The Information Commissioner’s Office has warned it is gunning for companies which fail to protect children online after battering Reddit, the social media platform and content aggregator dubbed the “front page of the Internet”, with a £14.47m fine for breaching the so-called Children’s Code.
The penalty, the largest ever handed out by the regulator over children’s privacy issues, comes amid an investigation launched last year into three sites over how they handle children’s personal information and age assurance measures.
Imgur-owned MediaLab was fined £250,000 last week; the TikTok investigation is continuing.
In a statement, the ICO said Reddit’s failings included not checking the age of users accessing its platform, putting youngsters at risk.
It said Reddit failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13.
The site also failed to carry out a data protection impact assessment (DPIA) to assess and mitigate risks to children before January 2025.
Information Commissioner John Edwards said that relying on users to declare their age themselves is not enough when children may be at risk, adding that the ICO is now focusing on companies that are primarily using this method.
He added: “I strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms. It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children.
“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.
“Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place.
“Reddit failed to meet these expectations. They must do better and we are continuing to consider the age assurance controls now implemented by the platform.
Reddit has already confirmed it intends to appeal the ICO’s decision.
“Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety,” said a Reddit spokesperson.
“The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety.”
The previous record fine for breaching children’s data rights – £12.7m – was issued against TikTok in April 2023. However, this was originally proposed at £27m but was reduced after the ICO decided not to pursue a finding related to “special category” data, such as ethnicity or religious beliefs).
Even so, TikTok is also appealing against this, but failed in its initial attempt to get the penalty thrown out even before the appeal got under way properly, with the First-tier Tribunal confirming the ICO did have the authority to issue the fine.
Related stories
Round 1 to ICO as TikTok opens £12.7m penalty appeal
TikTok whacked once again as privacy fines near €1bn
Three-pronged probe into abuse of children’s privacy
TikTok beefs up parental controls and ties with adland
Social media giants warned over children’s privacy
Hands off our kids’ data, ICO warns social media giants
