UK GDPR / Data Protection Act 2018 (Age Appropriate Design Code, the Children's Code)

On February 24, 2026, the UK Information Commissioner's Office fined Reddit 14.47 million pounds after finding it had unlawfully processed children's personal data. The ICO concluded Reddit applied no robust age assurance before July 2025 and held that self-declaration of age is insufficient when children may be exposed to risk, leaving Reddit without a lawful basis to process the data of under-13 users. The regulator also found Reddit had not carried out a child-focused Data Protection Impact Assessment before January 2025. Commissioner John Edwards said relying on users to declare their own age is not enough when children may be at risk. The action is distinct from the Ofcom-administered Online Safety Act regime and from the separate Dutch DPA inquiry.