What happened

Regulatory action landed on Reddit after an ICO probe concluded the platform processed the personal data of under‑18s without adequate controls; the UK data regulator imposed a penalty of just over £14m and flagged missing safeguards.

The ICO's findings centred on the absence of an effective age assurance system and the failure to complete a required data protection impact assessment (DPIA) prior to January 2025 — omissions the watchdog said left children exposed to inappropriate content and avoidable data uses.

Reddit said it prioritises user privacy and will appeal the decision, arguing that a requirement to collect identity information for every UK user would conflict with its design principles and the protection of anonymous engagement.

This enforcement sits alongside a wave of UK regulatory actions targeting age‑checks across different online sectors. Ofcom has used the Online Safety Act to fine adult‑content operators — for example, a recent £1.35m sanction against 8579 LLC for failing to implement age checks — while major adult sites’ operators such as Aylo (owner of Pornhub) have begun blocking unverified UK users ahead of compliance deadlines.

Those other actions illustrate two complementary but distinct enforcement tracks: the ICO is framing failures as data‑protection breaches (DPIA and lawful processing duties), whereas Ofcom’s Online Safety Act regime focuses on protecting minors from access to harmful content and can include escalating daily fines and site‑access remedies.

Industry responses vary accordingly. Adult‑content operators argue mandatory, centralised verification can push traffic to unregulated services, while platforms that prize anonymity (like Reddit) warn that identity‑first obligations undermine core product assumptions and create privacy risks.

For platform operators the ruling crystallises immediate choices: deploy more robust age‑assurance measures, document DPIAs and processing justifications, or risk enforcement across multiple UK regulators — each with different powers and potential remedies.

Technology vendors that provide identity verification, cryptographic attestations or device‑based checks are likely to see near‑term demand, but integrating these solutions carries technical costs and user‑experience trade‑offs that can reduce engagement.

Policymakers now face a practical dilemma: stricter controls can reduce underage exposure on mainstream platforms but may also drive users to less regulated corners of the internet or incentivise workarounds such as VPNs and fake credentials.

The case establishes a stronger enforcement precedent linking data‑processing practices to child protection outcomes under UK law and signals that firms operating across content types should expect coordinated scrutiny from both data and safety regulators.

For users and families, the outcome reframes trust markers: platforms will need to explain how age is determined, what data is collected, how DPIAs shaped decisions, and what safeguards protect minors — or face fines and restrictions in the UK market.