Imgur (MediaLab): parental supervision in the terms is not parental consent

MediaLab relied on users' consent as its lawful basis. For children under 13, UK GDPR needs a parent’s consent. Imgur’s terms said under-13s could use the service with parental supervision, but the service had no age assurance and no way to get a parent’s consent. MediaLab also had not assessed the risks to children.

These are ICO findings in the penalty notice. MediaLab accepted the provisional findings.

• MediaLab relied on consent but allowed under-13s on Imgur "with parental supervision".
• It had no age assurance, so it could not tell which users were under 13.
• It had no way to obtain parental consent, so the consent it relied on was not valid for those children (Article 8).
• It did not carry out a data protection impact assessment (Article 35).

Inth’s technical interpretation: once a service picks consent as its lawful basis, it has to be able to collect consent from the right person. For a child under 13 that is a parent, and the system needs both an age signal and a parent flow. A sentence in the terms provides neither.

1. 27 September 2021Start of the infringement period
2. 17 December 2024ICO opens its investigation
3. 10 September 2025Notice of intent proposes £393,000
4. 30 September 2025End of the period; Imgur blocks UK access
5. 29 October 2025MediaLab makes representations
6. 4 February 2026Penalty notice for £247,590

The ICO fined MediaLab £247,590, down from the £393,000 it had proposed, after MediaLab’s representations. The ICO announcement and enforcement record do not mention an appeal. Inth has not confirmed that the penalty was paid.

£247,590, and Imgur stopped serving UK users from 30 September 2025.

This is a smaller fine against a smaller company, which makes it closer to most readers' situation than the TikTok or Reddit cases. Allowing children under conditions written in the terms creates a duty to make those conditions work.

Inth has no capability for age assurance or parental consent. Code audit, Website audit and the Consent banner do not check who is signing up or how old they are, and sign-up screens are outside the banner.

The one adjacent point: the Consent banner covers cookie and tag consent on websites, under the regional policy you choose. It does not collect consent from a parent.

In the repository

• If your lawful basis is consent, find where consent is recorded and check it records who gave it.

In the browser and network

• Walk through sign-up as a child and see whether anything asks for a parent.

With the people responsible

• Compare what the terms promise about children with what the product does.
• Ask whether a written risk assessment covers child users.

• ICO enforcement record
• ICO announcement
• ICO penalty notice (PDF)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit MediaLab’s or Imgur’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Reddit (UK), TikTok (UK)