Reddit fined £14.47m as UK and Australian regulators reject self declared ages for children

On 24 February 2026 the United Kingdom's Information Commissioner's Office fined Reddit, Inc. £14.47 million for unlawfully processing the personal information of children. Five weeks later, on 31 March 2026, Australia's eSafety Commissioner published the first compliance report on this country's social media minimum age obligations. The two instruments come from different regulators working under different statutes on opposite sides of the world, and they arrive at the same finding: asking a child to state their own age is not a safeguard.

The ICO's case against Reddit rests on the UK General Data Protection Regulation and the regulator's Age Appropriate Design Code, known as the Children's Code. Reddit's terms of service have long barred anyone under 13. The ICO found that the platform ran no mechanism to check whether that rule held until July 2025, that large numbers of under 13s were using the service anyway, and that the company therefore had no lawful basis for processing their data. The ICO also found Reddit had not carried out a data protection impact assessment on risks to children before January 2025. When age measures did arrive in July 2025, they combined verification for mature content with a request that users declare their age at sign up. The ICO told Reddit that self declaration is easy to bypass and does not meet the standard.

John Edwards, the UK Information Commissioner, said in the ICO's statement that children under 13 had their personal information collected and used in ways they could not understand, consent to or control. The penalty was calculated with reference to the number of children affected, the duration and severity of the infringement, potential harm and Reddit's global revenue. According to law firm Osborne Clarke, writing on 25 February 2026, Reddit intends to appeal. Until that appeal is heard, the finding stands but is not final.

Reddit was not the first. On 5 February 2026 the ICO fined MediaLab.AI, Inc., which owns the image sharing site Imgur, £247,590 over the same defect: no means of verifying age and no route to parental consent, on a service that permitted under 13s with parental supervision. The communications regulator Ofcom has been running a parallel campaign under the Online Safety Act 2023. In February 2026 it penalised 8579 LLC £1.35 million, plus £50,000 for ignoring information requests and a running £1,000 a day, over four pornographic sites, and Kick Online Entertainment S.A. £800,000, plus £30,000 and £200 a day, over motherless.com. Both were section 12 breaches, the safety duties protecting children. On 12 March 2026 Ofcom wrote to major platforms requiring them to enforce their own minimum age policies with highly effective age assurance and to report back by 30 April 2026. The ICO issued an open letter in the same month. DLA Piper, writing on 9 June 2026, described a joint ICO and Ofcom statement as a sign of increasing coordination between the two.

Australia went further and legislated. Under the Online Safety Amendment (Social Media Minimum Age) Act, age restricted platforms have had to take reasonable steps to keep under 16s off since 10 December 2025. eSafety's March report says 4.7 million accounts had been removed by mid January 2026, with a further 310,000 by early March. Survey work cited in the report found 49.7 per cent of parents said their child had an account on at least one platform before the law commenced, falling to 31.3 per cent afterwards.

The report also sets out four concerns. Platforms prompted children to attempt age assurance even where the age they had declared before 10 December 2025 was under 16. Children could repeat the same age assurance method until it returned a 16 plus result. Pathways for reporting age restricted accounts were neither accessible nor effective. Measures to stop new under 16 accounts being created were insufficient. eSafety has confirmed investigations into Facebook, Instagram, Snapchat, TikTok and YouTube. Those investigations are open. No finding of breach has been made against any of them, and none should be inferred.

Not everyone reads the numbers the same way. Lisa M. Given, professor of information sciences at RMIT University, wrote on 31 March 2026 that account removal totals say nothing about how many children remain on the platforms or have moved to alternatives, that gaming and messaging services sit outside the scheme, and that restricting access does not touch algorithmic recommendation or addictive design. She argues a broader digital duty of care is needed.

What is not settled: whether Reddit's appeal succeeds, what a court would accept as reasonable steps, whether eSafety's investigations produce penalties, and whether any of this measurably reduces the harm to children that all three regulators say they are acting against.