UK data watchdog fines Reddit £14.47M for letting kids slip past the gate

The UK's data protection regulator has fined social media giant Reddit £14.47 million ($19.5 million) over its use of children's data. The Information Commissioner's Office (ICO) says Reddit's terms of service prohibited children under the age of 13 from using the platform, yet it claims the company did not introduce an age …

[Anonymous Coward]

Age gating is fundamentally incompatible with privacy

The UK is going to have to make a choice: are parents responsible for their own children, or does everyone else have to be identified in everything they do?

It won't stop with porn, it won't stop with "social media." Australia is now age gating search engines. Either people take a stand against this, or we're a few years away from a total identity ecosystem.

The choices will be either "papers, please" or taking a mugshot for every online service you want to use.

Don't forget where those papers and mugshots go. Don't trust Persona. Peter Thiel is one of the largest funders of American fascism.

How much longer can I comment on El Reg before bureaucrats demand my paperwork? Wouldn't want a kid to read salty language, would we? Please, think of the children!

[Rogerborg 2.0]

Re: Age gating is fundamentally incompatible with privacy

Mmm. I just lost a 2nd Facebook account to a "Show nude face" demand. A picture of Zuckerborg didn't fool it (OK, noob mistake). Account nuked, no appeal, no way to access or delete "my" data. Just unpersoned on the spot.

That's after losing a first account to "Prove you're over 13 by providing government ID". I'd had that account over 13 years. Again, no interaction was possible other than uploading a passport or driving licence.

"Papers, please" isn't coming, it's already here. If you haven't experienced it yet: don't worry, you will, and soon.

I

[chivo243]

Re: Age gating is fundamentally incompatible with privacy

Don't got no Facebook, don't want no facebook. Papers? We don't need no stinking papers!

[tip pc]

Re: Age gating is fundamentally incompatible with privacy

Once they’ve done with the popular socials they’ll come for your favourite hangouts.

Won’t be long till it’s here on el reg.

[Anonymous Coward]

Re: Age gating is fundamentally incompatible with privacy

“I just lost a 2nd Facebook account”

So, a good news story then.

[MorningLightMountain]

Re: Age gating is fundamentally incompatible with privacy

My immediate reaction to anyone using the "THINK OF THE CHILDREN!" argument is to assume that's not actually what they care about, that they somehow have some other goal in mind. Most of the time, it seems to be in pursuit of grinding away at the privacy of the common man. But never in pursuit of fixing an underlying issue.

Putting more resources into education, prevention or even mitigation of some societal issue? No no, how about we legislatively mandate less security somehow!

[Anonymous Coward]

Re: Age gating is fundamentally incompatible with privacy

Border controls & passports didn’t stop Epstein & his foes.

We all know age gating is more to stop us proles communicating openly & nothing to go about protecting children.

All nations doing the same thing to a common timeline shows it’s coordinated behind the scenes.

[VoiceOfTruth]

So which version is correct?

>> Children under 13 had their personal information collected and used in ways they could not understand

>> Reddit doesn't require users to share information about their identities, regardless of age,

Instead of 'think of the children', how about 'where are the parents?'.

[Craig 2]

Re: So which version is correct?

Parents should be legally responsible for their children's behaviour until adulthood. They can opt out of that responsibility if they want, but then should incur billing (or more likely, withheld benefits) for the state to take over said duties.

[Ordinary Donkey]

Re: So which version is correct?

Please don't let the state be an option. They'll put Mandelson in charge of that department.

[Danie]

The perpetrator is not held liable?

The logical progression of this is, if I speed in my car against the law, the traffic police will be prosecuted but not me? If I were to hack into say Microsoft, then Microsoft gets fined? It is crazy to hold the platform liable if they have stated there is a minimum age to use the service. There is actually a problem with who is being criminalised by this law.

It also creates a massive hole for peer-to-peer network services if we cannot hold the user liable at all. There is no central registration on P2P services at all, so no-one at all can be held liable, so that will be free access for kids.

[Furious Reg reader John]

Re: The perpetrator is not held liable?

Not quite - in the UK it is illegal to sell alcohol to under 18s, and the store is responsible in the law if they do sell alcohol to an under 18. Saying "I thought the 11 year old was 18 years old" isn't a defence. You have to verify that they are over 18, either by them clearly looking aged, or using ID if there is any question.

The 11 year old is still doing something illegal, but the store is also doing something illegal.

Traffic cops chasing a perp (as long as they are not irresponsibly risking public safety) are not breaking the law.

Microsoft being hacked - Microsoft may not have taken suitable measures to protect the data they hold, so would be guilty of not conforming to data protection laws, but the hacker is still commiting an offence, regardless of what Microsoft may or may not have done to stop them.

[Anonymous Coward]

Re: The perpetrator is not held liable?

Kids can’t sign contracts & don't tend to pay for internet access.

This is more like an 11 year old getting caught drinking after stealing their parents alcohol & the cops going after the shop the alcohol was purchased from instead of having a stern word with the family.

Kids use a bill payers internet & go to sites they shouldn’t. The bill payer should have done responsibility in this, they will pressure their isp’s and they will provide some tech to help stop kids going to sites they shouldn’t.

When consumers don’t fix this, government will use the circumstances to be draconian.

[Blazde]

Re: The perpetrator is not held liable?

