On 24 February 2026, the UK's Information Commissioner's Office fined Reddit £14,472,500. No data was breached. No system was hacked. Reddit was fined because it had no meaningful way to know whether the people using its platform were children, and had not seriously tried to find out, for over seven years.
What the ICO actually found
Reddit's terms of service prohibited users under 13. The ICO's finding was simple and damning: that prohibition was entirely unenforceable, because Reddit had no mechanism to check it. The gap between policy and practice was, in the ICO's view, not just inadequate, it was unlawful.
ICO Penalty Notice. Reddit, Inc., 24 February 2026
Fine: £14,472,500
- Articles breached: Art. 5(1)(a), Art. 6, Art. 8, Art. 35 UK GDPR
- Failure 1: No robust age assurance mechanism. Reddit had no lawful basis for processing personal data of children under 13. Its terms-of-service prohibition was meaningless without enforcement.
- Failure 2: No DPIA before January 2025. Reddit failed to carry out a Data Protection Impact Assessment, even for 13–18 year olds who were permitted to use the platform.
- Period covered: May 2018 to July 2025, over seven years of unlawful data processing
- Harm identified: Children's data used in ways they could not understand, consent to, or control. Potential exposure to inappropriate and harmful content.
"Children under 13 had their personal information collected and used in ways they could not understand, consent to or control. Relying on users to declare their age themselves is not enough when children may be at risk."
. John Edwards, UK Information Commissioner
Self-declaration is explicitly not enough
When Reddit eventually introduced age measures in July 2025, it asked users to declare their age at account creation. The ICO found this insufficient, and named the practice directly: "Relying on users to declare their age themselves is not enough when children may be at risk, and we are focusing now on companies that are primarily using this method."
If your platform's age gate is a date-of-birth field or a checkbox, the ICO has specifically flagged that approach as inadequate. This is now an active enforcement priority, not a future risk.
The ICO is currently investigating 17 other platforms, including Discord, Pinterest, and X, with ongoing work at Meta and Snapchat. The Reddit fine is not a one-off. It is the clearest signal yet of where enforcement is heading.
ICO children's privacy enforcement, escalating pattern
--- · --- · --- · ---
Apr 2023 · TikTok · £12.7M · Children's data processed without lawful basis
Feb 2026 · Imgur / MediaLab · £247,590 · No age assurance, no DPIA. Imgur subsequently withdrew from the UK.
Feb 2026 · Reddit · £14.47M · No robust age assurance mechanism, no DPIA before January 2025
Ongoing · 17 platforms · Under review · Discord, Pinterest, X, Meta, Snapchat and others
Three questions every platform must answer now
1. Do we actually know who is using our platform?
Not who our terms of service allow. Who is actually there. Reddit knew children were on its platform, the ICO found "a large number" were. Having a policy is not the same as having enforcement.
2. Have we carried out a child-specific DPIA?
A generic DPIA is not sufficient. It must specifically assess risks to children, exposure to harmful content, data profiling, algorithmic amplification, and document the mitigation steps taken. Reddit's failure here cost it as much as the age assurance failure.
3. Is our age check actually robust, or just a checkbox?
The ICO has explicitly named self-declaration as insufficient. If your current mechanism consists of asking users to state their age, you are operating under exactly the practice the regulator has signalled it will pursue next.
How Tuteliq Solves This
Every failure the ICO cited has a direct answer in Tuteliq.
Tuteliq is a purpose-built child safety API, designed from the ground up for exactly the compliance landscape this ruling describes. Here is how it maps to each ICO requirement.
--- · ---
Robust age assurance, beyond self-declaration · ✓ /v1/age-verify with liveness detection + official document scanning. Two modes: Complete (liveness + document) and Liveness Only. Configurable per jurisdiction, UK, EU, US, Australia each have separate age thresholds.
Lawful basis for processing children's data · ✓ Zero content retention on all child content, nothing is stored post-detection. Audit-trail logging provides the documentation needed for a defensible lawful basis under UK GDPR.
DPIA, assess and mitigate risks to children · ✓ DPIA-ready risk scoring, confidence levels, and detected harm patterns across 13 detection endpoints. White-label reports are available on the Assure plan and above.
