ICO (UK) - Reddit, Inc
From GDPRhub
| ICO - Reddit, Inc | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 35 UK GDPR Article 5(1)(a) UK GDPR Article 6 UK GDPR Article 8 UK GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 23.02.2026 |
| Published: | |
| Fine: | 14,472,500 GBP |
| Parties: | Reddit, Inc |
| National Case Number/Name: | Reddit, Inc |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | dt |
The DPA fined Reddit £14,472,500 (approximately €16,756,188) for processing children’s personal data unlawfully, failing to obtain consent from parents for the processing of personal data of children under 13 years old and failing to carry out a data protection impact assessment.
English Summary
Facts
Reddit, Inc. (the controller) operates the online website and mobile application Reddit (the Platform), a social news, discussion and content rating platform.
Between May 2018 and July 2025, the controller had no form of age assurance that users were required to pass through in order to access the Platform. Users with an account were asked to declare whether they were over 18 years old without any age verification.
Furthermore, for personal data processing via advertising and analytics cookies for children under 13 years old, the controller did not ensure that the holder of parental responsibility gave consent.
In addition, between May 2018 and January 2025, the controller did not conduct any data protection impact assessment in relation to the processing of children’s personal data.
Holding
The DPA found that the controller breached Article 5(1)(a) UK GDPR by processing the personal data of children under 13 years old on the Platform unlawfully since the processing activities were not fair or transparent and none of the legal bases under Article 6(1) UK GDPR applied.
The DPA also held that the controller could not rely on consent under Article 6(1)(a) UK GDPR as a lawful basis for processing the personal data of children under 13 years old on the Platform as it breached Article 8 UK GDPR which required that consent was given or authorised by the holder of parental responsibility.
Finally, the DPA found that the controller failed to carry out a data protection impact assessment in accordance with Article 35(1) UK GDPR in respect of the processing of the personal data of children under 18 years old in the context of the provision of an online service.
Therefore, the DPA fined the controller £14,472,500 (approximately €16,756,188).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
PENALTY NOTICE
REDDIT , NC.
23 February2026TABLE OF CONTENTS
I. INTRODUCTION AND SUMMARY .................................................3
II. RELEVANT LEGAL FRAMEWORK ................................................11
III. BACKGROUND TO THE INFRINGEMENTS ...................................12
(1) The Children’s Code and the background to the Investigation ...12
(2) The In vestigation.....................................................................14
(3) Background to Reddit...............................................................18
(4) Summary of the services provided by Reddit’s Platform............20
(5) Potentially harmful content on the Platform .............................22
(6) Reddit’s processing of personal data ........................................22
(7) Child users of Reddit ................................................................27
(a) Reddit’s Privacy Policy and User Agreement .......................27
(b) The number of children using Reddit in the UK....................30
(c) Reddit’s approach to age-gating.........................................37
IV. FINDINGS OF INFRINGEMENT ..................................................39
(1) The Relevant Periods ...............................................................41
(2) Reddit’s status as a controller ..................................................41
(3) Scope of the UK GDPR and DPA ................................................42
(a) Material scope....................................................................42
(b) Territorial scope.................................................................43
(4) Specific protections required for children .................................45
(5) Infringement of Articles 5(1)(a), 6 and 8 UK GDPR...................47
(a) Legal framework................................................................49
(b) Reddit’s stated position......................................................51
(c) Findings on lawfulness, fairness and transparency: Article
5(1)(a) UK GDPR.........................................................................56
(d) Findings on consent: Article 6(1)(a) and Article 8 UK GDPR 60
(e) Findings on contractual necessity: Article 6(1)(b) UK GDPR 65
(f) Findings on legitimate interests: Article 6(1)(f) UK GDPR ...70
(g) Concl usion on Article 5(1)(a) UK GDPR...............................96
(6) Infringement of Article 35 UK GDPR .........................................96
(a) Legal framework................................................................96
(b) Findings on Article 35 UK GDPR..........................................99
V. DECISION TO IMPOSE A PENALTY .......................................... 111
(1) Legal fram ework: penalty notices..................................... 111
1 (2) Reddit’s overarching submission that the Commissioner
should exercise his discretion not to impose a penalty in the
circumstances of this case......................................................... 114
(3) Seriousness of the Infringements..................................... 115
(4) Relevant aggravating or mitigating factors ....................... 131
(5) Effectiveness, proportionality and dissuasiveness............. 141
(6) The Commissioner’s conclusion on whether to impose a
penalty...................................................................................... 142
VI. CALCULATION OF THE PENALTY ............................................. 142
(1) Statutory Maximum Penalty ............................................. 143
(2) Step 1: Assessment of the seriousness of the Infringements
148
(3) Step 2: Accounting for turnover........................................ 149
(4) Step 3: Calculation of the starting point............................ 150
(5) Step 4: Adjustment to take into account any aggravating or
mitigating factors...................................................................... 151
(6) Step 5: Adjustment to ensure the fine is effective,
proportionate and dissuasive..................................................... 153
(7) Conclusion: Penalty.......................................................... 160
VII. FINANCIAL HARDSHIP ........................................................160
VIII. PAYMENT OF THE PENALTY..................................................161
ANNEX 1.........................................................................................163
ANNEX 2.........................................................................................166
ANNEX 3.........................................................................................188
2 DATA PROTECTION ACT 2018 (PART 6, SECTION 155)
ENFORCEMENT POWERS OF THE INFORMATION COMMISSIONER
PENALTY NOTICE
To:
Reddit, Inc.
Of: 548 Market Street
San Francisco
CA 94104
I. INTRODUCTION AND SUMMARY
1. Pursuant to section 155(1) Data Protection Act 2018 (“DPA”), the
Information Commissioner (“Commissioner”), by this written
notice (“Penalty Notice”), requires Reddit, Inc. (“Reddit”) to pay
a penalty of £14,472,500 in respect of infringements of the UK
General Data Protection Regulation (“UK GDPR”).
2. This Penalty Notice contains the reasons why the Commissioner has
decided to impose a penalty, including the circumstances of the
infringements and the nature of the personal data involved. It
follows an investigation which was carried out by the Information
Commissioner’s Office (“ICO”) into Reddit’s processing of children’s
personal data (“the Investigation”). The Investigation assessed
Reddit’s compliance with the UK GDPR.
3. In accordance with paragraph 2 of Schedule 16 to the DPA, the
Commissioner issued a notice of intent (“NOI”) to Reddit on 8 July
2025. The NOI set out the reasons why the Commissioner proposed
to give Reddit a penalty notice in relation to its website and mobile
3 app (the “Platform”). In that NOI, the Commissioner indicated that
he proposed imposing a penalty of £17,573,750 on Reddit following
provisional findings that Reddit had infringed Articles 5(1)(a), 6, and
8 and Article 35 UK GDPR.
4. On 26 September 2025, Reddit made written representations (“the
Representations”) about the Commissioner’s intention to give a
penalty notice.
5. Having considered the Representations, the Commissioner finds that
Reddit has, in its capacity as controller, infringed Articles 5(1)(a),
6, and 8 (the “Processing Infringements”) and Article 35 (the
“DPIA Infringement”) UK GDPR (collectively, the
“Infringements”). The Commissioner has decided to impose a
penalty for the reasons set out in this Penalty Notice.
6. The Infringements identified in this Penalty Notice took place over
the following periods (the “Relevant Periods”):
a) in respect of the Processing Infringements, the period of
infringement commenced on 25 May 2018 and concluded on
8 July 2025 (subsequent references to the ‘Relevant Period’ in
the singular are to the period of the Processing Infringements,
unless otherwise stated); and
b) in respect of the DPIA Infringement, the period of
infringement is between 25 May 2018 and 31 December 2024.
7. The end-dates of the respective Relevant Periods have been
selected for reasons set out in paragraphs 78 and 198-210 below.
The Commissioner will continue to consider whether Reddit’s
operation of the Platform after these dates, following the
4 introduction of age assurance measures by Reddit in July 2025, was
in accordance with its obligations under the UK GDPR.
8. Subject to paragraph 9 below, this Penalty Notice relates to the
processing by Reddit during the Relevant Period of personal data
relating to users of the Platform who:
a) in respect of the Processing Infringements, were children
under 13 years old; and
b) in respect of the DPIA Infringement, were children under 18
years old (the “Relevant Processing”).
9. However, the Relevant Processing does not include processing
performed by Reddit during the Relevant Period that was necessary
for the purposes of:
a) identifying users who were under 13 years old and removing
them from the Platform;
b) detecting, preventing or responding to security risks, abuse,
fraud, or technical issues which could harm users of the
Platform (including users who are under 13 years old); or
c) complying with applicable law.
10. In summary, as explained in detail in this Penalty Notice, during the
Relevant Period:
a) The Platform was made available by Reddit in the UK and, by
1
May 2025, was accessed daily by 7 million people in the UK.
1
Ofcom Online Nations Report 2025, p. 35.
5b) The Platform was offered to children between the ages of 13
– 17 years old. During the Relevant Period, the various
iterations of Reddit’s user agreement and privacy policy
explicitly stated that the Platform was not to be used by
children under 13 years old.
c) Until July 2025, Reddit had no form of age assurance that
users were required to pass through in order to access the
Platform. The Platform was available to view by anyone who
landed on it. Users who opted to set up an account, in order
to post content or to access content that was designated as
only being appropriate for adults, were asked simply to
declare whether they were over 18 years old, without any sort
of age verification being applied.
d) While on the Platform, users were asked whether they
consented to their personal data being processed via cookies
placed for advertising and analytics purposes. Reddit did not
take any steps to ensure that where consent was purportedly
given by a child under 13 years old to the placement of these
cookies, or to the processing of personal data for advertising
and analytic purposes, it had been given or authorised by the
holder of parental responsibility over that child.
e) Until January 2025, Reddit did not conduct any assessment of
the risks of it processing children’s personal data, even though
it offered the Platform to children between 13 – 17 years old,
and it took no steps to ensure that children below 13 years
old were not accessing the Platform.
6 f) Reddit estimated that it had approximately unique
daily active users in the UK in 2022. 2 Reddit separately
estimated that approximately of its users were children
and approximately were under 13 years old between the
years 2021-2023. 3 On Reddit’s own estimates, therefore,
around 42,000 children under 13 years old accessed the
Platform in the UK every day during those years. The
Commissioner’s own estimates of the number of children
accessing the Platform include that approximately 537,000
children visited the Platform in the UK in 2024, with around
226,000 of these being under 13 years old.
g) Children have had their personal data processed in various
ways during the Relevant Period, by Reddit and third parties,
as a result of accessing the Platform. It has been transferred
outside the UK; processed to determine the content of the
children’s home feeds 4 (including, potentially, to feed them
inappropriate or harmful content); shared with third parties
for further processing (including, potentially, for advertising
purposes); and processed by Reddit in a wide variety of ways
including for monitoring and analysing usage and activities
(such as, for example, information about what the child did on
the websites of third parties who have advertising
arrangements with Reddit).
h) This occurred in a setting where, during the Relevant Period,
a substantial amount of content was available on the Platform
that was unsuitable for children and potentially harmful to
2Correspondence from Reddit to the ICO, dated 3 May 2022.
3Correspondence from Reddit to the ICO, dated 1 March 2024.
4A personalised stream of content on a user’s home page on Reddit which uses
machine learning to recommend content.
7 them, including pornography, and discussions of subjects such
as suicide, self-harm, substance abuse, and eating disorders.
As a result of Reddit’s failure to conduct a timely impact
assessment, and/or to introduce appropriate age assurance
measures, children, including very young children, were
potentially exposed to this content.
11. In these circumstances, in summary, during the Relevant Period:
a) Reddit processed the personal data of children under 13 years
old on the Platform unlawfully as, in breach of the requirement
that personal data shall be processed lawfully, fairly and in a
transparent manner in relation to the data subject (Article
5(1)(a) UK GDPR), the Relevant Processing was not fair or
transparent and none of the lawful bases set out in Articles
6(1)(a) to (f) UK GDPR apply.
b) In particular, Reddit was not able to rely on consent as its
lawful basis for processing the personal data of children under
13 years old on the Platform in accordance with Article 6(1)(a)
UK GDPR, as it failed to ensure that consent was given or
authorised by the holder of parental responsibility over these
children, and/or was failing to make reasonable efforts to
verify in such cases that consent was given or authorised by
the holder of parental responsibility, taking into consideration
available technology, as required under Article 8 UK GDPR.
c) In respect of the processing of children’s personal data in the
context of the provision of an online service, until 1 January
2025, Reddit failed to carry out a data protection impact
assessment (“DPIA”) in accordance with the requirements of
8 Article 35(1) UK GDPR. This was a form of processing which
was likely to result in a high risk to the rights and freedoms of
individuals, in this case children under 18 years old.
12. For the reasons set out in this Penalty Notice, the Commissioner
considers that a monetary penalty should be imposed on Reddit to
reflect the seriousness of the Infringements. The penalty imposed is
effective, proportionate and dissuasive.
13. In its Representations, Reddit made a range of submissions on the
NOI, both in relation to the Commissioner’s provisional findings of
infringement and his provisional decision to impose a penalty. The
Commissioner has taken into account the Representations in
reaching his final decision. This Penalty Notice addresses the detail
of those Representations where relevant below.
14. Throughout the Representations, Reddit laid emphasis on its view
that the Commissioner has misunderstood the Platform and, in
particular, that:
a) The Commissioner has not appreciated the value of
pseudonymity to Reddit’s usership. Reddit considers that this
pseudonymity facilitates the expression of its users’ rights
under Articles 8, 10 and 11 of the European Convention on
Human Rights (“ECHR”), as well as Reddit’s own rights under
Article 10 of the ECHR, such that anything that cuts across it
would interfere with the exercise of fundamental rights by
Reddit’s users and by Reddit; and
b) It would have been disproportionate for Reddit to have
introduced age assurance during the Relevant Period, given
that children under 13 years old were a small minority of the
9 Platform’s users; that the Platform was not designed to appeal
to children; and that children were unlikely to encounter
harmful content on the Platform in view of the design and the
risk mitigation measures that Reddit had put in place. Rather,
Reddit’s view is that its approach struck the correct balance
between the competing rights of children under 13 years old
and of the majority of its users.
15. The Commissioner does not agree with these points, or that
enforcement action is inappropriate in this case, as:
a) The Commissioner has not overlooked the pseudonymous
nature of the Platform. Nothing in this Penalty Notice will ‘cut
across’ pseudonymity on the Platform. Age assurance
measures would require the provision of personal data to
Reddit, or to a third party. They would not require any form
of publication of personal data, or identification of users, on
the Platform itself. Thus, the Commissioner’s conclusions will
not undermine the ability of users to adopt pseudonyms on
the Platform. Indeed, Reddit has now introduced age
assurance to comply with the Online Safety Act 2023 (“OSA”)
and it continues to offer a pseudonymous Platform.
b) Enforcement action by the Commissioner is not an unlawful
interference with ECHR rights, whether users’ or Reddit’s.
Reddit does not contend otherwise. Even if age assurance
measures were to interfere with any ECHR rights, the rights
in question are qualified and the interference would be
justified. It would be in accordance with the law, under the UK
GDPR and the Commissioner’s enforcement powers under the
DPA; it would further the legitimate aims of protecting morals
and protecting the rights of children; and it would be
10 necessary and proportionate. Irrespective of what proportion
of users of the Platform they comprise, the absolute number
of children and young children accessing the Platform during
the Relevant Period was substantial and Reddit should have
taken steps, under the UK GDPR, to protect their rights and
interests.
II. RELEVANT LEGAL FRAMEWORK
16. Section 155(1) DPA provides that where the Commissioner is
satisfied that a person has failed, or is failing, in a manner described
in section 149(2) DPA, the Commissioner may by written notice (a
penalty notice) require the person to pay to the Commissioner an
amount in sterling specified in the notice.
17. Section 149(2) materially provides that:
“The first type of failure is where a controller or processor has failed,
or is failing, to comply with any of the following—
(a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3
or Chapter 2 of Part 4 of this Act (principles of processing);
(b) a provision of Articles 12 to 22 of the UK GDPR or Part 3 or 4 of
this Act conferring rights on a data subject;
(c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or
65 of this Act (obligations of controllers and processors)…”
18. The relevant substantive provisions of the UK GDPR are set out
below in the sections dealing with the Infringements. The legal
11 framework on setting penalties is set out at Section V(1) of this
Penalty Notice.
III. BACKGROUND TO THE INFRINGEMENTS
19. This section summarises the relevant background to the findings of
infringement.
(1) The Children’s Code and the background to the
Investigation
20. The Commissioner is required by section 123(1) DPA to prepare a
code of practice which contains such guidance as the Commissioner
considers appropriate on standards of age-appropriate design of
relevant information society services (“ISS”) which are likely to be
accessed by children. In compliance with this obligation, the
Commissioner laid the Age Appropriate Design Code 5 (the
“Children’s Code”) before Parliament on 11 June 2020. The
Children’s Code was then issued on 12 August 2020 and came into
force on 2 September 2020. 6
21. In accordance with section 123(1) DPA, the Children’s Code is
directed at providers of ISS that are “likely to be accessed by
children” and is expressly not “restricted to services specifically
directed at children”. In accordance with section 127 DPA, the
Commissioner must take the Children’s Code into account when
5Age appropriate design: a code of practice for online services | ICO, which came into
force on 2 September 2020 with a 12-month transition period for organisations to
conform by 2 September 2021.
6About this code | ICO.
7See the section on services covered by the Code.
12 considering whether an ISS provider has complied with its data
protection obligations under the UK GDPR.
22. The transitional arrangements set out upon the issuance of the
Children’s Code provided that any ISS provider within its scope was
expected to bring its processing into line with the standards of the
Children’s Code by 2 September 2021. 8
23. On 18 May 2021, the ICO conducted a risk assessment to identify
any ISS provider that could be considered higher risk because of
provisional indications of non-conformance with the Children’s Code.