If I were to hack into say Microsoft, then Microsoft gets fined

There's a pretty good case for this yes, it's not helping your point :)

Regarding P2P software I suppose we can only assume the directional of travel will be toward outlawing publishing of software that has capabilities to do such things. But it's a ratchet, there are some other teeth to take control of before then. Where a good stand can be made I really don't know, but the original internet freedoms are under attack.

[Blazde]

'effective age assurance measures'

This seems extremely harsh. Nobody was doing, what is now called, 'effective age assurance measures' before July 2025, when the relevant bits of Ofcom's interpretation of the Online Safety Act making clear what was required, came into force. This looks like retrospective application of standards Reddit couldn't possibly have foreseen would be so stringent at the time.

Immediately after July 2025 the site became almost unusable for anyone not willing to pony up privacy invading personal information no matter what their age, with some semblance of sanity only reappearing relatively recently, so they certainly have tried to comply and at great cost to legitimate adult users.

Whatever you position on this whole direction of change, 30 years of internet status quo being up-ended in plus or minus a handful of months surely demands more delicate enforcement than 15mil pound fines?

[Irongut]

Re: 'effective age assurance measures'

> the site became almost unusable

I have seen no difference in Reddit before or after July 2025. I have never been asked to verify my age and I am subscribed to several subs that have NSFW pictures posted, including one I added this week.

I'll agree Reddit is often unusable but that is down to their own technical issues and nothing to with age verification.

[Blazde]

Re: 'effective age assurance measures'

Experiences might depend on the age/activity/profiling of your account/linking to single-sign-ins and so on. My then 10 year old account with relatively low activity and all data collection opt-outs was blocked from accessing the entirety of all kinds of mundane threads and profiles, seemingly just on the basis of a single slightly out-of-bounds avatar or the profile having once posted a picture of a celebrity attending the BAFTAs or whatever. Literally 2/3rds of threads turned up in routine Google searches about programming or movies or politics entirely blurred.

Obviously, at the time it looked like a massive over-reaction. Now they've been hit with this fine you have to question whether they actually under-reacted by not just shuttering the entire site to UK audiences.

[Anonymous Coward]

Re: 'effective age assurance measures'

I'm going to hazard a guess you have a vpn running.

[Anonymous Coward]

Re: 'effective age assurance measures'

My experience as a very occasional Reddit user who is not prepared to go through age verification (too old for that sh*t!!) is that large swathes of Reddit are now blocked - not just NSFW but silly stuff like DIY threads (because a knife or saw is used perhaps?), medical advice (ok I know, shouldn't be using the internet for this), review of pubs or home brewing (alcohol), or even cooking that uses a splash of (gasp) red wine reduced down in a sauce. Not saying this is consistently the case but vast amounts of very innoculous stuff is being caught, and if I get prompted for an age gate I just navigate away (and go on to the 'dark web' for my ragu recipe, heh!).

[Anonymous Coward]

I have a couple of sites hosted in my UK homeland which are not salacious but could require OSA age verification so I simply block access to UK citizens as the easiest, cheapest and privacy protecting option.

I do not consider myself to be denying access to my fellow UK citizens - It is our government doing that.

My position is not going to change until the legislation does or the government takes on responsibility for age verification.

If our government wants UK citizens to enjoy the same benefits as foreign citizens have it's up to them to fix things. If they don't like what I am doing I will simply move those servers overseas.

[paluster]

I agree. If the UK Govsrnmebt wants comprehensive age gating then they should run it. They do after all own the databases that record all the government IDs that you can use.

Unfortunately the OSA was written by the previous lot who were very keen on passing stuff to the private sector so that their old school mates could make even more money.

[Anonymous Coward]

Huh.......Peter Thiel!!!!

Quote: "...kids slip past the gate..."

...and then there's Discord using "age verification" provided by..................

................Peter Thiel!!! (Age verification product is called "Persona").

Yup..... age verification so Peter Thiel can "verify" users against HUNDREDS of third party databases!

Link: https://fortune.com/2026/02/24/discord-peter-thiel-backed-persona-identity-verification-breach/

Who else is using Persona?

For reference Peter Thiel is also embedded in the NHS and is providing "services" to UK Police forces!!

Quote (William Burroughs): "The paranoid is a person who knows a little of what is going on."

[Tron]

Exit the UK.

Or be prepared to hand over large amounts of cash to the government. All governments will do this until we end up with a minimal net. A few heavily regulated services. It took them a while, but cross border data traffic is incompatible with nation state governance. Nation states will kill most internet activity to take back control of their digital borders, collecting a few sacks of cash on the way.

Fun's over. Nothing good ahead. Orwell nailed it.

[Fonant]

Will they pay up?

It's all very well UK government departments issuing big fines to foreign companies, but will these companies pay the fines?

4chan told Ofcom to go away. Perhaps Reddit could too?

I can see a future where people who don't want their identities databased by Peter Thiel and Palantir will just use online services located in China, Russia, etc. Or just fire up a VPN or TOR.

[Anonymous Coward]

Re: Will they pay up?

They don’t even get British companies to pay properly. I think you mean statutory regulators, not Govt Depts.

See ICO and British Airways or Dixons Store Group (aka Curry’s).

[SimonHayterUK]

I hate my stupid government

It's bloody ridiculous that our UK government is playing internet nanny. It has always been the responsibility of the parents to restrict what movies they watch, and the internet is no different. There are plenty of apps on multiple store fronts to block websites, block keywords and even AI is able to tell what is suitable for children. Holding websites and user generated sites is not only stupid, it will never work. They should have just mandated UK phone devices come preinstalled with parenting tools, if the parent doesn't enable it, that's on them.