[Enforcement library](/enforcement)

# Reddit: a ban in the terms is not an age check

The ICO found Reddit had no lawful basis for under-13 users' data because it relied on its terms instead of checking age, and had not assessed risks to children. Reddit has appealed.

## Key facts

- **Regulator or court:** ICO
- **Jurisdiction:** United Kingdom
- **Framework:** UK GDPR, including Article 35
- **Record date:** 2026-02-24
- **Procedural status:** Monetary penalty under appeal to the First-tier Tribunal

The ICO fined Reddit £14,472,500. Its terms barred under-13s, but it did not check ages, so it had no lawful basis for the children who used it anyway. Reddit has appealed.

ICO · UK GDPR · Announced 24 February 2026

- The problem
- Case record
- What the regulator found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

Reddit's terms said under-13s could not use the service. Until July 2025 there was no age check behind that rule. The ICO found that children under 13 used Reddit anyway and that Reddit had no lawful basis for their data. It had also not assessed the risks to children before January 2025.

## Case record

| Field | Record |
| --- | --- |
| Regulator | Information Commissioner's Office (ICO) |
| Organisation | Reddit |
| Action | Monetary penalty notice dated 23 February 2026, announced 24 February 2026 |
| Law | UK GDPR: lawful basis for under-13s' data and Article 35 data protection impact assessment |
| Amount | £14,472,500 |
| Stage | Under appeal to the First-tier Tribunal |

## What the regulator found

These are ICO findings in the [penalty notice](https://ico.org.uk/media2/hrlmvj14/reddit-mpn-20260223.pdf). Reddit is challenging them, so a tribunal may change them.

- Reddit relied on its terms to keep under-13s off the platform and had no age checks until July 2025.
- As a result it processed the personal data of under-13 users without a lawful basis.
- It did not carry out a data protection impact assessment covering risks to children before January 2025.
- The ICO said the self-declared age check Reddit added in July 2025 is easy to get around, and that it is looking at such checks.

## Technical issue

**Inth's technical interpretation:** a rule in the terms of service does nothing at sign-up. If the account flow never asks for or checks age, the system has no way to know which users are children, so it cannot treat their data differently. A self-declared birth date field is a step, but the ICO's view is that it is easy to bypass.

## Timeline

| Date | Event |
| --- | --- |
| Before January 2025 | No data protection impact assessment covering risks to children, per the ICO |
| July 2025 | Reddit adds a self-declared age check |
| 23 February 2026 | Date of the penalty notice |
| 24 February 2026 | ICO announces the fine |
| 19 March 2026 | Penalty notice published |
| 1 April 2026 | ICO update says Reddit has appealed to the First-tier Tribunal |

## Outcome

The ICO imposed a monetary penalty. Reddit appealed to the First-tier Tribunal, so the penalty is not final. Inth found no tribunal decision as of the source review date.

## What it cost

£14,472,500, subject to the appeal.

## Why it matters

A minimum age written into the terms is not a control. If children are likely to use a service, the ICO expects it to know which users are children and to have assessed the risks before it launches features. The ICO has also signalled that self-declared age gates are under review.

## How Inth catches this

Inth has no capability for age assurance or parental consent. Code audit, Website audit and the Consent banner do not check who is signing up or how old they are, and sign-up screens are outside the banner.

The one adjacent point: the Consent banner covers cookie and tag consent on websites, under the regional policy you choose. It does not verify a visitor's age.

## Checks for your own systems

### In the repository

- Find where sign-up enforces your minimum age, if anywhere, and what happens to an account flagged as under age.

### In the browser and network

- Try to sign up as a 12-year-old, then change the date and try again. Note what is stored and what stops you.

### With the people responsible

- Ask whether a written risk assessment covers children who may use the service despite the terms.
- Ask what evidence shows the minimum age works in practice.

## Sources and limits

- [ICO announcement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/reddit-issued-with-1447m-fine-for-children-s-privacy-failures/)
- [ICO penalty notice (PDF)](https://ico.org.uk/media2/hrlmvj14/reddit-mpn-20260223.pdf)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Reddit's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [TikTok (UK)](/enforcement/tiktok-uk), [Imgur (MediaLab)](/enforcement/imgur-medialab), [TikTok (EU)](/enforcement/tiktok-eu)