This assessment identified social media and messaging services as
a sector of ‘high’ risk for children.
24. Reddit was identified as an organisation of interest in the context of
this work. The ICO identified that Reddit’s website did not have any
form of age-gating and noted it had separately been classified in Net
10
Aware as “poor” in terms of its overall safety for children.
25. The ICO wrote to Reddit on 3 September 2021, enquiring about
Reddit’s approach to conformance of the Platform with the standards
of the Children’s Code and compliance with the UK GDPR. 11
26. The ICO reviewed Reddit’s responses in order to identify whether
there was a risk that Reddit’s processing activities were not
conforming to the standards set out in the Children’s Code, which
would indicate a likelihood that Reddit would be unable to
8See the transitional arrangements section of the Code and section 123(6) DPA.
9Intelligence Briefing – Age Appropriate Design Code – Risk Assessment (18 May 2021).
10
Net Aware was a guide jointly produced by O2 and the National Society for the
Prevention of Cruelty to Children (NSPCC) which aimed to provide parents with
information on how to help keep their children safe online with reference to the most
popular sites, apps and games that young people use. See the archived webpage
(Accessed 18 May 2021).
11Correspondence from the ICO to Reddit, dated 3 September 2021.
13 demonstrate its compliance with relevant provisions of the UK
12
GDPR. Following this assessment, the ICO commenced the
Investigation on 15 April 2022.
27. Separately, Reddit is a regulated user-to-user service for the
purposes of section 4(2) OSA, for which the Office of
Communications (“Ofcom”) has oversight. The OSA aims to make
the use of internet services safer for individuals in the United
Kingdom by, among other things, imposing duties requiring
regulated services like Reddit to mitigate and manage the risks of
harm from content and activity that is harmful to children.3
28. In accordance with section 36(1) OSA, regulated user-to-user
services were required to carry out a children’s access assessment
(“CAA”) by 16 April 2025. In the event that the CAA indicated that
a service is “likely to be accessed by children”, the relevant service
was required to complete a children’s risk assessment (“CRA”) by
24 July 2025. A CRA was required to consider, inter alia, the
likelihood of children encountering specific kinds of potentially
harmful content on the service and to contain an assessment of the
user base, including the number of users who are children in
different age groups (section 11(6) OSA). All regulated user-to-user
services were also required to carry out an illegal content risk
assessment (“ICRA”) by 16 March 2025.
(2) The Investigation
29. The Investigation included a variety of meetings with
representatives of Reddit, written requests for information, the
issuance of three statutory information notices under section 142
12
13See the section on the legal status of the Code.
See OSA, section 1.
14 DPA, and the issuance of a preliminary decision on which Reddit was
given the opportunity to comment. Of particular relevance to this
Penalty Notice, are the following.
30. The ICO made non-statutory requests for information, on:
a) 15 April 2022, in order to obtain, inter alia, company
information, details of Reddit’s data processing and data
sharing activities (including how it ascertains the age of
users), and copies of any relevant DPIAs;
b) 13 September 2022, in order to obtain estimates of the ages
of Reddit’s usership and details about how Reddit identifies
and removes accounts belonging to children under 13 years
old; and
c) 19 July 2024, in order to clarify responses to earlier
correspondence, obtain copies of legitimate interests
assessments for the processing of children’s personal data,
and to make a further request for any DPIAs that might have
been relevant to the Investigation.
31. The Commissioner served three information notices, on:
a) 14 July 2023, in order to, inter alia:
i. ascertain which Reddit entity was the controller of UK
users’ personal data;
ii. obtain estimates of the total UK users of Reddit, the
ages of these users and details of any actions taken
15 against accounts identified as belonging to children
under 13 years old; and
iii. ascertain whether Reddit had means by which to
obtain parental consent for the creation of accounts
for children under 13 years old.
b) 31 January 2024, in order to, inter alia:
i. clarify the specific functions of Reddit UK Limited;
ii. obtain copies of the third-party data Reddit had used
to estimate the number of children who used the
Platform;
iii. request further details of how Reddit identifies and
removes accounts associated with children under 13
years old;
iv. obtain copies of Reddit’s DPIAs covering the data
processing related to the provision of Reddit’s
services in the UK;
v. obtain copies of Reddit’s privacy policies, user
agreements and other contractual documentation;
vi. ascertain details of Reddit’s processing operations
and the legal bases upon which it relied in
undertaking such operations;
16 vii. clarify the nature of any age assurance measures
Reddit had in place on the Platform;
viii. obtain further details of the measures Reddit had in
place to detect and delete accounts associated with
children under 13 years old; and
ix. obtain details pertaining to the size and annual
turnover of Reddit.
c) 11 November 2024, in order to, inter alia:
i. obtain copies of any legitimate interests assessments
conducted by Reddit;
ii. ascertain what user personal data was processed by
Reddit and for which purposes, as well as clarify
apparent inconsistencies in previous responses
Reddit had provided to queries made by the ICO; and
iii. obtain the most recently available set of consolidated
financial statements for Reddit.
32. The ICO also held in-person and virtual meetings with Reddit on 9
January 2025 and 8 May 2025 to discuss Reddit’s approach to age-
gating on the Platform and the Commissioner’s provisional findings
of infringement. The Commissioner served Reddit with the NOI on 8
July 2025.
33. During the virtual meeting on 8 May 2025, Reddit agreed to provide
the ICO with copies of the CAA, CRA and ICRA that it had conducted
in connection with OSA and provided to Ofcom. On 27 May 2025,
17 via email, Reddit then refused to share those documents with the
ICO after all.14 Upon receiving the Representations, however, the
ICO repeated its request for copies. These were provided by Reddit
on 14 November 2025.
34. As part of the Representations, Reddit provided the ICO with copies
of the various iterations of its user agreement (setting out the terms
15
of service for using the Platform – the “User Agreement” ) as it
applied during the Relevant Period. It became apparent on reviewing
those documents again that, since 16 September 2024, the
counterparty to the User Agreement has not been Reddit but Reddit
Netherlands B.V. On 3 November 2025, the ICO therefore asked
Reddit a series of further questions about the role of Reddit
Netherlands B.V. and the relationship between the two companies.
Reddit responded on 21 November 2025 and details of its response
are set out in paragraph 41 of this Penalty Notice.
(3) Background to Reddit
35. Reddit was founded in June 2005 and is headquartered in San
Francisco. It was incorporated as Reddit, Inc. in May 2011 in
Delaware, USA. The largest shareholder is Advance Publications,
Inc., a media company incorporated in the state of New York, which
owns, among other companies, Condé Nast, the publisher of well-
known publications such as The New Yorker, Vogue, and GQ
Magazine. 16
14
Email from Reddit to the ICO dated 27 May 2025.
15The singular term ‘User Agreement’ is used throughout this Penalty Notice. Where
there are material differences between different iterations of the User Agreement
throughout the Relevant Period, these are indicated.
16See https://www.advance.com/ (accessed 18 February 2026), listing Condé Nast as
one of Advance’s “operating companies” and Reddit as one of its “major investments”.
1836. Reddit generated revenue of $1.3 billion in 2024, over 90% of which
17
was derived from its advertising business.
37. Reddit began trading on the New York Stock Exchange (“NYSE”) on
21 March 2024.
38. Reddit is the corporate parent of Reddit UK Limited, a wholly owned
subsidiary which has offices at 5 New Street Square, London, United
Kingdom, EC4A 3TW. Reddit UK Limited’s Annual Report and
Financial Statements for the financial year ended 31 December 2024
record that “[t]he principal activity of the company is to provide
support and outsourced services to its ultimate parent company
Reddit, Inc.”.18
39. Reddit informed the ICO that “Reddit UK Limited is not the data
controller of personal data relating to users of the Platform, nor does
it process user data”, 19 and that in terms of its specific functions,
“Reddit UK Limited
and, as part of that
function,
as directed by
Reddit, Inc.” 20Reddit UK Limited is Reddit’s representative in the
UK for the purposes of Article 27(1) UK GDPR. 21
40. Reddit is also the corporate parent of Reddit Netherlands B.V., a
wholly owned subsidiary which has offices at Keizersgracht 62,
1015CS Amsterdam, the Netherlands.
17Reddit’s 2024 Form 10-K, pp. 97; Advance Publication, Inc.’s place of incorporation is
stated as New York in US Securities and Exchange Commission filings, such as the cover
sheet of a Form SC 13G filed on 14 November 2024.
18
Reddit UK Limited Annual Report and Financial Statements for the financial year
ended 31 December 2024.
19Correspondence from Reddit to the ICO, dated 11 August 2023.
20Correspondence from Reddit to the ICO, dated 1 March 2024 (p. 4).
21See Reddit’s privacy policy (effective 16 August 2024) (accessed 24 June 2025).
1941. Reddit Netherlands B.V. is the controller of the personal data of
users based in the EEA and Switzerland. 22 In addition, since 16
September 2024, Reddit Netherlands B.V. has been the
counterparty to the User Agreement that Reddit maintains applies
to all UK users of the Platform. Reddit informed the ICO that “Reddit
Netherlands BV …has no vires to determine the purposes and means
of processing of the personal data of UK users and it does not do so.
To the extent that it makes any changes to the nature of the Service
which affects such matters for UK users and which involves any
limited processing of UK user personal data, it would do so as
23
processor on behalf of Reddit Inc.” Reddit therefore maintains that
Reddit Netherlands B.V. is the contractual counterparty for all UK
users, but that it is not a controller in respect of these users’
personal data.
(4) Summary of the services provided by Reddit’s Platform
42. Reddit is a social news aggregation, content rating, and discussion
platform, available both via a web browser, at www.reddit.com, (the
“Website”) and via an application programme (the “App”). The
Platform is accessible internationally, including in the UK. Reddit’s
most recent annual report states that in “the three months ended
December 31, 2024, an average of 101.7 million daily active uniques
[unique individual visitors per day] … around the world came
together on Reddit to share the rhythm of their daily discoveries,
ask questions and receive advice, research before making a
purchase decision, hear reactions to recent events, and thrive as a
24
community”. Ofcom research indicates that 60% of UK online
adults (a total of 29.4 million) visited Reddit in the single month of
22Ibid.
23
24Correspondence from Reddit to the ICO, dated 21 November 2025.
Reddit – Annual Report to Security Holders (28 April 2024), p.6.
20 May 2025. 25 In the year 2024, the ICO’s estimates indicate that
approximately 537,000 children visited the Platform in the UK, with
around 226,000 of these being under 13 years old. 26 While Ofcom’s
Online Nation Report 2025 does not include data on the number of
children using the Platform, it does confirm that Reddit is
increasingly used by “younger audiences”, with the Platform rising
th th
from the 7 to the 6 most popular organisation visited by adults
aged 18-24 (with 77% of users in this age bracket accessing Reddit
27
in the single month of May 2025) .
43. The access and features available to users differ depending on (i)
whether or not a user is accessing the Platform via a registered
Reddit account and (ii) whether the Platform is accessed via a web
browser or via the App. Only users who have registered as account
holders and access the Platform while logged into their accounts
(“Logged-in Users”) can post, comment, or vote (“upvote” or
“downvote”) on content in various communities organised around
topics of interest (“Subreddits”). Logged-in Users can also access
Reddit’s private message and chat function. 28 By contrast, these
features are not available to users who are not accessing the
Platform via an account (“Logged-out Users”), albeit that any
member of the public with access to the internet can view content
that has been shared publicly on the Platform.
44. There is no direct monetary charge to users for creating a Reddit
account. Instead, over 90% of Reddit’s income is generated via
advertising revenue. 29However, Reddit does also offer a ‘Reddit
Premium’ service, which, during the Relevant Period, was charged
25
26Ofcom, Online Nations Report 2025 (10 December 2025), p. 35.
See Annex 2.
27Online Nations Report 2025, pp. 17-18, 20.
28Letter from Reddit to the ICO, dated 1 March 2024 (p. 9).
29Reddit’s Annual Report indicated that US$1.185 billion of its US$1.300 billion revenue
was comprised of advertising revenue (p.82).
21 at US$5.99 per month or US$49.99 per year when accessed via a
web browser and charged at US$6.99 per month or US$59.99 per
year when accessed via the App. This ‘Reddit Premium’ service
enables users to browse the Platform without adverts and access a
‘premium lounge’, giving access to exclusive ‘avatar gear’ and the
30
use of ‘premium icons’.
(5) Potentially harmful content on the Platform
45. In April 2025, the ICO undertook research on the content available
on the Platform, a summary of which can be seen at Annex 3. The
research contains explicit imagery which has factored into the
Commissioner’s consideration of the seriousness of the
infringements in Section V(3) of this Penalty Notice. An advisory
content warning is hereby given in respect of the contents of Annex
3.
46. In its Representations, Reddit took issue with the Commissioner’s
presentation of the evidence in Annex 3, which is considered at
paragraphs 181-182 below.
(6) Reddit’s processing of personal data
47. The personal data processed by Reddit during the Relevant Period
varied according to whether the Platform was being accessed by
Logged-in Users or Logged-out Users. In respect of Logged-out
Users, Reddit automatically processed:31
30Reddit Premium - Enjoy Exclusive Features and VIP Status (accessed 18 February
3126).
Correspondence from Reddit to the ICO, dated 1 March 2024 (p. 9).
22 32
a) IP addresses, which were retained for before being
33
deleted;
b) device information, including details of the type of device and
operating system used;
c) details of web links these users clicked on; and
d) information (including IP addresses, unique identifiers, and
browsing history) from:
i. essential cookies which enable website
functionality;34
ii. non-essential advertising cookies — which Reddit
used with the aim of making advertisements more
relevant to users, to track the efficiency of advertising
campaigns and which its third-party advertising
partners may have used to build profiles of users and
35
deliver advertising on other websites — where users
provided consent to such cookies via the Platform’s
consent management platform (“CMP”); and
iii. analytics cookies — which enabled Reddit to count
visits to its Platform and traffic sources, assess which
32
An Internet Protocol (IP) address is a unique string of numbers that identifies each
computer using the Internet Protocol to communicate over a network.
33According to correspondence from Reddit to the ICO, dated 3 May 2022 and 1 March
2024.
34A cookie is a small text file that is downloaded onto ‘terminal equipment’ (e.g. a
computer or smartphone) when a visitor accesses a website. Essential cookies enable
core website functionality, such as account management and user login, while non-
essential cookies allow for further personalisation of a visitors’ experience on the relevant
website — including personalised advertising — and for website providers to measure
analytics and website performance.
35Reddit – Cookie Notice (Accessed 28 May 2025).
23 pages were the most and least popular and analyse
how users navigated its Platform — where users
provided consent to such cookies via the Platform’s
CMP. 36
48. For Logged-in Users, in addition to the categories of personal data
listed in paragraph 47 above, Reddit processed the following
categories of personal data: 37
a) an email address or telephone number for each user and one
interest (such as music or basketball), which was required in
order to set up an account;
b) gender, from a limited number of pre-defined options in a list,
where this was added at the option of the user during account
creation;
c) unstructured personal data in the form of a ’Display name’
(maximum 90 characters) and ’About you’ information
(maximum 200 characters) where this was added at the
option of the user by using the ’Edit’ profile function; and
d) further structured and unstructured personal data relating to
a user’s interactions on the Platform, including posts,
comments, and votes on content in Subreddits, as well as
messages in the Platform’s private message and chat
functions.
36Reddit – Cookie Notice (Accessed 28 May 2025).
37As identified by the ICO through the Investigation and stated in correspondence from
Reddit to the ICO, dated 1 March 2024.
2449. Moreover, in some cases Logged-In Users would post content
revealing racial or ethnic origin, political opinions, religious or
philosophical beliefs, trade union membership, or content
concerning health or data concerning a natural person's sex life or
sexual orientation. In those circumstances the content would
constitute special category data for the purposes of the UK GDPR
(Article 9).
50. Reddit stated in correspondence with the ICO that the personal data
referenced in paragraphs 47 and 48 above was processed
“primarily” to “provide, maintain and improve the services”, in which
context the term ‘services’ refers to Reddit’s websites, mobile apps,
widgets, APIs, emails and other online products and services
(collectively, the “Services”):
“[…]
25 38
”
51. Reddit’s privacy policy (effective 16 August 2024, the “Privacy
Policy”) 39 informed users “how” Reddit would use their personal
data as follows:
“How We Use Information
We use information about you to:
• Provide, maintain, and improve the Services;
• Personalize services, content, and features that match your
activities, preferences, and settings;
• Help protect the safety of Reddit and our users, which includes
blocking suspected spammers, addressing abuse, and
enforcing the Reddit User Agreement and our other terms and
policies, as well as comply with applicable law;
• Provide, optimize, target, and measure the effectiveness of
ads shown on our Services;
• Research and develop new services;
• Send you technical notices, updates, security alerts, invoices,
and other support and administrative messages;
• Provide customer service;
• Communicate with you about products, services, offers,
promotions, events, and programs, and provide other news
and information we think will be of interest to you (for
38Correspondence from Reddit to the ICO, dated 1 March 2024 (pp. 9-10).
39
Reddit Privacy Policy (Accessed 28 May 2025). All subsequent references to the
‘Privacy Policy’ are to this version, unless otherwise stated.
26 information about how to opt out of these communications,
see “Your Choices” below); and
• Monitor and analyze trends, usage, and activities in
connection with our Services.”
(7) Child users of Reddit
52. This sub-section sets out:
a) Reddit’s stated policy on access to the Platform by users under
13 years old;
b) the ICO’s estimates of the number of children under 13 years
old, and between 13 and 17 years old, accessing the Platform
during the Relevant Period; and
c) Reddit’s approach to age-gating for users attempting to
access the Platform during the Relevant Period.
