The era of "I agree that I am over 13" is officially dead. If you needed proof that regulators are finished with half-hearted attempts at safety, the Information Commissioner's Office (ICO) just delivered a £14.47 million reality check to Reddit.
The core issue isn't that Reddit allowed kids on the site; it's that they didn't have a legally defensible way to stop them or handle their data. For years, the platform operated on a "don't ask, don't tell" policy regarding age, which, according to the ICO, essentially rendered their data processing for underage users unlawful.
The failure of the honor system
For a long time, the tech industry relied on simple checkboxes to satisfy legal requirements. You click a button, you certify you're old enough, and the company is legally covered. That time has expired. The ICO made it clear: self-declaration is not a robust age assurance mechanism. It's too easy to bypass, it’s not accurate, and it doesn’t provide a lawful basis for handling the data of children under 13.
Reddit didn't implement any real age verification measures until July 2025. Even then, those measures were largely focused on access to "mature" content. The regulator viewed this as too little, too late. Because Reddit didn't have effective technical guardrails in place, they were processing personal data for a large number of children without valid consent.
Why the Data Protection Impact Assessment mattered
The fine wasn't just about kids slipping through the cracks. It was about corporate due diligence. The ICO pointed out that Reddit failed to carry out a Data Protection Impact Assessment (DPIA) before January 2025.
Think of a DPIA as a risk management audit. It's not just paperwork; it’s a required process to identify how your platform could harm children and how you plan to stop it. By skipping this, Reddit effectively admitted they hadn’t properly assessed the dangers their platform posed to younger users. Without that assessment, they couldn't possibly have the proper safeguards in place.
The privacy paradox
Reddit’s defense is simple and, for many users, relatable. They argue that they don't want to collect government IDs or biometric data because it hurts user privacy. They’re right—forcing everyone to upload a passport to browse a forum is a massive privacy risk. If those databases are breached, you aren't just losing a password; you're losing your identity.
However, the legal reality is that if you operate a service that children frequent, you have a duty to verify them. This puts platforms in a bind. You either collect sensitive data to verify age, or you face millions in fines for not knowing who is on your site. There is no easy middle ground.
Industry experts are currently pushing for "privacy-preserving" age assurance. This involves third-party services that confirm you’re over 18 without telling the website who you are. The site gets a green light, not your name or address. While this sounds ideal in theory, the implementation is often clunky, and users are understandably suspicious of any third-party company standing between them and their content.
What this means for you
If you’re a user, you’re going to be asked for your age more often. Sites are under immense pressure to avoid the kind of enforcement action Reddit just faced. Expect to see:
- More frequent age gates before content.
- Increased use of third-party "age assurance" tools.
- Tougher account creation flows.
If you’re a business owner or a developer, the lesson is straightforward. If your site is popular with younger crowds, stop relying on checkbox disclosures. Conduct a thorough DPIA, document your risks, and start researching age-assurance providers that prioritize data minimization.
The ICO isn't just targeting Reddit. They’ve recently moved against other platforms like Imgur for similar failures. They are looking for companies that treat children like just another user segment rather than a protected group. If you aren't taking this seriously, you are next on the list.
The days of "good enough" compliance are over. Regulatory patience has hit zero, and the cost of staying passive is rising by the millions.
