Reddit: a ban in the terms is not an age check

Reddit’s terms said under-13s could not use the service. Until July 2025 there was no age check behind that rule. The ICO found that children under 13 used Reddit anyway and that Reddit had no lawful basis for their data. It had also not assessed the risks to children before January 2025.

These are ICO findings in the penalty notice. Reddit is challenging them, so a tribunal may change them.

• Reddit relied on its terms to keep under-13s off the platform and had no age checks until July 2025.
• As a result it processed the personal data of under-13 users without a lawful basis.
• It did not carry out a data protection impact assessment covering risks to children before January 2025.
• The ICO said the self-declared age check Reddit added in July 2025 is easy to get around, and that it is looking at such checks.

Inth’s technical interpretation: a rule in the terms of service does nothing at sign-up. If the account flow never asks for or checks age, the system has no way to know which users are children, so it cannot treat their data differently. A self-declared birth date field is a step, but the ICO’s view is that it is easy to bypass.

1. Before January 2025No data protection impact assessment covering risks to children, per the ICO
2. July 2025Reddit adds a self-declared age check
3. 23 February 2026Date of the penalty notice
4. 24 February 2026ICO announces the fine
5. 19 March 2026Penalty notice published
6. 1 April 2026ICO update says Reddit has appealed to the First-tier Tribunal

The ICO imposed a monetary penalty. Reddit appealed to the First-tier Tribunal, so the penalty is not final. Inth found no tribunal decision as of the source review date.

£14,472,500, subject to the appeal.

A minimum age written into the terms is not a control. If children are likely to use a service, the ICO expects it to know which users are children and to have assessed the risks before it launches features. The ICO has also signalled that self-declared age gates are under review.

Inth has no capability for age assurance or parental consent. Code audit, Website audit and the Consent banner do not check who is signing up or how old they are, and sign-up screens are outside the banner.

The one adjacent point: the Consent banner covers cookie and tag consent on websites, under the regional policy you choose. It does not verify a visitor’s age.

In the repository

• Find where sign-up enforces your minimum age, if anywhere, and what happens to an account flagged as under age.

In the browser and network

• Try to sign up as a 12-year-old, then change the date and try again. Note what is stored and what stops you.

With the people responsible

• Ask whether a written risk assessment covers children who may use the service despite the terms.
• Ask what evidence shows the minimum age works in practice.

• ICO announcement
• ICO penalty notice (PDF)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Reddit’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: TikTok (UK), Imgur (MediaLab), TikTok (EU)