(a) Reddit’s Privacy Policy and User Agreement
53. In respect of children under 13 years old, Reddit’s Privacy Policy 40
states that:
40Reddit Privacy Policy. The Commissioner notes that wording substantially to this effect
has operated throughout the Relevant Period, with iterations since 15 November 2022
adopting precisely this wording. The operative privacy policies between 8 June 2018 and
15 November 2022 were identical except for the substitution of “if you are in the EEA”
for the words “if you are located outside the United States”. Reddit’s privacy policy for
the Relevant Period prior to 8 June 2018 read as follows: “Although we welcome users
from all walks of life, Reddit is not intended or directed at individuals under the age of
13. Therefore, individuals under the age of 13 may not create an account or otherwise
access or use the Services.”
27 “Children under the age of 13 are not allowed to create an account
or otherwise use the Services. Additionally, if you are located
outside the United States, you must be over the age required by the
laws of your country to create an account or otherwise use the
Services, or we need to have obtained verifiable consent from your
parent or legal guardian.”
54. In respect of the ‘verifiable consent’ of a parent or legal guardian
referred to above, there were no clear means throughout the
Relevant Period by which users could provide or evidence such
consent. When questioned on this subject, Reddit stated that:
“Under the Reddit User Agreement and Privacy Policy the minimum
age for a UK individual to use Reddit is 13 years old.
The Reddit User Agreement and Privacy Policy further require that,
if the user is over 13 but under the age of majority or contractual
capacity in their particular country (16 in the UK), they may only
use the app if their legal guardian has reviewed and agreed to the
User Agreement. The Privacy Policy also states that parental consent
must be verifiable.
The User Agreement also requires that users must be at least 18
years old to access content classified as NSFW (“NSFW” indicates
“Not Safe For Work” content, which is a phrase used by Reddit to
signify any type of graphic content that an adult might not wish to
be seen accessing in a professional setting like the workplace, such
as sensitive, explicit or mature content).”41
55. During the Relevant Period, Reddit’s User Agreement was accessible
at the foot of the Website landing page as well as by navigating to
‘settings’ in the App. A link to the User Agreement was also
41
Correspondence from Reddit to the ICO, dated 1 March 2024 (p.14).
28 presented to users during the account creation ‘user journey’, but it
was optional whether they would click on the link and read the text
of the User Agreement.
56. The User Agreement purported to set out the terms that users were
required to accept as a condition of accessing the Platform.
However, there was no requirement for users to positively affirm
that they had accepted these terms, or indeed to have read them;
rather, accessing the Platform in any capacity was assumed by
Reddit to be evidence of acceptance of these terms, in addition to
representing consent to the processing, transfer and storage of
information “in and to” the United States and other countries. 42
57. The User Agreement (effective 28 June 2025) 43 states that:
“1. Your Access to the Services
No one under 13 is allowed to use or access the Services. Parts of
our Services require you to be older to use them. For example, you
must be at least 18 years old to view mature content on Reddit.
Please read all notices and any Additional Terms carefully when you
access the Services.
By using the Services, you state that:
42Reddit Privacy Policy, see ‘International Data Transfers’.
43User Agreement – 28 June 2025 (accessed 18 February 2026). The reference to
‘mature content’ in this section was not included in earlier versions of the User Agreement
which were effective throughout the majority of the Relevant Period. The 24 September
2024 version of the User Agreement instead read as follows: “No one under 13 is allowed
to user or access the Services. We may offer additional Services that require you to be
older to use them, so please read all notices and any Additional Terms carefully when
you access the Services”. The Commissioner notes that earlier versions of the User
Agreement throughout the Relevant Period employ identical wording, except for versions
effective prior to 12 September 2021, which closely follow the wording in relation to
children under 13 years old in the privacy policies effective at the relevant times.
29 You are at least 13 years old and over the minimum age required
by the laws of your country of residence to access and use the
Services;
You can form a binding contract with Reddit, or, if you are over 13
but under the age of majority in your jurisdiction, that your legal
guardian has reviewed and agrees to these Terms;
You are not barred from using the Services under all applicable laws;
and
You have not been permanently suspended or removed from the
Services.”
(b) The number of children using Reddit in the UK
58. Before July 2025, Reddit did not require its users to declare their
age before accessing or using the Platform. Consequently, there was
unlimited logged-out access to general content on the Platform (i.e.,
content that had not been flagged as ‘NSFW’) throughout the
Relevant Period, though Logged-out Users could only browse and
could not post, comment, or vote. 44
59. Throughout the Relevant Period, access to content flagged as
‘NSFW’ required log-in or account creation, with the account holder
needing to confirm they were over 18. This confirmation, allowing a
user to open or log-in to an account and access NSFW content, was
by self-declaration. Users were not asked to provide a date of birth
or any other proof of age. They were simply shown the prompt “To
update your settings to show mature content, confirm you’re over
18” along with two options: to either “Go Back” or confirm “Yes, I’m
Over 18”.
44
Correspondence from Reddit to the ICO, dated 1 March 2024 (p. 9).
30 years 2021-2023 that “the vast majority of Reddit users (~96%)
are older than 18, and nearly 99% are over 13”. 51
63. Reddit has estimated that it had approximately unique
daily active users in the UK in 2022. 52 Consequently, even if the
number of child users represented only a small proportion of this
total, that could translate into a significant number of children
accessing the Platform in absolute terms in that year (and in any
other year during the Relevant Period for which comparable
numbers of users accessed the Platform).
64. Using a range of publicly available resources, the ICO has produced
its own estimates of the number of users between the ages of 13-
17 and under 13 years old who are likely to have accessed Reddit
during the Relevant Period (Annex 2). While consistent data is not
available for the years 2018-2019 and there is no equivalent data
yet published for the year 2025, the ICO’s estimates cover the
majority of the Relevant Period, and as such provide an indication
of the number of child users on the Platform during the Relevant
Period.
65. According to the ICO’s estimates for the years 2020-2024, the
number of Reddit users 53between the ages of 3 and 12 ranges
between 136,191 and 304,182 each year. The number of Reddit
users aged between 13 and 17 ranges between 209,765 and
349,590 each year during the same period. Furthermore, during the
five-year period from 2020-2024, the ICO estimates that the
Reddit also referred to a 2021 report by Common Sense Media, which focuses only on
teenage users in the USA, indicating that 98% of those between the ages of 13 and 18
in the US prefer platforms other than Reddit.
51Correspondence from Reddit to the ICO, dated 1 March 2024 (p. 2).
52Correspondence from Reddit to the ICO, dated 3 May 2022.
53As explained in detail in Annex 2, these results are based on survey data relating to
websites which parents identified their children as “using”.
32 number of children (being the combined number of children in the
age ranges 3-12 and 13-17) accessing Reddit has exceeded 450,000
in each year.
54
66. Moreover, the data to which Reddit referred in response
to enquiries from the ICO indicates that the number of child users
of Reddit during the Relevant Period was significantly higher. As
outlined at section 6 of Annex 2, the estimated number of child
users of Reddit in the UK in September and December 2023 — based
on reports when cross-referenced with monthly user
projections taken from Ofcom’s Online Nation Report 2024 — ranged
between and The ICO does not possess sufficient
information about proprietary technologies which were
used to produce these estimates to assess the reliability of these
figures and therefore the weight that can be placed on them. The
Commissioner nonetheless notes that the sources relied upon by
Reddit indicate that a significant number of children accessed the
Platform during the Relevant Period, regardless of which dataset
more accurately reflects the number of children using Reddit’s
Platform.
67. The estimates summarised in paragraph 65 above (and further
particularised in Annex 2 of this Penalty Notice) were put to Reddit
in the NOI, in response to which Reddit asserted in its
Representations that:
a) it is implausible that many children aged 7 or below would use
the Platform in the light of the “text-heavy content of Reddit’s
service”;
54
See correspondence from Reddit to the ICO dated 22 September 2022.
33 b) user number estimates for later years could not be considered
representative of the years 2018 and 2019, as the levels of
child use of the internet will likely have been “lower prior to
the 2020 coronavirus pandemic”;
c) the Commissioner’s estimates were contestable and their
relevance to the provisional findings of infringement
insufficiently well explained; and
d) the number of children aged 13-17 years old cannot have
been relevant to the provisional findings of infringement,
which related to the unlawful processing of personal data of
children under 13 years old. 55
68. In respect of these assertions, the Commissioner makes the
following observations:
a) In respect of Reddit’s general point, the Commissioner does
not accept the characterisation of the Platform as being
“primarily text-based”. In fact, several of the Platform’s
features are intended to enable users to engage specifically
with, and scroll through, audio-visual content. For example,
Reddit introduced the Watch feed in or after March 2023,
which is “an option for video lovers to optimize their feed for
56
video content.” The Commissioner has set out an illustration
of Watch feed at Figures 4.1 and 4.2 of Annex 3. Moreover,
Reddit introduced a media search tab in or after October 2023,
which allows users “to browse media results – videos, GIFs,
and images – all at once” and allows users to no longer “need
55The Representations paragraphs 75-77.
56
New Features Aimed at Making Reddit Easier to Use: An Update on Our Product
Priorities Focused on Simplification - Upvoted (accessed 5 January 2025).
34 to scroll through results on the posts tab to find specific
57
media.” The Commissioner has set out an illustration of the
media search tab at Figures 5.1, 5.2, and 5.3 of Annex 3.
b) As set out in Annex 2 of the NOI and this Penalty Notice, the
Commissioner’s estimates of the number of 3–7-year-olds
using the Platform drew upon survey data contained in the
Ofcom Media Literacy Tracker and the Ofcom Children’s Media
Literacy Tracker, in which parents of children in this age
bracket confirmed whether they used the Platform. These
estimates were accordingly based on actual evidence of usage
among children within this age bracket. The Commissioner
does not accept Reddit’s assertion therefore that it is
“implausible” that children in this age bracket used the
Platform. In any event, the key point is that a significant
number of children under 13 years old used the Platform
during the Relevant Period, irrespective of the number of
these who were aged between 3 and 7 years old.
c) The Commissioner accepts that children’s use of the Platform
might conceivably have been lower prior to the coronavirus
pandemic. However, there is no evidence that such use would
have been at a trivially low level.
d) Despite Reddit’s assertion that the Commissioner’s estimates
are “highly contestable”, it is notable that the data
to which Reddit referred in response to the ICO’s enquiries
during the Investigation indicated higher numbers of children
under 13 years old using the Platform than are set out in the
57
New on Reddit - Improved Search Capabilities and Speed, Media Tab, and More -
Upvoted (accessed 5 January 2025).
35 Commissioner’s estimates (see paragraphs 65-66 above and
Annex 2 for an explanation of these) and that Reddit did not
produce its own estimates to counter those which were set out
in the NOI.
e) The number of children aged 13-17 years old who used the
Platform is not relevant to the Processing Infringements, but
it is relevant to the DPIA Infringement given the
Commissioner’s finding that Reddit failed to conduct a DPIA in
respect of the high-risk processing activity of intending to
offer online services directly to children and using the personal
data of children for marketing purposes, profiling or other
automated decision making. 58 During the Relevant Period of
the DPIA Infringement, Reddit intended to offer online
services to children as it permitted children aged 13 and above
to use the Platform without attempting to exclude them under
the terms of the User Agreement, and without attempting to
use any age assurance to prevent such children accessing the
Platform.
69. Therefore, Reddit will have inevitably processed children’s personal
data for marketing purposes as its Privacy Policy makes clear that it
engages in this type of processing as it processes users’ personal
data to “[p]rovide, optimize, target, and measure the effectiveness
of ads shown” on the Platform. It also processed children’s personal
data to “[p]ersonalize services, content, and features that match
59
[user] activities, preferences, and settings”” . Throughout the
Relevant Period, Reddit did not have any means of distinguishing
children from adult users.
58See Examples of processing ‘likely to result in high risk’ | ICO.
59
See Reddit’s Privacy Policy. This policy also acknowledges that it processes users’
personal data for the purpose of “marketing and promoting” its services.
3670. For the reasons set out above, the Commissioner maintains that the
estimates set out in Annex 2 and paragraph 65 above give a reliable
indication of the number of child users of the Platform during the
Relevant Period, such that they continue to inform the conclusions
reached in this Penalty Notice.
(c) Reddit’s approach to age-gating
71. During the Relevant Period, Reddit had no form of age-gating
anywhere on the Platform (despite the ICO identifying the
importance of appropriate age assurance throughout the
Investigation).
72. Reddit prefaced its response of 1 March 2024 to an information
notice issued by the Commissioner dated 31 January 2024 as
follows:
“While we recognize that some peer companies collect self-reported
ages or birth dates from their users to guide their application of child
safety protections, we believe this is not the right approach for
Reddit for a few reasons. First, based on the data we have seen from
third parties like (see attached reports), the vast
majority of Reddit users ( ) are older than 18, and
are over 13. Second, as the ICO and others have recognized,
collection of self-reported age, by itself, has limited effectiveness in
protecting children.
Moreover, privacy and pseudonymity are particularly important to
our users, and requiring them to share additional data about
themselves like age or other personal information could potentially
threaten that pseudonymity and the safety it provides. For example,
37 our user-moderators have expressed concerns that poorly
implemented age collection and verification could have a chilling
effect on communities that rely heavily on anonymity to foster
authentic conversation.
In sum, given the importance of privacy to our users, the vast
majority of whom are adults, we don’t believe it is proportionate to
require all of our users to provide their age to protect the of
our users who may be under 18, especially when such age collection,
by itself, may have limited effectiveness. At the same time, we
recognize that having some form of effective age assurance can be
an important tool in protecting those under 18 who are on our
Platform. Given the state of age assurance technologies, many of
which are still continuing to mature, are not fully proven as effective,
and/or come with their own privacy risks and tradeoffs, and given
the lack of consensus among regulators as to which methods are
required, we are moving cautiously in the name of protecting our
users’ privacy.”
73. Reddit later maintained a similar position to that set out in
paragraph 72 above in its Representations. However, following
Reddit’s 1 March 2024 correspondence quoted above, Reddit
subsequently indicated during the Investigation that its views on the
appropriateness of using age assurance measures on the Platform
had evolved. Following engagement with Ofcom and the ICO,
Reddit: (i) committed to collecting self-declared ages of users “as
60
part of the Reddit account registration process in Q3” of 2025, (ii)
indicated that it planned to require users to “verify that they are 18
or over in order to view mature content”, and (iii) stated that it will
60
Reddit’s accounts operate on the basis of US financial quarters which correspond to
the calendar year, such that Q3 in this context runs from July to September 2025.
38 use “a machine-learning model to proactively identify under 13
users on the Platform”.61
74. As noted at paragraph 60 above, on 14 July 2025, Reddit introduced
a requirement for users to verify their age using facial age
estimation or by providing a copy of an identification document via
a third-party, Persona, as a precondition of accessing ‘NSFW’
content. Reddit also began requesting that users provide their age
when creating an account on its App and said in its Representations
that it will “imminently” add this feature for users who set up an
account via a web browser. 62These measures were implemented
after the Relevant Period.
75. Reddit observed in its Representations that its App has been
classified in the Apple App Store as either 17+ or 16+ during the
Relevant Period, meaning that the App would be blocked
automatically where a parent or guardian had set content
restrictions on their child’s device (in other words, this was reliant
on proactive action on the part of children’s parents or guardians).
However, this will have had no effect on users accessing the
Platform via a web browser, through which medium the same
content is accessible as can be viewed via the App. Nor will it have
affected those who accessed the App through the Google Play Store
and an Android device rather than an Apple iOS device. In any case,
this is not an age-gating measure for which Reddit has oversight.
IV. FINDINGS OF INFRINGEMENT
61Correspondence from Reddit to ICO, dated 31 January 2025 (p. 3); and Reddit
62sponse to draft Children’s Strategy Progress Update (March), dated 25 February 2025.
Representations, paragraph 3(8).
3976. The Commissioner finds that Reddit has infringed Articles 5(1)(a),
6, 8, and 35 UK GDPR for the reasons summarised below:
a) Reddit has been processing the personal data of children
under 13 years old on the Platform unlawfully as, in breach of
the requirement that personal data shall be processed
lawfully, fairly and in a transparent manner in relation to the
data subject (Article 5(1)(a) UK GDPR), the Relevant
Processing was not fair or transparent and none of the lawful
bases set out in Articles 6(1)(a) to (f) UK GDPR apply.
b) In particular, Reddit was not able to rely on consent as its
lawful basis for processing the personal data of children under
13 years old on the Platform in accordance with Article 6(1)(a)
UK GDPR, as it failed to ensure that consent was given or
authorised by the holder of parental responsibility over these
children, and/or was failing to make reasonable efforts to
verify in such cases that consent was given or authorised by
the holder of parental responsibility, taking into consideration
available technology, as required under Article 8 UK GDPR.
c) In respect of the processing of children’s personal data in the
context of the provision of an online service, until January
2025, Reddit failed to carry out a DPIA in accordance with the
requirements of Article 35(1) UK GDPR. This was a form of
processing which was likely to result in a high risk to the rights
and freedoms of individuals, in this case children under 18
years old.
77. In reaching these findings, the Commissioner has had regard to the
detailed matters set out below.
40 (1) The Relevant Periods
78. As set out at paragraph 6 above, the Commissioner’s view is that
the Relevant Periods of the Infringements:
a) began on 25 May 2018, when Reddit’s obligations under the
General Data Protection Regulation (Regulation 2016/679 of
the European Parliament and Council) 63and the DPA came
into effect;
b) in respect of the DPIA Infringement, the Commissioner treats
this as having concluded on 31 December 2024, as explained
in paragraphs 198-210 below; and
c) in respect of the Processing Infringements, the Commissioner
treats these as having concluded on 8 July 2025, as this is the
date on which the Commissioner issued his provisional
findings in the NOI.
(2) Reddit’s status as a controller
79. Reddit was the controller in respect of personal data of UK data
subjects who were either Logged-in Users or Logged-out Users (or
both) of the Platform, because it determined the purpose and means
of the Relevant Processing within the meaning of Article 4(7) UK
GDPR during the Relevant Period.
