This article explains aspects of data privacy for UK media companies and organisations following a recent ruling from the UK’s data watchdog.
What is Reddit?
Reddit is an online discussion platform where millions of users share news, content, and participate in discussions across thousands of communities called subreddits. Since being founded in 2005, Reddit has evolved from a niche forum into a major social media platform, and was listed on the New York Stock Exchange in 2024.
In February 2026, the UK Information Commissioner’s Office (ICO) fined Reddit £14.47m after finding that it had failed to use children’s personal information lawfully and that it did not have adequate age‑assurance measures in place. Reddit has indicated that it intends to appeal the ICO’s decision. Due to its size and reach, this case has serious implications for media organisations whose services may be accessed by children.
What does the Reddit fine mean for a business collecting data?
The fine relates to Reddit’s failure to implement robust age‑assurance measures and to ensure a lawful basis for processing the personal data of children under the age of thirteen in line with UK data protection law. The ICO found that children’s information was collected and used in ways they could not reasonably understand or control. For media businesses, this case is critical because it shows how data protection law intersects with their content and audience‑engagement operations.
If a platform or publication attracts younger audiences, robust mechanisms are required to understand who the users are and how their data is handled. Under the UK General Data Protection Regulation (UK GDPR), the processing of children’s personal data merits particular protection, especially where consent is relied on.
Is the Reddit fine related to the Online Safety Act?
No. This ruling is not related to the Online Safety Act 2023 (OSA). It concerns Reddit’s inability to effectively manage and process children’s personal data in compliance with UK data protection law. Specifically, the ICO found that Reddit unlawfully collected and used personal data belonging to children under thirteen, in breach of the UK GDPR and the Data Protection Act 2018.
The OSA is currently being brought into force in stages, which places duties of care on online platforms to protect users from harmful content. While the OSA does have significant implications for how platforms like Reddit handle children’s safety online, the ICO’s fine in this case was specifically about data‑privacy failings rather than content‑moderation obligations.
This distinction matters for media businesses because it means they face compliance obligations under two separate regulatory regimes:
- Data protection law enforced by the ICO, and
- Online safety obligations enforced by Ofcom.
In practice, media organisations hosting user content need to consider both sets of duties in tandem, as decisions about safety measures often involve processing personal data.
What is good governance and why does it matter in the Reddit fine case?
Good governance in data protection means having clear policies, accountability structures and oversight arrangements in place. It is about documenting how data is collected, who is responsible for approving particular activities, and how compliance is monitored. The ICO found that Reddit lacked adequate governance and safeguards around children’s data handling, contributing to the unlawful processing it identified.
Good governance in this area will usually include documented records of processing, appropriate data protection impact assessments (DPIAs), and a clear allocation of responsibility for data‑protection decisions. For media businesses, good governance can offer protection in two ways. Firstly, it helps prevent breaches like those identified in the Reddit case by ensuring someone is responsible for data‑protection decisions. Secondly, if regulators investigate, an evidential record of reasonable steps having been taken to comply with UK data protection law will be available. This matters because the ICO will look at whether the business had appropriate systems and safeguards in place.
Is Reddit entirely to blame?
Reddit plans to appeal the fine. The platform does ask users to declare their age, but this amounts to mere self‑declaration and, according to the ICO, fell short of the level of age‑assurance it expects under UK data protection law. Ultimately, the legal responsibility lies with the platform. Under UK data protection law, children under the age of thirteen cannot themselves give valid consent for online services; consent must come from someone with parental responsibility. No amount of self‑declaration changes that obligation.
Nevertheless, there is ongoing debate in online forums and in public commentary about whether parents bear greater responsibility for monitoring their children’s online activity. While parental oversight is undoubtedly important, it is unrealistic to expect parents to understand the complex technical ways in which platforms collect and process data behind the scenes. That is precisely why data protection law places the burden on platforms, which have both the resources and the legal obligation to implement proper policies and safeguards. Reddit disputes the ICO’s findings and the level of the penalty, and its appeal may result in the decision being varied or overturned.
What should media companies do now?
Media businesses should treat the Reddit decision as a prompt to review their own practices, particularly where children may access their services. Steps to consider include:
- Auditing who has access to user data and on what basis.
- Implementing proportionate age‑assurance measures (not just self‑declared ages) to reduce the likelihood that children under thirteen can access services that are not designed for them.
- Documenting data‑processing activities, including records of processing and, where relevant, DPIAs.
- Designing systems to identify and manage under‑age users, rather than relying on them to understand or consent to lengthy privacy notices.
- Where children cannot be excluded from your platform, ensuring verifiable parental consent has been obtained before collecting any personal data that depends on consent as the lawful basis.
For more information
The Reddit case is a reminder that data protection is not optional and that taking the advice of a data‑privacy solicitor is an important preventative measure. Data privacy and media law have become increasingly important with the rise of the internet and large online social‑media platforms. Taylor Hampton has a longstanding practice in this area and its experts can help explain and navigate these difficult issues.
If you are already facing regulatory scrutiny or enforcement action from the ICO, Taylor Hampton can help you navigate that process, respond to investigations and defend your position. Even if you are not under immediate threat of enforcement, we can advise on governance structures and risk‑management measures to help prevent future issues.
For more information about Taylor Hampton’s privacy practice see our Media Services page HERE or call +44 (0)20 7427 5970. Email: [email protected]
Disclaimer: This article provides general guidance only and does not constitute legal advice. It is based on information publicly available at the date of publication and the regulatory position may change, including as a result of any appeal. Civil procedure rules, legislation and case law can change. Reading this article does not create a solicitor–client relationship. Always seek professional legal advice tailored to your specific situation before acting.