribunal (Information Rights).

Source: Information Commissioner's Office, "Reddit issued with £14.47m fine for children's privacy failures," ICO Media Centre, 24 February 2026, available at: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/reddit-issued-with-1447m-fine-for-children-s-privacy-failures/; UK General Data Protection Regulation, Articles 5(1)(a), 6, and 35; Data Protection Act 2018, sections 123 and 157. Verified 10 March 2026.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.