63The General Data Protection Regulation (2016/679) of the European Parliament and
Council was incorporated into UK domestic law by s.3(1) of the European Union
(Withdrawal) Act 2018 on 1 January 2021 and was renamed the UK GDPR pursuant to
paragraph 2 of Schedule 1 to the Data Protection, Privacy and Electronic Communications
(Amendments etc) (EU Exit) Regulations 2019.
4180. The nature of Reddit’s processing of UK users’ personal data is set
out at paragraphs 47-51 above. Reddit determined the purposes
and means of this processing. In particular, Reddit exercised
decision-making control over the processing of personal data
relating to Logged-out Users and Logged-in Users, including in
relation to the means and purposes of the collection of the personal
data and its further processing. This includes the Relevant
Processing.
81. The Commissioner notes that Reddit’s Privacy Policy identifies
Reddit as the controller for the processing described in this Penalty
Notice.64 The Commissioner understands that no other organisation
has been identified as controller in Reddit’s Privacy Policy during the
Relevant Period. 65
(3) Scope of the UK GDPR and DPA
82. The provisions of the DPA and UK GDPR apply to the processing of
personal data by Reddit during the Relevant Period for the following
reasons.
(a) Material scope
83. Article 2 sets out the material scope of the UK GDPR:
64See the Privacy Policy.
65The privacy policies (all accessed 18 February 2026) of 15 October 2020 (available at
https://www.reddit.com/en-us/policies/privacy-policy-revision-2020-10-15), 12
September 2021 (available at https://www.reddit.com/en-us/policies/privacy-policy-
revision-2021-09-12), 15 November 2022 (available at https://www.reddit.com/en-
us/policies/privacy-policy-revision-2022-11-and, 31 July 2023 (availableat
https://www.reddit.com/en-us/policies/privacy-policy-revision-2023-07did) not
identifya Controller.The Privacy Policy of 15 February 2024 (availableat
https://www.reddit.com/en-us/policies/privacy-policy-revision-2024-02identified
Reddit as the controller.
42 a) Article 2(1) UK GDPR provides that the UK GDPR applies to
“the automated or structured processing of personal data”,
subject to the exceptions set out at Article 2(2).
b) The Relevant Processing was automated processing of
personal data, and none of the exceptions in Article 2(2) UK
GDPR apply.
c) Further, Part 2 DPA also applies to the Relevant Processing by
virtue of section 4(2) DPA. Section 4(2) DPA specifies that Part
2 DPA applies to the types of processing of personal data to
which the UK GDPR applies by virtue of Article 2 UK GDPR,
and supplements, and must be read with, the UK GDPR.
(b) Territorial scope
84. Article 3(2) UK GDPR provides that:
“This Regulation applies to the relevant processing 66 of personal
data of data subjects who are in the United Kingdom by a controller
or processor not established in the United Kingdom, where the
processing activities are related to:
(a) the offering of goods or services, irrespective of whether a
payment of the data subject is required, to such data subjects in the
United Kingdom…”
85. The Relevant Processing falls within the scope of Article 3(2)(a). In
particular:
66Article 3(2A) provides that: “In paragraph 2, “relevant processing of personal data”
means processing to which this Regulation applies, other than processing described in
Article 2(1)(a) or (b) or (1A).” For the avoidance of doubt, the Relevant Processing is not
a form of processing described in Article 2(1)(a) or (b) or (1A).
43 a) The Relevant Processing involved Reddit processing the
personal data of data subjects who are in the UK.
b) Reddit states in its Privacy Policy that it offers “websites,
mobile apps, widgets, APIs, emails, and other online products
and services” to its users. These are “services” for the
purposes of Article 3(2)(a) 67 and it is readily apparent that
Reddit intended to offer them, and did offer them, to users in
the UK during the Relevant Period. 68
c) Reddit’s processing of UK users’ personal data during the
Relevant Period, including the Relevant Processing, was
related to these services. In particular, Reddit’s processing
included gathering personal data from users who were
accessing the Services; processing personal data for the
purposes of providing, maintaining, and improving the
Platform; and processing personal data for advertising
services that were related to the Platform. The Commissioner
considers that all Reddit’s processing activities set out in
paragraphs 47-51 above were related to the service that
Reddit provides, within the meaning of Article 3(2)(a).
86. Moreover, where processing falls within Article 3 UK GDPR, the DPA
also applies to that processing pursuant to section 207 DPA.
67
The Commissioner also notes the European Data Protection Board’s (EDPB) position
that information society services are services for the purposes of Article 3(2)(a):
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), Version 2.1, p. 16,
available at
https://www.edpb.europa.eu/sites/default/files/files/file1/edpb guidelines 3 2018 ter
ritorial scope after public consultation en 1.pdf.
68See Recital 23 UK GDPR.
44(4) Specific protections required for children
87. As recognised at Recital 38 UK GDPR, “[c]hildren merit specific
protection with regard to their personal data, as they may be less
aware of the risks, consequences and safeguards concerned and
their rights in relation to the processing of personal data”. Further,
Recital 58 states that “[g]iven that children merit specific protection,
any information and communication, where processing is addressed
to a child, should be in such a clear and plain language that the child
can easily understand”. These are part of the objectives of the UK
GDPR, and the obligations in the UK GDPR must be interpreted in
69
the light of it.
88. As well as in the UK GDPR itself, Recital 38 is reflected in the
Children’s Code. It is reflected in Standard 1 of the Children’s Code,
which states: “Best interests of the child: The best interests of the
child should be a primary consideration when you design and
develop online services likely to be accessed by a child.”
89. As required by section 123(4)(b) DPA, the Commissioner also had
regard to the UK’s obligations under the UN Convention on the
Rights of the Child (“UNCRC”) 70 when drafting the Children’s
Code: 71
“The UNCRC recognises that children need special safeguards and
care in all aspects of their life and requires that these should be
guaranteed by appropriate legal protections. European level data
protection law reflects this and provides its own additional
safeguards for children.
69Eg C G Fry & Sons v Secretary of State for Housing, Communities and Local
Government [2025] UKSC 35, paragraphs 44-49.
70The United Nations Convention on the Rights of the Child.
71In the section entitled “About this code”.
45 In the UK, Parliament and government have acted to ensure that
our domestic data protection laws do truly transform the way we
safeguard our children when they access online services by requiring
the Commissioner to produce this statutory code of practice. This
code delivers on Parliament and the government’s intent to use data
protection law to make a profound and lasting change to how we
look after our children when they access online services.
It takes account of the standards and principles set out in the
UNCRC, and sets out specific protections for children’s personal data
in compliance with the provisions of the GDPR.”
90. The concept of the “best interests of the child” comes from Article 3
of the UNCRC, which provides that: “In all actions concerning
children, whether undertaken by public or private social welfare
institutions, courts of law, administrative authorities or legislative
bodies, the best interests of the child shall be a primary
consideration.” ICO guidance explains that “[t]o consider whether
you are acting in the best interests of children, you must consider
how your use of their data impacts on the range of rights they hold
under the UNCRC.” 72
91. Relevant examples of children’s rights that might be at stake when
children use online services are set out in the ICO’s Children’s code:
best interests framework, which refers to a range of rights children
hold under the UNCRC. These rights include provisions aimed at
supporting children’s needs for:
“● safety;
● health;
● wellbeing;
72
See the ICO’s guidance on the best interests framework.
46 ● family relationships;
● physical, psychological and emotional development;
● identity;
● freedom of expression;
● privacy; and
● agency to form their own views and have them heard.” 73
92. In its Representations, Reddit took issue with the Commissioner’s
references to the UNCRC, relying on R v Secretary of State for Work
and Pensions and Others [2021] UKSC 26 in support of its
contention that the Commissioner had “erred in placing reliance” on
the UNCRC as it does not form part of the law of the UK.74However,
the Commissioner does not treat the UNCRC as being part of the
law of England and Wales, nor does he find that Reddit has infringed
it. Rather, the above references explain the ways in which the
Commissioner had regard to the UNCRC when drafting the
Children’s Code, which, as Reddit acknowledged in its
75
Representations, the Commissioner had a duty to do pursuant to
section 123(4)(b) DPA. Further, the Commissioner has a duty to
take into account relevant provisions of the Children’s Code in
assessing Reddit’s processing of children’s personal data after 2
September 2021 pursuant to section 127(4) DPA.
(5) Infringement of Articles 5(1)(a), 6 and 8 UK GDPR
93. As set out in paragraphs 47-49 above, the personal data processed
by Reddit during the Relevant Period varied according to whether
the Platform was being accessed by Logged-in Users or Logged-out
Users.
73Children’s code: best interests framework | ICO.
74See Representations, paragraph 101.
75See Representations, paragraph 102.
4794. The Commissioner has found that Reddit has infringed Articles
5(1)(a), 6 and 8 UK GDPR for the reasons set out in this Penalty
Notice.
95. In summary, the Commissioner finds that Reddit’s processing of
personal data of children under 13 years old for purposes other than
those outlined at paragraph 9 was not fair or transparent and was
carried out without a lawful basis throughout the Relevant Period.
96. It was not fair or transparent because (i) while Reddit states in its
User Agreement that the Platform is not be to used by children under
13 years old, until 8 July 2025 it had no form of age assurance in
respect of the Platform, and (ii) children under 13 who have
accessed the Platform cannot reasonably be expected to be able to
understand Reddit’s User Agreement.
97. Reddit did not have a lawful basis to process personal data of
children under the age of 13 because none of Articles 6(1)(a) to (f)
UK GDPR are applicable to the Relevant Processing. In particular,
and as set out in more detail in paragraphs 118-183, in respect of
the lawful bases upon which Reddit relies (variously, Articles
6(1)(a), (b) and (f) UK GDPR):
a) Consent can be a lawful basis in respect of Reddit’s processing
of the personal data of data subjects under 13 years old only
insofar as Article 8 UK GDPR is complied with. Reddit has not
complied with Article 8 UK GDPR in relation to the Relevant
Processing.
48 b) Reddit does not enter into a valid contract with children under
13 years old, such that contractual necessity is not an
applicable lawful basis.
c) In circumstances where Reddit does not intend to offer access
to the Platform to children under 13 years old, and in the
context of a complete absence of age assurance measures in
order to access the Platform during the Relevant Period,
Reddit has no legitimate interest in processing their personal
data, save insofar as is necessary for the purposes outlined in
paragraph 9 above.
(a) Legal framework
98. Article 5 UK GDPR sets out the principles relating to the processing
of personal data. These include the following:
“(1) Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation
to the data subject (‘lawfulness, fairness and transparency’);
…
(2) The controller shall be responsible for, and be able to
demonstrate compliance with, paragraph 1 (‘accountability’).”
99. Therefore, “lawfulness”, “fairness” and “transparency” are
cumulative conditions that must be met.
49100. The Commissioner considers that processing of personal data will
not be fair or transparent inter alia if the data subject cannot be
expected to understand the terms on which they are using the
Platform, pursuant to which their personal data will be processed.
101. In order to be “lawful” in compliance with Article 5(1)(a), processing
must comply with Article 6 UK GDPR.
102. Article 6(1) UK GDPR materially provides that processing “shall be
lawful only if and to the extent that” one of six specified lawful bases
applies.76 These lawful bases include the following:
“(a) the data subject has given consent to the processing of his or
her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to
which the data subject is party or in order to take steps at the
request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to
which the controller is subject; …
(f) processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party, except where
such interests are overridden by the interests or fundamental rights
and freedoms of the data subject which require protection of
personal data, in particular where the data subject is a child.”
103. Article 8 UK GDPR materially provides that:
76
The Commissioner has produced guidance for organisations on the requirement for a
valid lawful basis for the processing of personal data.
50 “(1) Where point (a) of Article 6(1) applies, in relation to the offer
of information society services directly to a child, the processing of
the personal data of a child shall be lawful where the child is at least
13 years old. Where the child is below the age of 13 years, such
processing shall be lawful only if and to the extent that consent is
given or authorised by the holder of parental responsibility over the
child.
(2) The controller shall make reasonable efforts to verify in such
cases that consent is given or authorised by the holder of parental
responsibility over the child, taking into consideration available
technology.
(3) Paragraph 1 shall not affect the general contract law as it
operates in domestic law such as the rules on the validity, formation
or effect of a contract in relation to a child.”
104. It is Reddit who bears the burden of proving that there is a lawful
basis for its processing activities.77
(b) Reddit’s stated position
105. Reddit’s Privacy Policy 78 states as follows:
“As required by applicable law, we collect and process information
about individuals in the EEA and UK only where we have a legal
basis for doing so. Our legal bases depend on the Services you use
and how you use them. We process your information where:
77Meta Platforms Inc and Others v Bundeskartellamt, Case C-252/21,
ECLI:EU:C:2023:537, paragraph 95.
78Reddit Privacy Policy.
51 • It is necessary to fulfill [sic] our contract with you, including
to provide, operate, and improve the Services, provide
customer support, personalize features and to protect the
safety and security of the Services;
• It satisfies a legitimate interest (which is not overridden by your
data protection interests), such as preventing fraud, ensuring
network and information security, enforcing our rules and
policies, protecting our legal rights and interests, research and
development, personalizing the Services, and marketing and
promoting the Services;
• You have consented for us to do so for a specific purpose; or
• We need to process your information to comply with our legal
obligations.”
106. Reddit therefore informs data subjects that it variously relies upon
Article 6(1)(a) (consent), Article 6(1)(b) (contractual necessity),
Article 6(1)(c) (legal obligation) and Article 6(1)(f) UK GDPR
(legitimate interests) when processing the personal data of users
who are in the UK.
107. In the course of the Investigation, the ICO sought clarity from Reddit
as to the purposes for which Reddit processed the personal data of
UK users and the lawful bases relied upon for that processing during
the Relevant Period. 79The Commissioner understood from Reddit’s
responses that:
a) Reddit relied on Article 6(1)(f) (overriding legitimate
interests) for “[m]ost” of its personal data processing. 80
79Letter from the ICO to Reddit dated 31 January 2024; Reddit’s response dated 1 March
2024; information notice addressed to Reddit on 11 November 2024; Reddit’s response
80 the information notice dated 18 December 2024.
Reddit’s response dated 1 March 2024.
52 Specifically, it generally relied on this lawful basis when it
processed personal data in order to:
81
i. personalise the Services, content and features;
ii. provide advertising (including through targeting
advertisements); 82
83
iii. “[r]esearch and develop new services”;
iv. “communicate with users about products, services,
offers, promotions events and programs”, as well as
“other news and information [Reddit] think[s] will be
84
of interest to users”;
v. monitor and analyse usage and other trends in
85
connection with Reddit’s Services;
vi. share personal data “with partners and services
providers” . 86
b) Reddit also relied on overriding legitimate interests when it
processed personal data in order to “[h]elp protect the safety
81
Reddit’s response of 18 December 2024 stated that it alternatively relies on Article
6(1)(a) (consent) in relation to this processing and that “[u]sers have a variety of
controls related to these activities in their user settings.”
82Reddit’s response of 18 December 2024 identified that it alternatively relies on Article
6(1)(a) (consent) in relation to this processing.
83
Reddit’s response of 18 December 2024 noted that consent may be sought “depending
on the type of research (such as surveys)”. However, Reddit does not appear to rely
upon Article 6(1)(a) in respect of this processing.
84Reddit’s response of 18 December 2024 further stated that it relies on Article 6(1)(a)
(consent) in relation to this processing.
85
Reddit’s response of 18 December 2024 further stated that it relies on Article 6(1)(b)
(contractual necessity) in relation to this processing “where [the data processing is]
required to provide services described in the Reddit User Agreement” and therefore relies
on its legitimate interest only “where outside the scope of our agreement with the user,
such as with our development platform”.
86
Reddit’s response of 18 December 2024.
53 of Reddit and [its] users”, such as through blocking suspected
spammers and addressing abuse. 87Processing for the purpose
of safety and the protection of Reddit’s users does not
constitute Relevant Processing covered by this Penalty Notice.
It is therefore not considered further in this Penalty Notice.
c) Reddit generally relied on Article 6(1)(b) (contractual
necessity) where processing personal data in order to:
i. “[p]rovide, maintain and improve the Services” 88,
(albeit that this appears to be at odds with the
assertion that Reddit relied on its legitimate interests
as the basis for “most” of its processing, as noted
above);
ii. send technical notices, updates, security alerts,
invoices and other support and administrative
messages to users; 89and
iii. provide customer support.
d) Reddit relied on Article 6(1)(a) (consent) when processing
personal data collected through non-essential cookies (for
advertising and analytics purposes, as set out at paragraph
87Reddit’s response of 18 December 2024 stated in relation to this processing that Reddit
also relies on (i) Article 6(1)(b) (contractual necessity) “where described in the Reddit
User Agreement” and (ii) Article 6(1)(c) (legal obligations) “for processing required to
88mply with applicable law”.
The “Services” are understood to be a reference to the services offered by Reddit to
users in the UK, as identified at paragraph 50 above.
89Reddit’s response to the information notice dated 18 December 2024 stated in relation
to this processing that Reddit also relies on Article 6(1)(c) (legal obligations) for this
processing “in limited circumstances, such as where required for tax purposes”. Insofar
as the processing is carried out in order to comply with applicable law, it is not Relevant
Processing.
54 47(d)(ii) above).
e) Reddit additionally or alternatively relied upon Article 6(1)(c)
(legal obligation), for certain personal data processing
activities. Where processing is carried out in order to comply
with a legal obligation, it is not within the definition of
Relevant Processing for the purpose of this Penalty Notice.
This basis is therefore not considered further in this Penalty
Notice.
108. As set out at Section III(4) above, a significant number of children
used the Platform during the Relevant Period, with approximately
537,000 accessing the Platform in 2024, around 226,000 of whom
were under 13 years old. Reddit, therefore, processed the personal
data of such children in reliance on the lawful bases identified above.
