{"id":4638,"date":"2026-02-26T05:37:29","date_gmt":"2026-02-26T05:37:29","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2026\/02\/26\/icos-14m-reddit-fine-highlights-age-check-privacy-concerns\/"},"modified":"2026-02-26T05:37:29","modified_gmt":"2026-02-26T05:37:29","slug":"icos-14m-reddit-fine-highlights-age-check-privacy-concerns","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2026\/02\/26\/icos-14m-reddit-fine-highlights-age-check-privacy-concerns\/","title":{"rendered":"ICO\u2019s \u00a314m Reddit Fine Highlights Age Check Privacy Concerns"},"content":{"rendered":"
\n

The UK\u2019s Information Commissioner\u2019s Office (ICO) has issued a multimillion-pound fine to Reddit for GDPR non-compliance, but experts have warned that its rules pose a risk to user security and privacy.<\/p>\n

The UK\u2019s data protection regulator said on February 24 that its \u00a314.47m ($19.6m) fine was levied for two main reasons.<\/p>\n

First, Reddit failed to put \u201crobust\u201d age verification measures in place, which meant it did not have a lawful basis for processing the personal information of children under the age of 13.<\/p>\n

Second, it failed to carry out a data protection impact assessment (DPIA) to assess and then mitigate risks to children on the platform before January 2025.<\/p>\n

The fine took into account the large number of children using the site, the degree of potential harm caused, the duration of the failings\u00a0and Reddit\u2019s global turnover, the ICO said,<\/p>\n

Read more on ICO fines: UK ICO Fires GDPR \u201cWarning Shot\u201d Over Use of Children\u2019s Data.<\/em><\/p>\n

\u201cChildren under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today\u2019s fine,\u201d said information commissioner, John Edwards.\u00a0<\/p>\n

\u201cLet me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they\u2019re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place.\u201d<\/p>\n

Reddit introduced age verification to access \u201cmature content\u201d in July 2025\u00a0and now asks users to state their age when opening an account, although the ICO noted that the latter is too easy to bypass.<\/p>\n

Sympathy for Reddit<\/strong><\/h2>\n

Reddit has defended its decision, saying in a statement that it \u201cdidn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety.”<\/p>\n

Some experts agreed that the ICO\u2019s intrusive age verification checks, as per those for users of adult content sites, put user security and privacy at risk.<\/p>\n

Paul Bischoff, consumer privacy advocate at Comparitech, said he hoped Reddit would stand firm.<\/p>\n

\u201cThe problem with mandatory identity verification is that it places an undue burden of proof on the vast majority of people not suspected of any wrongdoing,\u201d he added.<\/p>\n

\u201cIt has a chilling effect on our freedoms and there’s little evidence that it achieves its stated purpose. Parents need to take responsibility and stop shifting their burden onto private companies, the government, and the general public.\u201d<\/p>\n

Pieter Arntz, senior researcher at Malwarebytes, agreed that such checks potentially expose user data.<\/p>\n

\u201cWhether it\u2019s facial age estimation relying on biometrics, open banking checks querying financial data, digital ID wallets adding new layers of infrastructure, or photo-ID matching concentrating high-value identity data, each approach introduces fresh privacy and security concerns,\u201d he added.<\/p>\n

\u201cEven simpler methods, like credit card checks, email-based inference, or mobile network verification, raise issues around exclusion, profiling, or reliability.\u201d<\/p>\n

If the ICO supported \u201cdouble-blind\u201d verification, it could potentially allay these concerns, Arntz added.<\/p>\n

\u201cIn this model, a trusted third party confirms a user\u2019s age and issues a simple \u201818+\u2019 (or similar) token to the relying site, without revealing the user\u2019s identity or which service they are accessing,\u201d he continued.<\/p>\n

\u201cThis reduces data exposure, limits cross-service tracking, and avoids creating new honeypots of sensitive personal information, offering stronger privacy protections than most current approaches while still meeting regulatory objectives.”<\/p>\n

A Warning to Others<\/strong><\/h2>\n

However, others\u00a0were less sympathetic to Reddit\u2019s cause.<\/p>\n

Chris Linnell, associate director of data privacy at\u00a0Bridewell, argued that when processing children\u2019s data, a DPIA is simply not optional.<\/p>\n

\u201cIt is a statutory requirement designed to force organizations to properly assess, document and mitigate risk before harm occurs. The absence of a robust DPIA suggests that the risks to children were not adequately identified or addressed at the outset,\u201d he said.<\/p>\n

\u201cEqually, relying on terms and conditions to state that under-13s should not use the service is not, in itself, a protective measure. If no effective technical or operational controls are in place to enforce that rule, the organization cannot credibly argue that it has taken reasonable steps to prevent access. Compliance cannot sit solely in contractual wording; it must be reflected in practical safeguards.\u201d<\/p>\n

The Reddit fine comes just weeks after Imgur parent company MediaLab was fined over \u00a3247,000 for failing to use children\u2019s information lawfully.<\/p>\n

Linnell urged online service providers to avoid similar regulatory action by focusing on the basics, namely:<\/p>\n