Real-time detection of harm exposure · ✓ Real-time detection (typical 1.1 to 1.5s) of grooming, bullying, unsafe content, sextortion, radicalisation, self-harm, and more, across text, voice, image, and video.
Children's Code, safety by default · ✓ Age-calibrated risk scoring applies an automatic multiplier for younger age groups. Recommended actions tier from monitor to immediate_intervention, safety is built in, not bolted on.
KOSA, COPPA, UK OSA, EU DSA alignment · ✓ Tuteliq is purpose-built for multi-jurisdiction compliance. Ship compliance in under 5 minutes with official SDKs for Node.js, Python, Swift, Kotlin, Flutter, Unity, React Native, and .NET.
Age Assurance, beyond self-declaration
The ICO said explicitly that asking users to declare their age "presents risks to children as it is easy to bypass." Tuteliq's age verification uses liveness detection and official document scanning to provide verification that cannot be bypassed with a false date of birth.
Market overrides allow different verification modes per jurisdiction, a UK user might require Complete mode (liveness + document), while a lower-risk market uses Liveness Only.
DPIA Support, document your risk assessment
A DPIA is a mandatory legal requirement where processing is likely to result in high risk, and children are explicitly a higher-risk category under UK GDPR. Tuteliq's incident reports, risk scoring, and audit trails provide the documented evidence base a DPIA requires.
Every detection includes confidence levels, harm patterns, and rationale, giving compliance teams the material they need to demonstrate that risks were assessed and mitigated.
Real-Time Harm Detection, 13 endpoints
Reddit's failure to run a DPIA was partly a failure to think seriously about what children were being exposed to on its platform. Tuteliq's detection suite surfaces those risks in real time, grooming, unsafe content, sextortion, radicalisation, before they become regulatory findings.
All detection is multi-modal: text, voice, image, and video analysed through a single API integration.
Identity Verification, ban evasion prevention
Once a user is removed from a platform, they should not simply be able to rejoin with a new account. Tuteliq's identity verification with liveness detection and ban evasion prevention closes the loop that age assurance alone cannot.
Available on the Assure plan and above, with SOC 2 Type II attestation and ISO 27001 certification in progress, not yet issued.
What an age verification call looks like in practice
Integrating Tuteliq's age verification takes minutes with any of the 8 official SDKs. Here is how a Node.js integration looks for a UK platform:
// npm install @tuteliq/sdk
const { Tuteliq } = require('@tuteliq/sdk');
const client = new Tuteliq({ apiKey: process.env.TUTELIQ_API_KEY });
const result = await client.ageVerify({
mode: 'complete', // liveness + official document
market: 'GB', // applies UK age threshold (13/16/18)
min_age: 13, // reject under-13s at account creation
external_id: userId, // your platform's user reference
});
// result.verified → true / false
// result.age_band → "under_13" | "13_15" | "16_17" | "18_plus"
// result.method → "liveness_and_document"
// result.audit_id → UUID for DPIA audit trail
if (!result.verified || result.age_band === 'under_13') {
// Block account creation, lawful basis cannot be established
return res.status(403).json({ error: 'age_verification_failed' });
}
// Proceed, lawful basis established, audit_id stored for DPIAThe audit_id returned in every response is the foundation of your DPIA documentation trail, a verifiable record that age was assessed for each user, when, and by what method. That is exactly the kind of evidence the ICO expects platforms to be able to produce.
The broader principle the Reddit ruling establishes
Legal analysts at Kennedy's Law described the ICO's direction as "a clear and sustained shift towards firmer, more interventionist enforcement, moving away from guidance and informal action towards meaningful financial penalties where systemic shortcomings are identified."
The standard is no longer whether you intended for children to use your platform. It is whether children could access it, and whether you took proportionate steps to prevent or mitigate that. Reddit's terms of service were never the problem. The absence of any mechanism to enforce them was.
The ICO is working closely with Ofcom to coordinate enforcement of the Online Safety Act alongside data protection law. Two regulators, aligned on children's safety, both watching the same platforms. The overlap between the Children's Code and the Online Safety Act means that compliance with one does not guarantee compliance with the other, and Tuteliq is designed to address both.
---
Sources: ICO press release, 24 February 2026 · The Register · Kennedy's Law · Osborne Clarke. John Edwards quote is drawn directly from the ICO press release.