109. In its Representations, Reddit took issue with the scope of the NOI,
submitting that despite the Commissioner’s focus on the “full range
of processing operations” set out at paragraph 107 above, the
Commissioner was in reality only concerned with “processing
entailed in providing the Service to users”, in respect of which Reddit
relied on contractual necessity under Article 6(1)(b) UK GDPR, 90
because, Reddit submitted, the Commissioner has identified no
harm which arose from processing beyond what it describes as
“Service delivery processing”. 91 The Commissioner does not agree
with Reddit’s position in this respect. Harm is not a prerequisite to
the Commissioner making a finding of infringement and deciding to
take enforcement action. The processing of the personal data of
children under 13 years old in a manner which is not fair or
90Representations, paragraph 104.
91Representations, paragraphs 105-106.
55 transparent, and without a lawful basis, infringes fundamental data
protection principles (specifically, Article 5(1)(a)) of the UK GDPR
such that, even if there were no harm caused, or potentially caused
to such users as a consequence of the Relevant Processing (which
the Commissioner does not accept is the case), it would be
appropriate and proportionate for the Commissioner to take
enforcement action.
(c) Findings on lawfulness, fairness and transparency: Article
5(1)(a) UK GDPR
110. In the circumstances of this case, the Commissioner concludes that
Reddit’s processing of the personal data of children under 13 years
old did not have a lawful basis (for the reasons set out in paragraphs
118-183) and was not fair or transparent.
111. Reddit’s offer to provide its Services during the Relevant Period was
made subject to its User Agreement, which provides that “[n]o one
under 13 is allowed to use or access the Services”. Children under
13 years old are thus expressly excluded from the Platform according
to the User Agreement. Reddit’s position is that when it receives a
report that an account holder is under 13 years old, it will ban the
92
account.
112. This exclusion of children under 13 years old from Reddit’s offer
appears to reflect a recognition by Reddit that it would generally
require parental consent to process the personal data of children
under 13 years old under Articles 5(1)(a), 6(1)(a) and 8 UK GDPR
(as set out in more detail in paragraphs 118-126 below). Reddit took
no steps to obtain such consent during the Relevant Period.
92
See Reddit’s letter to the ICO dated 11 August 2023 (response to question 5).
56113. Until 14 July 2025 Reddit had no form of age assurance on the
Platform, and took no steps, or no adequate steps, to enforce the
exclusion of children under 13 years old. To process the personal
data of children under 13 years old, obtained through their use of
the Platform, in these circumstances is an aspect of the unfairness
that the Commissioner finds in this Penalty Notice.
114. Against that context, in order for the processing of personal data to
be fair, the data subject must be in a position to understand the
contractual terms to which they are being asked to agree. In respect
of all children, let alone children under 13 years old, that is
particularly important, as is made clear in Recital 58 UK GDPR, which
states that “[g]iven that children merit specific protection, any
information and communication, where processing is addressed to a
child, should be in such a clear and plain language that the child can
easily understand”.
115. During the Relevant Period children under 13 years old, who were
able to gain access to the Platform because of Reddit’s failure to
operate any form of age assurance, were not in a position to
understand the contractual terms that Reddit asked them to agree
to.
116. In this regard, the Commissioner notes in particular:
a) the facts and matters concerning the User Agreement and
Privacy Policy referred to at paragraphs 53-57 above;
b) the inadequacy of the information provided to the child
regarding the continuing obligations to which they would
become subject under the User Agreement, including, for
example, the grant of “a worldwide, royalty-free, perpetual,
57 irrevocable, non-exclusive, transferable, and sublicensable
license to use, copy, modify, adapt, prepare derivative works
of, distribute, store, perform, and display Your Content
[defined as “text, links, graphics, photos, videos, audio,
streams, software, tools, or other materials” which are
“created with or submitted to the Services by you or through
your Account”] and any name, username, voice, or likeness
provided in connection with Your Content in all media formats
and channels now known or later developed anywhere in the
world” to Reddit;
c) the opacity of the language used in the User Agreement to
communicate such information as is provided, including, for
example, the requirement for users to “agree to defend,
indemnify, and hold Reddit, its affiliates, and their respective,
directors, officers, employees, affiliates, agents, contractors,
third-party service providers, and licensors (the “Reddit
Entities”) harmless from and against any claim or demand
made by any third party, and any related liability, damage,
loss, and expense (including costs and attorneys’ fees) due to,
arising out of, or in connection with: (a) your use of the
Services; (b) your violation of these Terms; (c) your violation
of applicable laws or regulations; or (d) Your Content”; and
d) the fact that many (if not most or indeed all) children under
13 years old would lack the capacity to contract on these
terms, given their complexity and the significance of their
subject matter. Reddit submitted that it is not legitimate for
the Commissioner to consider the capacity of children under
13 years old as a homogeneous group, and that “incapacity
must be specifically proven on the basis of the facts that apply
58 to the individual and time”. 93 The Commissioner does not
agree. Reddit did not dispute that there are children under 13
years old who do not have the capacity to contract. In any
event, even if Reddit is right that an individual examination of
the many thousands of children who used the Platform during
the Relevant Period might reveal some children under 13
years old who could understand the terms of Reddit’s User
Agreement (which the Commissioner does not accept, given
the inadequacy of the information provided and the opacity of
the language used), it is wholly implausible that a large
proportion of children under 13 years old do have capacity to
enter into the User Agreement. Reddit also submitted that “in
order for a contracting party’s incapacity to affect the validity
of their contract, the other party must have knowledge of it:
Imperial Loan Co Ltd v Stone [1892] 1 QB 599, 601”. 94The
Commissioner does not accept this. Reddit cannot rely on its
own failure to apply age-gating on the Platform as a basis for
95
alleging that it lacked knowledge of the age of its users. To
the extent that it does so, this underlines the unfairness of its
conduct in processing the personal data that it obtains as a
result.
117. In summary, the Commissioner finds that – in addition to not having
a lawful basis for the processing of the personal data of children
under 13 years old for the reasons set out in paragraphs 118-183 –
Reddit’s User Agreement was so difficult for child users under 13
years old to understand as to render the processing of their personal
93Representations, paragraph 115(2)(i).
94Representations, paragraph 115(2)(iii)
95In this regard, the Commissioner notes the indication in Dunhill v Burgin [2014]
UKSC 18 that it is relevant to consider what Reddit either knew or ought to have
known.
59 data unfair and non-transparent, in breach of Article 5(1)(a) UK
GDPR.
(d) Findings on consent: Article 6(1)(a) and Article 8 UK GDPR
118. Reddit relied on consent as the lawful basis for its processing of
personal data collected through non-essential cookies for advertising
and analytics purposes during the Relevant Period. This processing
included personal data being used by Reddit and also by third
parties, for targeted advertising, for tracking the efficiency of
advertising campaigns, for building profiles of Reddit’s users, for
delivering advertising on third party websites, and for tracking the
relative popularity of Reddit’s various pages, as set out at paragraph
47(d) above.
119. Article 6(1)(a) UK GDPR applies where “the data subject has given
consent to the processing of his or her personal data for one or more
specific purposes”. Article 4(11) UK GDPR requires that this consent
must be a “freely given, specific, informed and unambiguous
indication of the data subject’s wishes by which he or she, by a
statement or by a clear affirmative action, signifies agreement to the
processing of personal data relating to him or her”. This is a high
threshold for a controller relying on Article 6(1)(a) UK GDPR to meet.
120. Where an ISS is offered directly to a child under 13 years old, Article
6(1)(a) UK GDPR will only apply if and to the extent that consent is
given or authorised by the holder of parental responsibility over the
child (Article 8(1) UK GDPR). This is a clear reflection of the objective
set out in Recital 38 of the UK GDPR, that “Children merit specific
protection with regard to their personal data, as they may be less
60 aware of the risks, consequences and safeguards concerned and
their rights in relation to the processing of personal data”.
121. The Commissioner has concluded that throughout the Relevant
Period, Reddit offered an ISS within the meaning of Article 4(25) UK
GDPR. Reddit’s Platform was provided at a distance, by electronic
means, and at the individual request of its users. Reddit received
remuneration through advertising and through its ‘Premium’
service, as set out at paragraph 44 above. Reddit did not dispute
this in its Representations.
122. Further, the Commissioner has concluded that Reddit offered access
to the Platform directly to children throughout the Relevant Period,
in circumstances where the Platform was made available to all users
without age-gating, where children between 13-17 years old were
allowed to hold accounts under Reddit’s User Agreement, and where
a large number of children under 13 years old created accounts
and/or otherwise used Reddit in the UK (as set out at Section
III(5)(b) above). In reaching this decision, the Commissioner has
had regard to the ICO guidance on the rules about ISS and
96
consent:
“Any ISS which explicitly states that it is for children, or has
children of any age as its target audience is clearly being offered
directly to a child.
The ICO also considers an ISS is offered directly to a child when it
is made available to all users without any age restrictions or when
any age restrictions in place allow users under the age of 18.
96
What are the rules about an ISS and consent? | ICO.
61 If an ISS is only made available to users who are aged 18 and
over then it is not being offered directly to a child. However, if
your ISS states that it has such an age limit then, in the event of
a complaint, we may look for evidence that the limit is applied in
practice, and not just in theory, when deciding whether Article 8
applies. We may consider evidence such as site content, marketing
plans, systems or processes designed to limit access, and
information provided to users, in this respect.
This means that you need to carefully consider your target
audience, and be clear about what age group you intend to allow
to access your ISS. If you decide not to offer your ISS to children
then you need to consider how to mitigate the risk of them gaining
access, using measures that are proportionate to the data
protection risks inherent in the processing.
Because online processing of children’s personal data is likely to
be high risk processing you must use a data protection impact
assessment to help you in this task and to evidence and explain
your approach to processing.”
123. In the light of the above, Article 8(1) UK GDPR applies to the
Relevant Processing insofar as the lawful basis of consent was relied
upon.
124. The Commissioner finds that Reddit failed to comply with Article 8
UK GDPR during the Relevant Period. In the absence of age-gating
on the Platform, it had no means of knowing the age of users who
purportedly gave their consent to their personal data being
processed in the ways set out above. Reddit therefore did not
obtain, and did not even seek to obtain, parental consent for users
62 under 13 years old. As a result, Article 6(1)(a) UK GDPR cannot
provide a lawful basis in relation to the Relevant Processing.
125. In its Representations, Reddit submitted that the NOI did not
suggest that its processing undertaken in reliance on user consent
resulted in any harm to children under 13 years old and that, in any
case, Reddit would be able to rely, in the alternative, on its
legitimate interests (Article 6(1)(f) UK GDPR) as a lawful basis in
respect of this processing as “Reddit pursues legitimate interests in
protecting the Article 8, 10 and 11 ECHR rights of its user base
overall by relying on the consents given by users on the basis of a
representation as to their age, even when such representations are
97
false”. The Commissioner does not agree with Reddit’s position,
as:
a) The Commissioner does not agree that this processing does
not lead to any harm. In the context of the advertising
technology market, personal data is collected, combined, and
used for commercial purposes, often in opaque ways. The ICO
has previously highlighted the risks posed by processing in
this context, including the potential lack of protections for
personal data following disclosure to third parties; and has
noted data subjects’ limited understanding of how personal
98
data is processed for online advertising purposes. The ICO
has previously identified that non-compliant processing in this
context can result in harms ranging from detriment suffered
by individuals to societal harms with collective
consequences. 99
97Representations, paragraph 129.
98ICO – Update report into adtech and real time bidding (20 June 2019), p.9.
99 ICO Opinion – Data protection and privacy expectations for online advertising
proposals, p.18.
63 b) In any event, the present enforcement action would be
appropriate even if damage was unlikely to have occurred.
Like other data protection authorities, 100the ICO considers
that when organisations are relying on user consent in the
advertising technology context, this consent “must be
meaningful”. 101 The infringement addressed in this Penalty
Notice engages fundamental principles of lawfulness, fairness
and accountability. Where consent is being relied upon to
process personal data, it is of fundamental importance that
such consent is validly obtained. If it has not been, then it is
appropriate for the Commissioner to act.
126. In respect of Reddit’s reliance on Article 6(1)(f), this is addressed in
Section IV(5)(f) below, however, in summary for reasons set out in
more detail below, the Commissioner considers that the other bases
for lawful processing set out in Article 6(1) cannot be used as a
means of circumventing the essential protections that are afforded
to children by Article 8, where a controller was required to comply
with Article 8 and has failed to do so. Moreover, retrospectively
switching lawful basis is likely to be inherently unfair to individuals
whose data is being processed and to lead to breaches of
accountability and transparency requirements, including the
requirement in Article 5(1)(a) UK GDPR that personal data must be
processed transparently, and the requirement in Article 13(1)(c) UK
GDPR that controllers provide data subjects with information as to
the legal basis for their processing, at the time when personal data
102
are obtained. Organisations must determine their lawful basis
100See, for example, the APD decision in IAB Europe (dataprotectionauthority.be); and
the CNIL’s Délibération n° 2020-091 du 17 septembre 2020 (cnil.fr) and Délibération n°
2020-092 du 17 septembre 2020.
101ICO Opinion – Data protection and privacy expectations for online advertising
proposals, p.5.
102See also the Commissioner’s guidance: A guide to lawful basis | ICO
64 before starting to process personal data. Accordingly, Reddit cannot
rely on Article 6(1)(f) UK GDPR in the alternative in circumstances
where it has failed to obtain valid consent.
(e) Findings on contractual necessity: Article 6(1)(b) UK GDPR
127. Reddit relied on contractual necessity as being the lawful basis for
its processing of personal data for the purposes of providing,
maintaining and improving the Platform, including sending various
types of communication to users, and providing customer support
during the Relevant Period.
128. Article 6(1)(b) UK GDPR applies only where processing:
a) is necessary for the performance of a contract to which the
data subject is party; or
b) in order to take steps at the request of the data subject prior
to entering into a contract.
129. The Commissioner finds that this lawful basis was not applicable to
the Relevant Processing for the reasons set out below.
Article 6(1)(b) is not available in circumstances where its application
would allow a controller to undermine the policy built into the UK GDPR to
give specific protection to children under 13 years old in relation to the
processing of their personal data
130. Contractual necessity as a lawful basis for processing is to be
interpreted strictly.03 In particular, the Commissioner notes and
103Case C-252/21 Meta Platforms Inc and Others v Bundeskartellamt
ECLI:EU:C:2023:537, at [93]; Case C-394/23 Mousse v. CNIL ECLI:EU:C:2025:2 at
[27].
65 agrees with the conclusion of the European Data Protection Board
(“EDPB”) that there is a need for “a strict interpretation of the Article
6(1)(b) GDPR among other legal bases, particularly to avoid any
104
circumvention of the requirement for consent”.
131. This is of particular importance in the context of processing of
personal data relating to children under the age of 13. One of the
explicit objectives of the UK GDPR is that personal data relating to
children should be afforded specific protection. Article 6(1)(b) must
be interpreted consistently with the objective set out in Recital 38,
and with the legislative scheme as a whole including Articles 5(1)(a),
6(1)(a) and 8 UK GDPR in particular. 105
132. Reddit submits that there are valid contracts under English law
between Reddit and all users under 13 years old who accessed the
Platform during the Relevant Period, which are voidable at Reddit’s
option (not the children’s) on the basis of these young children
having made misrepresentations as to their age: 106
“The user’s confirmation of their age was both a representation upon
which Reddit relied to contract with the user, and an essential term
of Reddit’s contract with the user. A misrepresentation thus gave to
107
[sic] a right on the part of Reddit to avoid the contract.”
133. The Commissioner does not accept this argument, which he
considers incompatible with the purpose of the legislative scheme,
and which if accepted could seriously undermine the protections built
into the UK GDPR to protect children under 13 from having their
104EDPB, Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta
Platforms Ireland Limited and its Facebook service (Article 65 GDPR), 5 December 2022,
105agraph 116.
Eg C G Fry & Sons v Secretary of State for Housing, Communities and Local
Government [2025] UKSC 35, paragraphs 44-49.
106Representations, paragraphs 113 and 114.
107Representations, paragraph 113.
66 personal data processed unlawfully. Reddit’s argument is based on
the crucial premise that children under 13 years old are in the same
position as competent adults to enter into agreements under which
their personal data will be processed, and that if they commit a
misrepresentation concerning their age, or breach an essential
contractual term concerning their age, this renders the contract with
Reddit voidable at Reddit’s option. Article 6(1)(b) UK GDPR should
be interpreted as restricted to cases where the data subject (or
person with parental authority, in the case of a child) was in a
position to make a valid and non-voidable contract with the
controller.
No valid contract between Reddit and children under 13 years old – any
such contract would be contrary to public policy
134. Even if, contrary to the above, Article 6(1)(b) UK GDPR were, in
principle, available in the circumstances of this case, the
Commissioner also considers that there is no valid and enforceable
contract under English law between Reddit and children under 13
years old who accessed the Platform during the Relevant Period, as
the object of the putative contract and its performance would be
illegal and contrary to public policy.
135. For the reasons set out in paragraphs 130-133 above, if English law
were to recognise a valid and enforceable contract in these
circumstances, it would allow Reddit (and potentially other
controllers who provide ISS) to circumvent a key objective of the UK
GDPR (providing specific protection to children). Permitting this
circumvention would be contrary to public policy. 108
108
Patel v Mirza [2016] UKSC 42, paragraph 101 and eg Stoffel & Co v Grondona
[2020] UKSC 42 paragraph 26.
67136. Moreover, for the reasons set out in paragraphs 110-117 above,
Reddit’s processing of personal data of children under 13 years old
is not fair or transparent and therefore in breach of Article 5(1)(a)
UK GDPR, which means that the object and performance of any
putative contract between Reddit and such children is illegal and
contrary to public policy on this account also.
