Reddit hit with £14m ICO penalty over age‑verification failings
What happened
Regulatory action landed on Reddit after an ICO probe concluded the platform processed the personal data of under‑18s without adequate controls; the UK data regulator imposed a penalty of just over £14m and flagged missing safeguards.The ICO's findings centred on the absence of an effective age assurance system and the failure to complete a required data protection impact assessment (DPIA) prior to January 2025 — omissions the watchdog said left children exposed to inappropriate content and avoidable data uses.
Reddit said it prioritises user privacy and will appeal the decision, arguing that a requirement to collect identity information for every UK user would conflict with its design principles and the protection of anonymous engagement.
This enforcement sits alongside a wave of UK regulatory actions targeting age‑checks across different online sectors. Ofcom has used the Online Safety Act to fine adult‑content operators — for example, a recent £1.35m sanction against 8579 LLC for failing to implement age checks — while major adult sites’ operators such as Aylo (owner of Pornhub) have begun blocking unverified UK users ahead of compliance deadlines.
Those other actions illustrate two complementary but distinct enforcement tracks: the ICO is framing failures as data‑protection breaches (DPIA and lawful processing duties), whereas Ofcom’s Online Safety Act regime focuses on protecting minors from access to harmful content and can include escalating daily fines and site‑access remedies.
Industry responses vary accordingly. Adult‑content operators argue mandatory, centralised verification can push traffic to unregulated services, while platforms that prize anonymity (like Reddit) warn that identity‑first obligations undermine core product assumptions and create privacy risks.
For platform operators the ruling crystallises immediate choices: deploy more robust age‑assurance measures, document DPIAs and processing justifications, or risk enforcement across multiple UK regulators — each with different powers and potential remedies.
Technology vendors that provide identity verification, cryptographic attestations or device‑based checks are likely to see near‑term demand, but integrating these solutions carries technical costs and user‑experience trade‑offs that can reduce engagement.
Policymakers now face a practical dilemma: stricter controls can reduce underage exposure on mainstream platforms but may also drive users to less regulated corners of the internet or incentivise workarounds such as VPNs and fake credentials.
The case establishes a stronger enforcement precedent linking data‑processing practices to child protection outcomes under UK law and signals that firms operating across content types should expect coordinated scrutiny from both data and safety regulators.
For users and families, the outcome reframes trust markers: platforms will need to explain how age is determined, what data is collected, how DPIAs shaped decisions, and what safeguards protect minors — or face fines and restrictions in the UK market.
Read Our Expert Analysis
Create an account or login for free to unlock our expert analysis and key takeaways for this development.
By continuing, you agree to receive marketing communications and our weekly newsletter. You can opt-out at any time.
Recommended for you
Ofcom Demands Tighter Age Verification from Major Social Platforms
UK regulators Ofcom and the ICO have pressed major social platforms to deploy robust age‑verification measures to block under‑13 registrations, citing high self‑reported child account prevalence and very large suspected‑underage removal figures; firms now face immediate choices between third‑party/device attestations and deeper product redesigns that reshape onboarding and recommendation exposure. The push amplifies privacy, security and market‑structure tensions — from vendor data retention and a recent identity‑image breach to divergent regulatory tools and platform promises about biometric ephemerality.
X to Rework EU Verification After €120M DSA Penalty
X will overhaul its European verification model after a €120 million sanction from EU regulators under the Digital Services Act, prompting platform governance changes and higher compliance costs. The European Commission will evaluate X’s proposed remedies, a decision likely to reshape verification practices across major social networks.
Ofcom fines 8579 LLC £1.35m for age-verification lapses
Ofcom has fined 8579 LLC £1.35m under the Online Safety Act for failing to deploy effective age checks on its adult websites; a further £50,000 penalty was issued for ignoring regulator requests. Regulators have set immediate deadlines and potential daily penalties, signaling tougher enforcement of age-verification rules for online adult platforms.
Age-Verification Mandates Force Millions into Mandatory ID Checks
State and platform-level rules are pushing broad age checks that pull ordinary adults into verification flows; vendors and platforms differ on whether inputs are ephemeral, while governments (including Brazil and Apple’s platform controls) accelerate requirements — expect vendor consolidation, single-use age credentials, and intensified legal and privacy battles.
Pornhub to block many UK visitors as new age-verification deadline looms
Parent company Aylo will make Pornhub inaccessible to new UK visitors after February 2 unless they complete the required age checks; previously verified accounts remain functional. Aylo warns that restrictive verification rules may push users toward unregulated sites and raises privacy and enforcement concerns.
Apple Tightens App Store Access with Age Verification Measures
Apple has activated platform-level age checks and published a Declared Age Range API to help developers comply with new local laws; simultaneously, Brazil is preparing a federal decree that would extend mandatory certified age attestations across storefronts, content platforms and the ad ecosystem, forcing a design choice between identity-based checks and privacy-preserving attestations. The combined shift accelerates platform-centered enforcement, raises privacy and compliance-cost risks, and is likely to spur a market for cryptographic age‑attestation services.
Brazil to Require Age Verification to Block Teen Access to Gambling and Adult Content
Brazil is drafting rules that would force app stores, platforms and sites that run ads to verify users’ ages and block minors from gambling, pornography and other adult services. The proposal echoes moves in Europe and the UK and raises enforcement, privacy and compliance trade‑offs for global and local tech firms.
Australia Rebukes Major Tech Firms Over Failures to Curb Child Sexual Abuse Material
Australia’s government publicly condemned large technology platforms for failing to stop the spread of child sexual abuse content, pressing for faster detection, clearer reporting and stronger enforcement. Officials signalled tougher oversight and potential regulatory steps that would force platforms to change moderation practices and cooperation with law enforcement.