No contract between Reddit and children under 13 years old – no valid
offer by Reddit that is capable of acceptance by children under 13 years
old
137. In any event, Reddit did not make a valid offer 109 to contract with
children under 13 years old which was capable of being accepted by
them during the Relevant Period. 110 That is because Reddit’s offer
to provide its Services is set out in its User Agreement, which
provides that “[n]o one under 13 is allowed to use or access the
Services”. Children under 13 years old are thus expressly excluded
from the group of persons to whom the offer is addressed in the
User Agreement, and Reddit’s position is that when it receives a
report that an account holder is under 13 years old, it will ban the
111
account.
138. A contractual offer may be accepted only by the person to whom it
109In this section, the term “offer” is used to refer to whether there was a valid
contractual offer under English law, as opposed to “the offer of information society
services directly to a child” under Article 8 UK GDPR, which bears an autonomous
meaning (see Article 8(3) UK GDPR).
110See for example, Crest Nicholson (Londinium) Limited v Akaria Investments Limited
[2010] EWCA Civ 1331, at [25], explaining that when “seeking to determine whether or
not a contract has been made at all”, the court will consider whether “a proposal [was]
made by one party (A) which was capable of being accepted by the other (B)”, as to
which “the correct approach is to ask whether a person in the position of B (having the
knowledge of the relevant circumstances which B had), acting reasonably, would
understand that A was making a proposal to which he intended to be bound in the event
of an unequivocal acceptance”.
111See Reddit’s letter to the ICO dated 11 August 2023 (response to question 5).
68 was made, as a general matter. There will be no valid contract if
there was no objective agreement, for example because the offer
was, objectively speaking, made to one person and accepted by
another (e.g. owing to fraud). 112Reddit’s own representations have
sought to suggest that children under 13 years old may be viewed
as having made misrepresentations to Reddit in relation to their age
by using the Service: see paragraph 140 below.
139. In the absence of any offer to contract with children under 13 years
old which is capable of being accepted, Reddit cannot rely on
contractual necessity as a lawful basis for the processing of the
personal data of children under 13 years old.
140. In its Representations, Reddit submitted that its Services are offered
to users on terms “that are intended to apply to any person who in
fact uses the Service” (emphasis in original) and that, accordingly,
“any person who accessed the Service did so on the basis of the
terms, which constituted a binding contract with Reddit. The terms
were thus capable of automatic acceptance by any person using the
113
service, whatever their age”. Reddit says that the correct analysis
114
is that users made a representation , by simply using the Platform,
that they were at least 13 years old:
“The user’s confirmation of their age was both a representation upon
which Reddit relied to contract with the user, and an essential term
of Reddit’s contract with the user. A misrepresentation thus gave to
[sic] a right on the part of Reddit to avoid the contract. A contractual
power of avoidance presupposes the existence of a valid contract
112
See per Goff LJ in Whittaker v Campbell [1984] Q.B. 318 at p.327
113Representations, paragraph 111.
114Reddit submits that users made an implied representation as to their age until 11
September 2021, at which point the wording of subsequent iterations of the user
agreement changed to include an express representation at those using the Platform
were “at least 13” – Representations, paragraph 112.
69 115
and thus undermines, rather than supports, the ICO’s case.”
141. The Commissioner does not agree with Reddit’s position in this
regard. This is because the explicit terms of the User Agreement,
which state that the Service is only to be used by those who are 13
years old and over, make clear that they are intended to apply,
objectively speaking, to any person who legitimately uses the
Service, i.e., those over 13 years old.
142. If Reddit were to be correct and its User Agreement were indeed
capable of being accepted by children under 13 years old,
notwithstanding its explicit terms, then the Commissioner considers
that this too underlines the unfairness of Reddit’s processing
activities in relation to the personal data of children under 13 years
old during the Relevant Period.
Conclusion on Reddit’s reliance on contractual necessity as a basis for
processing
143. In the light of the above, the Commissioner finds that Article 6(1)(b)
UK GDPR (contractual necessity) did not apply as a lawful basis for
the Relevant Processing during the Relevant Period.
(f) Findings on legitimate interests: Article 6(1)(f) UK GDPR
144. As outlined at paragraph 107(a) above, Reddit has stated that
“[m]ost” of its processing of the personal data of its users (including
those under 13 years old) during the Relevant Period — which
included processing for the purposes of personalising the Services
and providing targeted advertising — was necessary for the
70 purposes of its legitimate interests pursuant to Article 6(1)(f) UK
GDPR.
145. As explained at paragraph 102 above, Article 6(1)(f) UK GDPR
applies where “processing is necessary for the purposes of the
legitimate interests pursued by the controller or by a third party,
except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is
a child” (see Section IV(4)).
146. In order for processing to be necessary for the purposes of a
legitimate interests pursuant to Article 6(1)(f) UK GDPR, three
cumulative conditions must be satisfied:
a) there must be a legitimate interest which is being pursued
(the “purpose test”);
b) the processing must be necessary for that purpose (the
“necessity test”); and
c) the individual data subject’s interests must not override the
legitimate interest (the “balancing test”). 116
147. Legitimate interests as a lawful basis for processing is to be
interpreted strictly. It must be shown that legitimate interests
“cannot reasonably be as effectively achieved by other means less
restrictive of the fundamental rights and freedoms of data subjects,
116Information Commissioner’s guidance on legitimate interests,. See similarly: Case C-
13/16 Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas
pašvaldības SIA "Rīgas satiksme" ECLI:EU:C:2017:336 at [28]; Case C-621/22
Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens
ECLI:EU:C:2024:858 at [37]; and EDPB Guidelines 1/2024 on processing of personal
data based on Article 6(1)(f) GDPR, paragraph 6.
71 in particular the rights to respect for private life and to the protection
of personal data”. 117 And, as per paragraph 130 above, the
Commissioner notes and agrees with the conclusion of the EDPB
that there is a need for a strict interpretation of this lawful basis in
order to avoid any circumvention of the requirement for consent.
148. As set out in paragraph 131 above, this is of particular importance
in the context of processing of personal data relating to children
under the age of 13. One of the explicit objectives of the UK GDPR
is that personal data relating to children should be afforded specific
protection. Article 6(1)(f) must not be used as a means of
circumventing the essential protections of Articles 5(1)(a), 6(1)(a)
and 8 UK GDPR read together with Recital 38. Article 6(1)(f) must
be interpreted consistently with the objective set out in Recital 38,
and with the legislative scheme as a whole, including, in particular,
Articles 5(1)(a), 6(1)(a) and 8 UK GDPR. 118
149. It is Reddit who bears the burden of proving that there is a lawful
119
basis for its processing activities.
150. The following subsections set out the submissions in Reddit’s
Representations regarding the processing in respect of which it
relied on Article 6(1)(f) UK GDPR, before setting out the
Commissioner’s view that Reddit did not satisfy any of the
cumulative conditions in Article 6(1)(f) in relation to the Relevant
Processing and therefore could not rely on legitimate interests as a
lawful basis.
117Case C-708/18 252/21 TK v Asociatia de Proprietari bloc M5A-ScaraA
ECLI:EU:C:2019:1064, at paragraphs 46-47; Meta at paragraph 93.
118Eg C G Fry & Sons v Secretary of State for Housing, Communities and Local
Government [2025] UKSC 35, paragraphs 44-49.
119Meta, paragraph 95.
72Reddit’s Representations: personal data processing in reliance on Article
6(1)(f)
151. Reddit’s position as to exactly what processing it conducts in
reliance on Article 6(1)(f) is not entirely clear.
152. Reddit stated in its Representations that it relied on legitimate
interests as its lawful basis during the Relevant Period where it
processed personal data to:
“(1) Personalise services, content, and features that match user
activities, preferences, and settings (save where user’s consent is
sought for the processing activity in question);
(2) Help protect the safety of Reddit and its users, which includes
blocking suspected spammers, addressing abuse, and enforcing the
Reddit User Agreement and other terms and policies (save where
the processing is described in the User Agreement or is necessary
for compliance with a legal obligation);
(3) Provide, optimise, target, and measure the effectiveness of ads
shown on Reddit’s services (save where the user’s consent is sought
for the processing activity in question);
(4) Research and develop new services (save where the user’s
consent is sought for the processing activity in question);
(5) Communicate with users about products, services, offers,
promotions, events, and programs, and provide other news and
information Reddit thinks will be of interest to users (save where the
user’s consent is sought for the processing activity in question);
(6) Monitor and analyse trends, usage, and activities in connection
with Reddit’s services (save where such processing is required to
provide the services Reddit is contracted to provide under the User
73 Agreement).” 120
153. This account differs in one material respect from Reddit’s 18
December 2024 response to an information notice given by the
Commissioner (which is included in the summary of Reddit’s
processing activities in paragraph 107 above). Reddit makes no
reference in this section of its Representations to sharing personal
data with partners and service providers in reliance on Article 6(1)(f)
UK GDPR, despite Reddit stating in its response to an information
notice during the Investigation that it “share[s] data with third
parties only where we have a legitimate interest and rely on that
lawful ground”. 121
154. Reddit does, however, later state in its Representations that, in
circumstances where it had not obtained valid consent from such
users, it relied on Article 6(1)(f) UK GDPR for the processing of non-
essential cookies set on the devices of children under 13 years
122
old , which involved the sharing of these users’ personal data with
third-parties who may build profiles of their interests, as set out at
paragraph 47(d)(ii) above. This amounts to a tacit
acknowledgement by Reddit that it cannot rely on consent in respect
of this processing activity insofar as it relates to children under 13
years old and is in tension with its repeated refrain in its
Representations (replicated at paragraph 152 above) that it did not
rely on Article 6(1)(f) UK GDPR “where user’s consent is sought for
123
the processing activity in question” . The Commissioner reiterates
his view (set out in paragraph 126 above) that switching lawful
bases in this manner is, in any case, inherently unfair to users of
120Representations, paragraph 121.
121Reddit’s response of 1 March 2024 to the Commissioner’s information notice dated
31 January 2024.
122Representations, paragraph 129.
123Representations, paragraphs 121(1)-(6).
74 the Platform.
155. It is therefore unclear to what extent Reddit relied on Article 6(1)(f)
UK GDPR for the sharing of users’ personal data with third parties
and whether this comprised solely of personal data obtained by
Reddit using non-essential cookies or whether Reddit was also
sharing such data with third-parties via another mechanism during
the Relevant Period. The Commissioner considers that, in either
case, the sharing of the personal data of children under 13 years old
with unidentified third-parties is a significant source of risk to these
users.
Reddit’s Representations: submissions regarding its reliance on Article
6(1)(f)
156. Reddit explained the basis for its reliance on Article 6(1)(f) UK GDPR
to process the personal data of children under the age of 13 during
the Relevant Period in the following way:
a) Reddit submitted that it had a legitimate interest, in
processing personal data as “part and parcel of operating a
safe and successful online business”. 124 Processing activities
that are conducted for the purposes of safety are not within
the definition of Relevant Processing, and as such they are not
part of the infringements found in this Penalty Notice. The
legitimate interest relied upon of running a successful online
business is addressed below.
b) Reddit submitted that this legitimate interest extended to
processing the personal data of children under 13 years old,
as it relates to “each user who has declared themselves to be
124
Representations, paragraph 122.
75 at least 13” (original emphasis), as there is “no principle of
data protection law that a controller is required to assume,
without proof to the contrary, that those with whom they deal
125
are acting in bad faith” .
c) Reddit submits that it had further legitimate interests in
protecting “the Article 8, 10, and 11 ECHR rights of Reddit’s
users above the age of 13”. Reddit submits that this gave it
reason to rely on children’s representations as to their ages,
as if it “instead sought to collect users’ age data and/or verify
their age through the use of facial recognition, identity
documents, or other similar methods, it would inevitably have
(i) interfered with the Article 8 privacy rights of a highly
privacy-conscious user base in a context where privacy and
pseudonymity are core values, (ii) interfered with users’
Article 10 rights by deterring them from imparting and
receiving information on the platform, and (iii) interfered with
users’ Article 11 rights by disrupting the Reddit communities
that rely on minimal data collection, and so maximum privacy,
126
to survive and thrive” .
d) Reddit submitted that the interests and fundamental freedoms
of children under 13 years old were overridden by Reddit’s
legitimate interest in processing their data, as “the risks to
Underage Users’ interests and freedoms are significantly
overstated” by the Commissioner in the NOI. Reddit submitted
that:
i. the Commissioner has failed to identify “harm or risk
125
126Representations, paragraph 124.
Representations, paragraph 125.
76 of harm to Underage Users, or anyone, flowing from
targeted advertising or personalisation”;
ii. it had specific safeguards to prevent access to NSFW
content in place throughout the Relevant Period (with
further “specific safeguards” introduced after the end
of the Relevant Period), in addition to Reddit’s
processing being “extensively safeguarded”
generally; and
iii. “Reddit does not target advertising at under-18 users
by reference to age, not least because it has not
traditionally collected age data from users”.127
e) Finally, Reddit also submitted that the Commissioner is
incorrect to contend that Reddit cannot rely on Article 6(1)(f)
UK GDPR in the absence of a child-specific legitimate interests
assessment as:
i. the UK GDPR imposes no requirement to complete a
legitimate interests assessment;
ii. “Reddit can demonstrate that it has a lawful basis for
the processing in question absent a prior legitimate
interests assessment”; and
iii. “[e]ven if there had been a formal requirement to
conduct a legitimate interests assessment, a failure
to conduct such an assessment could hardly warrant
enforcement action given that the balance of
127
Representations, paragraph 126(1)-(5).
77 legitimate interests tipped clearly in favour of there
128
being a lawful basis under Article 6(1)(f)”.
157. The Commissioner does not accept Reddit’s submissions for the
reasons set out below.
Purpose test: does Reddit have a legitimate interest in processing personal
data of children under 13 years old?
158. The legitimate interests identified by Reddit were:
a) its own interests in “running a successful online business”;
and
b) the interests of its other users, over 13 years old, in not being
troubled by age-verification.
159. The Commissioner considers that Reddit was not pursuing any
legitimate interest when it processed the personal data of users
under 13 years old for the Relevant Processing. That is because
Reddit had decided to specifically prohibit those individuals from
using the Platform. Reddit’s interest in running a successful business
cannot extend to carrying out the Relevant Processing in relation to
children under 13 years old when it expressly stated in its User
Agreement they were not allowed to use its services during the
Relevant Period. Processing the personal data of such children was
not envisaged as forming part of the business Reddit was intending
to run.
160. The Commissioner’s guidance on legitimate interests explains that
“[s]howing that you have a legitimate interest does mean… that you
128
Representations, paragraph 127(1)-(3).
78 (or a third party) must have some clear and specific benefit or
outcome in mind. It is not enough to rely on vague or generic
business interests. You must think about specifically what you are
trying to achieve with the particular processing operation.” 129 The
EDPB Guidelines similarly state that an interest will only be
legitimate if it is “clearly and precisely articulated. The perimeter of
the legitimate interest pursued must be clearly identified in order to
ensure that it will be properly balanced against the interests or
fundamental rights and freedoms of the data subject” 130. These
guidelines build upon the Article 29 Working Party’s earlier guidance
addressing the legitimate interests of controllers, in which it was
made clear that an ”interest must be sufficiently clearly articulated
to allow the balancing test to be carried out against the interests
and fundamental rights of the data subject”. 131
161. Reddit has identified the perimeter of this particular legitimate
interest by excluding children under 13 years old from its offer in
the User Agreement. It clearly did not have any specified legitimate
interest in the Relevant Processing because it was expressly seeking
not to process the personal data of users under 13 years old (still
less for any specific aim) as its User Agreement states that “[n]o
one under the age of 13 is allowed to use or access the Services”.
162. Moreover, the Commissioner does not accept Reddit’s submission,
summarised at paragraph 140 above, that it was entitled to rely on
children accessing the Platform having made representations as to
their age. This is because, throughout the Relevant Period, these
children did not make any representation as to their age, as Reddit
129
Available at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-
resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/.
130EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
(adopted 8 October 2024), paragraph 17.
131WP29 Opinion 06/2014 on the notion of legitimate interests of the controller under
Article 7 of Directive 95/46/EC (WP 217, adopted on 9 April 2014), p. 24.
79 had no age assurance measures in place which might have required
them to do so. Reddit cannot rely on its own failure to put in place
appropriate measures to ascertain the age of its users to found a
legitimate interest in processing those users’ personal data. Nor
does the mere fact that children under 13 years old actually
accessed the Platform amount to a representation by the children
concerned that they were at least 13 years old.
163. If Reddit were to be correct, and the simple fact of children under
13 years old accessing the Platform were to amount to a
representation that gave rise to Reddit having a legitimate interest
in processing their personal data in order to ‘run a successful
business’, then the Commissioner considers that this too underlines
the unfairness of Reddit’s processing activities in relation to the
personal data of children under 13 years old during the Relevant
Period.
164. The Commissioner also does not accept that Reddit was entitled to
rely on Article 6(1)(f) UK GDPR in order to process the personal data
of children under 13 years old as a means by which to protect the
putative ECHR rights of its wider user base, who might otherwise
have been required to provide additional personal data in order to
pass through age assurance measures and access the Platform. This
is because:
a) The putative ECHR rights on which Reddit relies are qualified
rights. Any interference with those rights that age assurance
measures might have comprised could and would have been
justified.
80 b) This is not listed by Reddit in its Privacy Policy 132 as a
legitimate interest that it will pursue, and nor was any other
attempt made to communicate to users that this was a
legitimate interest being pursued by Reddit, which is a
requirement of Article 13(1)(d) UK GDPR.
c) As such, children under 13 years old who accessed the
Platform during the Relevant Period could not reasonably
expect that their personal data would be processed for this
purpose. Recital 47 to the UK GDPR makes clear that “the
existence of a legitimate interest would need careful
assessment including whether a data subject can reasonably
expect at the time and in the context of the collection of the
personal data that processing for that purpose may take
place”.
d) Moreover, in the context of complying with Article 6(1)(f) UK
GDPR, the importance of using children’s data in a manner
which is transparent and for foreseeable purposes is clear
from the references to the Meta judgment, Recital 38 and the
ICO’s guidance on legitimate interest set out at paragraph 173
below. The Commissioner does not consider that processing
the personal data of children under 13 years old for a purpose
entirely unrelated to their use of the Platform (i.e., the
protection of the ECHR rights of the wider user base) accords
with the requirement to afford such children specific
protections or to guard them against risks and consequences
132Reddit Privacy Policy – in respect of processing based on purported legitimate
interests, the policy states: “We process your information where… It satisfies a legitimate
interest (which is not overridden by your data protection interests), such as preventing
fraud, ensuring network and information security, enforcing our rules and policies,
protecting our legal rights and interests, research and development, personalizing the
Services, and marketing and promoting the Services…”.
81 they may not fully appreciate.
165. Accordingly, the Commissioner’s view is that Reddit failed at the first
limb of the legitimate interests assessment, in that it did not have a
legitimate interest in processing the personal data of children under
13 years old during the Relevant Period where those children were
prohibited from using the Platform.
Necessity test: is it necessary for Reddit to process the personal data of
children under 13 years old?
166. Even if (contrary to the above) Reddit could establish a legitimate
interest in carrying out the Relevant Processing in relation to
children under 13 years old, despite expressly seeking to prevent
children under 13 years old using the Platform, it would, in any
event, fail the necessity test.
167. As indicated in paragraph 147 above, it must be shown that
legitimate interests “cannot reasonably be as effectively achieved
by other means less restrictive of the fundamental rights and
freedoms of data subjects, in particular the rights to respect for
private life and to the protection of personal data guaranteed by
Articles 7 and 8 of the Charter”. 133 The ICO’s guidance 134 on
legitimate interests for organisations has made clear that
‘necessary’ for the purposes of a legitimate interests assessment
“means that the processing must be a targeted and proportionate
way of achieving your purpose. You cannot rely on legitimate
interests if there is another reasonable and less intrusive way to
achieve the same result”.
133Case C-708/18 252/21 TK v Asociatia de Proprietari bloc M5A-ScaraA
134I:EU:C:2019:1064, at paragraphs 46-47; Meta at paragraph 93.
Legitimate interests | ICO
82168. Processing the personal data of children under 13 years old was not
a targeted means of either ensuring Reddit’s business ran properly,
or protecting the ECHR rights of users aged 13 and over. Both of
these aims could reasonably have been achieved, as effectively, by
other means that were less restrictive of the rights of children under
13 years old.
169. Neither was doing so proportionate where the personal data of
children under 13 years old was being processed for the purposes
of, inter alia, personalisation of content and targeted advertising
(forms of processing likely to result in a high risk to the rights and
freedoms of individuals) in circumstances where, due to a lack of
age assurance, Reddit could not identify each under-13 user and,
consequently, could not prevent them being subjected to
personalisation of content and targeted advertising, including
inappropriate and potentially harmful content. 135
170. Finally, doing so was not proportionate where such processing
included the processing, transfer and storage of information “in and
to” the United States and other countries. 136
Balancing test: does Reddit’s interest override that of an individual under
13 years old?
171. In any event, the balancing test was not met in respect of the
Relevant Processing, irrespective of any legitimate aim which Reddit
might have sought to rely upon.
172. The balancing test requires the controller to take into account “the
interests or fundamental rights and freedoms of the data subject
which require the protection of personal data” and ensure that they
135
136Examples of processing ‘likely to result in high risk’ | ICO
Reddit Privacy Policy – How We Use Your Information
83 do not override the relevant legitimate interests. The ICO’s guidance
on legitimate interests explains that the balancing test involves
consideration of:
a) the nature of the personal data being processed (for example,
whether it is children’s personal data);
b) the reasonable expectations of the data subject; and
c) the likely impact of the processing on the data subject and
available safeguards to mitigate negative impacts. 137
173. Where the processing relates to children’s personal data, the
balancing test must take full account of the particular rights and
interests of children:
a) Article 6(1)(f) specifically provides that particular regard must
be given to the overriding interests, fundamental rights and
freedoms of a data subject where the data subject is a child.
b) That is reinforced by Recital 38, which makes clear that it is
one of the objectives of the UK GDPR that children should be
afforded specific protection. This states that: “Children merit
specific protection with regard to their personal data, as they
may be less aware of the risks, consequences and safeguards
concerned and their rights in relation to the processing of
personal data. Such specific protection should, in particular,
apply to the use of personal data of children for the purposes
of marketing or creating personality or user profiles and the
collection of personal data with regard to children when using
137Information Commissioner's guidance on legitimate interests; EDPB Guidelines also
identify these as key considerations - EDPB Guidelines 1/2024 on processing of personal
data based on Article 6(1)(f) GDPR, paragraph 32.
84 services offered directly to a child”.
c) Recital 75 further states that: “The risk to the rights and
freedoms of natural persons, of varying likelihood and
severity, may result from personal data processing which
could lead to physical, material or non-material damage, in
particular where personal aspects are evaluated, in particular
analysing or predicting aspects concerning… personal
preferences or interests… in order to create or use personal
profiles” or where “personal data of vulnerable natural
persons, in particular of children, are processed”.
d) The CJEU in Meta 138 noted that “it is apparent from the very
wording of point (f) of the first subparagraph of Article 6(1) of
the GDPR that it is necessary, in such a balancing exercise, to
pay particular attention to the situation where the data subject
is a child. According to recital 38 of that regulation, children
merit specific protection with regard to the processing of their
personal data because they may be less aware of the risks,
consequences and safeguards concerned and of their rights
related to such processing of personal data. Thus, such
specific protection should, in particular, apply to the
processing of personal data of children for the purposes of
marketing or creating personality or user profiles or offering
services aimed directly at children.”
e) The ICO’s guidance on legitimate interests similarly explains
that: “If [a controller] choose[s] to rely on legitimate interests
for processing children’s personal data [the controller has] a
138
Meta Platforms Inc and Others v Bundeskartellamt, Case C-252/21,
ECLI:EU:C:2023:537, paragraph 111.
85 responsibility to protect them from risks that they may not
fully appreciate and from consequences that they may not
envisage. [The controller] must ensure their interests are
adequately protected and that there are appropriate
safeguards.” 139
f) The Children’s Code also explains (at Annex C) that a
controller relying on legitimate interests to process children’s
personal data has “a particular responsibility to protect
children from risks that they may not fully appreciate and from
consequences that they may not envisage. [The controller]
must ensure their interests are adequately protected and that
there are appropriate safeguards. [The controller must] give
extra weight to their interests, and [the controller] need[s] a
more compelling interest to justify any potential impact on
children.”
g) The EDPB Guidelines state that “in general terms, the legal
basis in Article 6(1)(f) GDPR allows for a proportionate level
of interference with the rights of data subjects, the balancing
test should be recalibrated where the data subjects are
children” 140and that “the interests of children as data subjects
should have high priority and will very often outweigh the
interests of the controller or third parties”. 141 The EDPB
specifically notes that extensive profiling and targeted
advertising activities will, subject to certain limited
exceptions, generally not align with the obligation to ensure
139Information Commissioner's guidance on legitimate interests.
140EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
(adopted on 8 October 2024), paragraph 92.
141EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
(adopted on 8 October 2024), paragraph 94.
86 specific protection of children.42
174. In this case, the Relevant Processing involved the processing of
children’s personal data, including potentially their special category
data (see paragraph 49 above).
175. The Commissioner considers that the likely impacts of the
processing on the data subjects were potentially serious as:
a) As a result of being able simply to access the Platform, in the
absence of any age-gating, children under 13 years old were
able to access potentially harmful content such as that which
is set out in Annex 3.
b) Throughout the Relevant Period, users were able to access
NSFW content by creating an account and simply confirming
they were over 18 (which question was asked at the moment
at which users wishing to view such content had the greatest
incentive to be dishonest – at the point of access to the NSFW
content, as opposed to upon accessing the Platform or during
account creation). This self-declaration involved no form of
verification.
c) Personal data of children under 13 years old was used for
targeted advertising and personalisation (because, without
age assurance, Reddit could not identify under-13 users and,
consequently, could not prevent them being subjected to
targeted advertising and personalisation), without any specific
safeguards against the processing of personal data of children
under 13 years old. 143 Indeed, Reddit’s DPIA regarding
142EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
(adopted on 8 October 2024), paragraph 95.
143See correspondence from Reddit to the ICO, dated 1 March 2024 (p. 10).
87 Personalized Advertising Based on Advertiser-Provided Data
(dated January 2025) acknowledges, as a “Residual Risk”,
that “
” While Reddit points in its Representations to the
existence of restrictions and controls which it has put in place,
that it submits reduced the likelihood of children under 13
years old encountering potentially harmful adverts on the
Platform, Reddit nevertheless did allow advertising of alcohol
and gambling on the Platform. Moreover, Reddit’s DPIA
regarding Processing of Minors’ Personal Data on Reddit (the
“Children’s Data DPIA”) acknowledges, as a Residual Risk
After Mitigation, that
d) During the Relevant Period, Reddit recommended content and
personalised user experiences using a recommender system
which served feed recommendations based on several factors,
including users’ activity on Reddit, their account age (i.e., the
length of time since the account was opened), and their
location setting.144 The Commissioner acknowledges that
content which was labelled by moderators of Reddit as
“mature or sexually explicit is ineligible for recommendation
to users of any age” by the Platform’s content recommender
144
Reddit’s Approach to Content Recommendations (accessed 29 January 2026).
88 system. 145However, this was not the only content which is
potentially harmful to children under 13 years old on the
Platform (as evidenced by Reddit’s own risk assessments
referred to above) and which could have been placed in their
feeds. In any case, Reddit acknowledges in its
Representations that “it is possible to find harmful content on
Reddit, and even to find accessible harmful content which—
despite the best efforts of Reddit and its moderators—has not
been identified as NSFW and/or age-gated”. 146
e) During the Relevant Period, the personal data of children
under 13 years old was transferred outside the UK, and it was
shared with third parties.
176. All of the above took place in circumstances where, as set out in
paragraphs 114-117 above, the User Agreement provided
inadequate information about how children’s personal data would be
used, and was expressed in opaque language that children under 13
years old could not understand. The data subjects would not
reasonably have expected their personal data to have been used in
the ways that it was.
177. Given the Commissioner’s findings on the number of children using
the Platform (as set out in Section III(7)(b) above), there was
therefore a risk of harm to a significant number of children under 13
years old arising from the manner in which Reddit processed their
personal data.
178. The Commissioner considers that even if Reddit had a legitimate
interest in the Relevant Processing, that interest would have been
145
146This is stated several times in Reddit’s CRA (see, for example, p. 21)
Representations, paragraph 83.
89 overridden by the interests of the data subject in these
circumstances (as described in Section IV(4) above).
179. Further, despite the fact that children under 13 years old were using
the Platform, Reddit did not carry out any assessment of whether it
could rely on its legitimate interests to process their personal data.
The ICO’s guidance 147 recommends that organisations document
each stage of the three-part test in order to demonstrate that their
legitimate interests are not overridden by the data subjects’ rights
and interests, in accordance with the accountability principle (Article
5(2) UK GDPR). Reddit was asked by the ICO to provide copies of
any such assessments for the processing of personal data of
children148. In response, Reddit stated that it “does not maintain
copies of LIAs [legitimate interest assessments] for the processing
of personal data of children as the near-total majority of Reddit’s
user base is adults and as Reddit’s provision of its services is based
on contractual necessity” 149. In response to the Commissioner’s
subsequent information notice dated 11 November 2024, Reddit
nevertheless provided certain legitimate interest assessments to the
Commissioner. 150 However, these documents did not assess
whether Reddit had a legitimate interest in processing the personal
data of children under 13 years old at all, and consequently did not
balance Reddit’s putative interest in such processing against the
fundamental rights and freedoms of children under 13 years old.
180. Reddit submitted in its Representations that “the risks to Underage
Users’ interests and freedoms are significantly overstated” in the
NOI, particularly as the Commissioner “has identified no harm or
risk of harm… flowing from targeted advertising or personalisation”
147Information Commissioner's guidance on legitimate interests
148Letter from the ICO to Reddit dated 19 July 2024.
149Letter from Reddit to the ICO dated 6 August 2024.
150Letter from Reddit to the ICO dated 18 December 2024.
90 and Reddit says it put in place safeguards “to prevent under-18
users on the platform from accessing NSFW or mature content”. 151
181. Reddit also took issue with the Commissioner’s presentation of the
evidence of explicit content contained in Annex 3, submitting that
all the evidence therein is current (and purportedly therefore cannot
be considered to be representative of the nature of the content
available on the Platform throughout the Relevant Period), is now
152
subject to age assurance measures, or is subject to “other
153
protective measures to address any risk of harm”.
182. The Commissioner does not agree with Reddit’s position
summarised in paragraphs 180 and 181 above, as:
a) The Commissioner strongly disagrees with Reddit’s contention
that the risks to the rights and freedoms of children under 13
years old who access the Platform are overstated. The risks
set out in paragraph 175 above are significant, and serious.
b) Reddit’s own risk assessments – carried out in response to the
coming into force of the OSA – concluded that there were non-
trivial risks, both to children and to users of the Platform
generally, of experiencing harms related to illegal content as
well as content which is compliant with Reddit’s rules 154. In its
CRA, Reddit assessed there was a ‘ risk to children
related to
151
Representations, paragraph 126.
152These measures were not in place at the time that the NOI was served and were
implemented after the conclusion of the Relevant Period.
153Representations, paragraphs 87-88.
154Eight Platform-wide rules that apply to everyone on Reddit - Reddit Rules (accessed
7 January 2026).
91 . Separately, in its
ICRA, Reddit assessed there was a ‘ risk to its general
user base related to content giving rise to
. Moreover, the CRA was carried out following the
implementa tion of further age assurance on the Platform as a
pre-condition of viewing NSFW content, which will have
materially reduced the risk levels set out above relative to the
Relevant Period.
c) Concerning Reddit’s Representations on Annex 3 more
specifically, the content displayed therein is intended to give
a broad illustration of certain types of potentially harmful
content available on the Platform. The relevance of Reddit’s
suggestion that it might not be representative of content
available on the Platform earlier in the Relevant Period is
unclear in circumstances where it does not dispute that,
throughout this period, Reddit permitted such content on its
Platform. Furthermore, the only other protective measure
155The CRA employs a ‘Risk Matrix’ which operates on the premise that there are four
levels of potential risk to children associated with different forms of content on the
Platform – ‘Negligible’, ‘Low’, ‘Medium’ and ‘High’. These designations are achieved by
inputting two separate scores into the Risk Matrix – on the one hand, assessing the
‘Likelihood’ of encountering the particular risk, which criterion has six separate levels of
severity ranging from ‘Extremely Unlikely’ (1) at the low end to ‘Almost Certainly’ (6)
at the high end; and, on the other hand, assessing the ‘Impact’ of encountering the
particular risk, which criterion also has six separate levels of severity ranging from
‘Negligible’ (1) at the low end to ‘Severe’ (6) at the high end. These separate
assessments are combined to give a total score ranging from 2-12, which produces a
result corresponding to the overall risk of harm associated with that particular content
as follows: ‘Negligible’ for scores of 2-3; ‘Low’ for scores of 4-7; ‘Medium’ for scores of
1560; ‘High’ for scores of 11-12.
The ICRA employs a similar ‘Risk Matrix’ to the CRA as outlined at
footnote 36 above, however, there are only five separate levels of severity ‘Likelihood’
(ranging from ‘Unlikely’ to ‘Almost Certainly’) and ‘Impact’ (from ‘Minimal’ to ‘Severe’)
and three levels of risk to children associated with different forms of illegal content –
‘Low’ for scores of 2-5; ‘Medium’ for scores of 6-8; and ‘High’ for scores of 9-10.
92 Reddit references in relation to protecting children from the
potentially harmful content contained in Annex 3 is Reddit’s
claim that the relevant subreddits where this content is
contained are “tightly moderated”. 157 The Commissioner
accepts that, in principle, well-trained and properly resourced
moderators can be effective after-the-event at removing
content that is illegal or content that violates an ISS provider’s
rules. However, there is nothing to suggest that Reddit
considers that the content in Annex 3 is illegal or that it
violates the Reddit Rules. This is clearly evidenced by the fact
that the Commissioner was able to access and download the
images included in Annex 3. Rather, it is material that is
unsuitable and potentially harmful for children. Moderation
can have some effect in reducing the potential for harm to
children, but in any event, it is largely an after-the-event
approach that means potentially harmful content is available
for a period of time until it is taken down.
d) The limitations of Reddit’s reliance on volunteer moderators
are referred to in paragraph 182(c) above and are also
highlighted by academic research indicating that some
individual moderators are responsible for monitoring over 60
158
subreddits as well as challenges faced when operating with
Reddit’s ‘modqueue’ - “coordination breakdowns within
moderation teams during modqueue review work, interface
limitations that disrupt multi-step actions, inconsistent or
noisy interface signals, and frustration stemming from poor
159
tool integration across Reddit’s multiple interfaces”. The
157Representations, paragraph 88(3).
158"Think about it like you're a firefighter": Understanding How Reddit Moderators Use
the Modqueue, p.13
159Ibid., p.3.
93 extent of the limitations on Reddit’s reliance on its moderation
system to prevent harms arising as a consequence of the
processing of the personal data of children under 13 years old
is highlighted by evidence of the volume of inappropriate
content on its Platform contained in Reddit’s own transparency
160
reports. For instance, the 2020 report indicates that 6%
(233,368,137 pieces of content) of all content generated on
the Platform that year was removed by moderators or Reddit’s
automoderator 161 as a consequence of violating the Reddit
Rules. While, on the one hand, this might point to the
effectiveness of Reddit’s moderation techniques, it also
demonstrates the significant volume of rule-violating content
on the Platform – an observation supported by the
implementation of 307,472 account sanctions that year for
violating rules relating to hateful content, minor sexualisation,
162
harassment, violent content and involuntary porn -
highlighting the risk of children under 13 years old
encountering such content before it is removed, in addition to
the risks posed by similar such content which is missed by
these moderation techniques and content which does not
violate the Reddit Rules but is nonetheless potentially harmful
to children.
e) Since 2022 to the end of the Relevant Period, the majority of
user-generated content on Reddit (and prior to that a
significant proportion of such content) has not been contained
in posts and comments, but rather in chats and private
160Transparency Report 2020 - Reddit (accessed 18 February 2026).
161Automoderator is a tool Reddit’s moderators can customise to automatically filter
specific content in the community for review or to remove posts or comments that
contain certain keywords.
162
Transparency Report 2020 - Reddit (Chart 10. Account sanctions for Content Policy
violation, by type (not including spam or ban evasion)).
94 messages. 163 This content was not subject to the same active
moderation by volunteer moderators as posts and comments
in subreddits, which system Reddit submits is an important
means by which it mitigated the risk of exposure to potentially
164
harmful content for children under 13 years old. Instead,
there was a greater emphasis on users to regulate the content
encountered in this space through the use of user controls,
such as blocking users and controlling which users can send
165
chat requests.
Conclusion on Reddit’s reliance on legitimate interests as a lawful basis
for processing
183. For the reasons set out above, the Commissioner concludes that, in
respect of the Relevant Processing, Reddit unlawfully processed the
personal data of children under 13 years old where it relied on the
lawful basis of legitimate interests because:
a) it had no legitimate interest in processing the personal data of
children under 13 years old where such children were
prohibited from using the Platform;
b) the processing could not be necessary for the provision of a
service which was expressly not offered to children; and
c) in any event, any legitimate interests were overridden by the
children’s rights in respect of the Relevant Processing.
163
Since Reddit began publishing data on the distribution of user generated content in
2021, private messages and chats have accounted for: in 2021, 45.59%; in 2022,
59.51%; in 2023, 60.29%; in 2024, 65.22%; and in the first half of 2025, 63.61% of
such content.
164Representations, paragraphs 61-62.
165Representations, paragraph 63.
95(g) Conclusion on Article 5(1)(a) UK GDPR
184. The Commissioner concludes that the Relevant Processing infringed
Article 5(1)(a) UK GDPR as the Relevant Processing was carried out
without a lawful basis and was not fair or transparent, for the
reasons set out at paragraphs 110-183 above.
(6) Infringement of Article 35 UK GDPR
185. The Commissioner has concluded that Reddit failed to comply with
Article 35 UK GDPR throughout the Relevant Period of the DPIA
Infringement, as it failed to carry out a DPIA in accordance with the
requirements of Article 35(1) UK GDPR, despite engaging in
processing which was likely to result in a high risk to the rights and
freedoms of individuals (Article 35(1) UK GDPR), in this case
children under 18 years old.
(a) Legal framework
186. Article 35(1) UK GDPR provides as follows:
“Where a type of processing in particular using new technologies,
and taking into account the nature, scope, context and purposes of
the processing, is likely to result in a high risk to the rights and
freedoms of natural persons, the controller shall, prior to the
processing, carry out an assessment of the impact of the envisaged
processing operations on the protection of personal data. A single
assessment may address a set of similar processing operations that
present similar high risks.”
96187. Article 35(4) requires the Commissioner to “establish and make
public a list of the kind of processing operations which are subject
to the requirement for a data protection impact assessment”. The
Commissioner has accordingly published non-exhaustive examples
of processing likely to result in high risk.6These examples include
the “use of the personal data of children or other vulnerable
individuals for marketing purposes, profiling or other automated
decision-making, or if you intend to offer online services directly to
children”, such as through “social networks”.
188. The ICO’s guidance on DPIAs 167 is based upon, and complements,
guidelines endorsed by the EDPB. 168 The latter guidelines were
adopted on 4 April 2017 and state that a DPIA will be required where
two or more of nine criteria are met. Those criteria include data
processed on a large scale (for example, across a large number of
data subjects or large geographic area) and data concerning
vulnerable data subjects, including children who “can be considered
as not able to knowingly and thoughtfully oppose or consent to the
processing of their data”.
189. In order to conform with Standard 2 of the Children’s Code,
organisations are required to carry out a “DPIA to assess and
mitigate risks to the rights and freedoms of children who are likely
to access your service, which arise from your data processing. Take
into account differing ages, capacities and development needs and
ensure that your DPIA builds in compliance with this Code.” Section
2 of the Children’s Code further notes that in practice, controllers
offering online services likely to be accessed by children are required
to carry out a DPIA. This is supported by the ICO guidance on the
166Available on the ICO website.
167Data Protection Impact Assessments (DPIAs) | ICO.
168Available from the European Commission website (accessed 18 February 2026), as
initially promulgated by the Article 29 Working Party and endorsed by the EDPB.
97 rules about ISS and consent, which explains that because “online
processing of children’s personal data is likely to be high risk
processing you must use a data protection impact assessment” to
169
“evidence and explain your approach to processing”.
190. Article 35(7) UK GDPR requires that:
“The assessment shall contain at least:
(a) a systematic description of the envisaged processing operations
and the purposes of the processing, including, where applicable, the
legitimate interest pursued by the controller;
(b) an assessment of the necessity and proportionality of the
processing operations in relation to the purposes;
(c) an assessment of the risks to the rights and freedoms of data
subjects referred to in paragraph 1; and
(d) the measures envisaged to address the risks, including
safeguards, security measures and mechanisms to ensure the
protection of personal data and to demonstrate compliance with this
Regulation taking into account the rights and legitimate interests of
data subjects and other persons concerned.”
191. Section 2 of the Children’s Code provides further guidance on how
a DPIA is to be carried out in relation to online services which are
directed at, or are likely to be accessed by, children. The guidance
is provided by reference to seven steps:
a) identifying the need for a DPIA;
b) describing the processing;
169
What are the rules about an ISS and consent? | ICO.
98 c) considering consultation;
d) assessing necessity and proportionality;
e) identifying and assessing risks arising from the processing;
f) identifying measures to mitigate the risks, and
g) signing off, recording and integrating outcomes.
192. The Commissioner notes, in particular, the following points from
that guidance contained in the Children’s Code:
a) The fact that a service is not aimed specifically at children
does not mean that the obligation to carry out a DPIA does
not apply. On the contrary, a DPIA should be carried out where
an online service is “likely to be accessed by children”.
b) The description of the processing should include an
explanation of, among other things, whether the service is
designed for children, “if not, whether children are
nevertheless likely to access” the service, and plans for
establishing the age range of children using the service.
(b) Findings on Article 35 UK GDPR
193. During the Relevant Period, Reddit offered access to its Platform to
children aged 13 and older. In addition, during the Relevant Period
of the DPIA Infringement, it was foreseeable and likely that children
under 13 years old would access the Platform. That the Platform was
likely to be accessed by children, including children under 13 years
99 old, is evidenced by the estimates set out at paragraphs 64-65
above. Indeed, even without carrying out any assessment of the
extent to which children use its Platform, Reddit itself estimated that
approximately of users of its Platform were children and
approximately were under 13 years old between the years 2021-
2023 (paragraph 62 above).
194. Reddit was therefore required to carry out a DPIA in relation to its
processing of children’s personal data, which was high-risk
processing for the reasons set out above. Reddit nonetheless did not
complete a DPIA in relation to its processing of children’s personal
data during the Relevant Period of the DPIA Infringement.
Reddit’s position that it was not required to conduct a DPIA at all
195. Reddit initially took the position that a DPIA was not necessary
because its Platform is “aimed at adults”.70In the Representations,
Reddit maintained that primary position. It submitted that the
Commissioner was wrong to conclude that a child-specific data
protection impact assessment was required. It said firstly that the
Commissioner had failed to take into account that the Service is not
aimed at children, and Reddit “does not target children for
marketing, profiling, or the offer of online services” 171. The
Commissioner rejects these submissions. As set out above at
paragraphs 64-65, children used the Platform during the Relevant
Period of the DPIA Infringement and Reddit does specifically intend
to offer online services directly to children (13-17) as only children
under 13 years old are prohibited from using the Platform.
Moreover, even if Reddit did not specifically target children for
marketing or profiling, as set out above at paragraph 69 its
170
171Correspondence from Reddit to the ICO, dated 6 August 2024 (p. 1).
Representations, paragraph 132(1).
100 marketing and profiling activities did extend to children, given the
absence of age-gating on the Platform, and Reddit made use of their
personal data for these purposes. The Commissioner’s list
(published pursuant to Article 35(4) UK GDPR) of processing
operations likely to result in a high risk makes clear that a DPIA is
required not only in respect of targeting children, but in respect of
”[t]he use of the personal data of children or other vulnerable
individuals for marketing purposes, profiling or other automated
decision-making, or if you intend to offer online services directly to
children” [emphasis added].
196. Next, in the Representations, Reddit submitted that the Service “is
not inherently high risk to under-18 users”, and that the Children’s
Data DPIA finalised in May 2025 found that the risks were low or
medium, and Reddit says that the Commissioner “makes no
criticism of this analysis” 172. For the reasons given above at
paragraphs 175 and 182, the Commissioner considers that the
Service did present a high risk of harm to under-18 users during the
Relevant Period of the DPIA Infringement. Further, the
Commissioner does not reach a conclusion in this Penalty Notice on
whether the Children’s Data DPIA of May 2025 is compliant with
Article 35 or accurately assesses the risks as low or medium.
197. Thirdly, in the Representations Reddit made various submissions
about the construction of Article 35 UK GDPR 17. In particular,
Reddit submitted that Article 35 focuses on the risks arising from
particular types of processing, rather than the risks to particular
classes of data subjects whose personal data may be processed. In
respect of this position:
172
173Representations, paragraph 132(2).
Representations, paragraph 133.
101 a) Insofar as Reddit contends that Article 35 does not require the
preparation of a separate, child-specific assessment
document, the Commissioner agrees. The requirements of
Article 35 must be met in substance. An impact assessment
may meet the requirements of Article 35 while covering
different processing operations, and/or different classes of
data subjects, and assessing the particular risks of processing
children’s personal data does not necessarily require the
preparation of a separate, child-specific document. However,
the substance of the assessment that is conducted must
clearly and fully assess the particular risks to children (as well
as any other risks that the assessment may also cover) if it is
to satisfy the requirements of Article 35.
b) The Commissioner rejects Reddit’s submission insofar as it
contends that Article 35 does not, in substance, require a DPIA
in respect of the activity of processing children’s personal
data. The Commissioner’s published list of the kinds of
processing operations requiring a DPIA as per Article 35(4) is
based on processing likely to result in a high risk. The
Commissioner considers that ”[t]he use of the personal data
of children or other vulnerable individuals for marketing
purposes, profiling or other automated decision-making, or if
174
you intend to offer online services directly to children” , as
listed, is a high-risk type of processing. The fact that personal
data of children (or other vulnerable individuals) was being
processed in the way described in the Commissioner’s
published list pursuant to Article 35(4) triggered an obligation
to complete a DPIA before the processing commenced.
174
Examples of processing ‘likely to result in high.risk’ | ICO
102 c) The Commissioner also rejects Reddit’s submission insofar as
it contends that he has confused the risk of the Platform being
accessed by under-18s and the risk to the rights of data
subjects who do access the Platform. Reddit is, and was,
aware that children were accessing the Platform and that it
was offering the Platform to children between 13-17 years old.
It was processing the personal data of those children,
including for marketing purposes.
Reddit’s submission that it has, in substance, conducted an
assessment of the risks of processing children’s personal data
198. In the Representations, Reddit contended for the first time that it
had conducted extensive impact assessments of its processing
operations at various points in the course of the Relevant Period of
the DPIA Infringement “which... have included risks to the rights
and freedoms of children and/or which have assessed Reddit’s
processing operations for risks which will apply to all users in a
materially similar way” 175.
199. Reddit’s position in the Representations is contrary to the position it
took earlier during the Investigation, which was that Reddit had ”not
conducted a DPIA on the use of personal data of children for
marketing activities or profiling” (until the ”Children’s Data DPIA”
completed in May 2025) because the Reddit Service ”is aimed at
176
adults, not children” .
200. The ICO repeatedly wrote to Reddit during the course of the
Investigation requesting information in relation to DPIAs. In its
175Representations, paragraph 134.
176See Reddit’s letter to the ICO dated 6 August 2024.
103 letter dated 3 September 2021, the ICO asked Reddit “Can you
provide a summary of the action that you have taken during the last
12 months to seek to conform with the requirements of the
[Children’s] code, including whether you have completed a Data
Protection Impact Assessment (DPIA)?”. Reddit responded by letter
dated 29 September 2021 to state that “Reddit routinely performs
DPIAs on existing features and feature improvements that may
impact any user’s privacy, not just children. The existence of the
code, by and large, states what Reddit has been implementing for
years”. No DPIA was provided.
201. The ICO further wrote to Reddit by letter dated 15 April 2022 stating
“Reddit confirmed in its previous response that it frequently carries
out DPIAs. Please provide a copy of the most recent DPIA, prior to
the Code coming into force”. Reddit responded by letter dated 3 May
2022 to say “Reddit internal teams historically have conducted a
privacy review whenever there is any processing of personal
information, regardless of the risk of processing. Currently, the
privacy review is conducted with a centralized privacy impact
assessment including assignees from both the privacy team and the
legal team at Reddit...The privacy impact assessment is part of a
holistic product review where other teams conduct their own
assessment to ensure there is an understanding of the potential
community and safety perspectives, and that our activities fit our
company values.” Again, no DPIA was provided.
202. The ICO again wrote to Reddit by letter dated 29 November 2022,
stating “In your previous responses, when asked about specific
DPIAs carried out in preparation for the code, you have stated that
privacy reviews are a holistic process carried out by relevant internal
teams. Please advise what work was done by any relevant internal
104 teams in preparation for the Children’s Code coming into force,
including outcomes of risk assessments and any changes to internal
processes prompted by the Code’s introduction.” Reddit responded
by letter dated 13 December 2022 to say “Reddit does not conduct
any of the high risk activities described in the Information
Commissioner's opinion on Age Assurance for the Children’s Code.
Nevertheless, prior to the launch of any new product, Reddit’s
product attorneys and privacy team take into account applicable
laws and regulations, including the Children’s Code and UK GDPR.
Indeed, because Reddit values privacy, we have taken into
consideration age appropriate design even prior to implementation
of the Code. Given Reddit’s commitment to privacy, our teams
would raise concerns about UK GDPR, the Code, opinion on Age
Assurance, or any other applicable law during the product review
process. Depending on the nature of the concern, our teams may
choose to remediate or not launch. To date, however, there have
been no such activities proposed, as they would not align with
Reddit’s values.”.
203. The Commissioner then served on Reddit an information notice
dated 31 January 2024 stating “Please provide copies of Reddit’s
current DPIAs which cover the data processing related to Reddit’s
services in the UK. If any previous versions of the current DPIAs
were in place during the Relevant Period, please also provide those
previous versions. If no DPIAs were undertaken, please specifically
confirm that to be the case.” Reddit responded by letter dated 1
March 2024 which attached “a selection of Reddit’s DPIAs” and
explained that “Reddit conducted hundreds of privacy reviews
during the relevant period as part of its vendor and product review
processes, including for consumer products, ads products, safety
products, and others. The attached DPIAs constitute a relevant
105 sample that demonstrate the methodology used as part of our
commitment to the 'privacy by design' principle”. There were 12
DPIAs in total which appeared to have been randomly selected and
provided with the letter dated 1 March 2024. None of those DPIAs
specifically considered the processing of children’s personal data.
204. In response, the ICO wrote to Reddit by letter dated 19 July 2024
to clarify specifically the DPIA position, asking as follows: “Please
confirm whether Reddit has conducted any DPIAs on the use of the
personal data of children or other vulnerable individuals for
marketing purposes, profiling or other automated decision making
or in respect of offering online service directly to children, and if so
please provide copies of the same.” Reddit responded by letter
dated 6 August 2024 to explain that “[b]ecause the Reddit service
is aimed at adults, not children, we have not conducted a DPIA on
the use of personal data of children for marketing activities or
profiling.”
205. On 9 January 2025, the Commissioner’s staff met with
representatives of Reddit at the Commissioner’s office. At that
meeting, it was discussed whether Reddit would produce a DPIA for
the processing of children’s personal data. Reddit said this was
something it was looking to work on and said it could look to
accelerate this process after the meeting.177 On 30 January 2025,
Reddit wrote a letter to the ICO, in which Reddit stated “[W]e’d like
to provide you with updates on the following topics which we
discussed at our meeting: Data Protection Impact Assessment: We
have taken your feedback and are currently conducting a DPIA
relating to children’s access to Reddit. We expect this DPIA to be
completed within the first quarter of 2025...”
177
The ICO’s note of the meeting was sent to Reddit on 15 January 2025.
106206. Following requests from the ICO on 9 and 23 May 2025, Reddit
provided to the ICO a copy of a DPIA of its processing of children’s
data (the “Children’s Data DPIA”), by email sent on 27 May 2025.
207. In the Representations, Reddit refers to “a range of impact
assessments in relation to its processing, which included
178
assessments of the risks to children’s rights and freedoms” . In
particular, Reddit refers to ten such impact assessments. However,
two of the impact assessments appear to be the same (those
numbered 1 and 4, both of which are said to be Exhibit 36 to the
Representations). Three of the impact assessments are the same
documents as versions provided by Reddit’s letter dated 1 March
2024 (see paragraph 203 above). The other six documents were
provided to the ICO for the first time in the Representations.
208. The nine impact assessments provided with the Representations are
listed below:
a)
. Reddit says in the
Representations that this was drafted in January 2025. 179
b) Reddit says in the
Representations that this was originally drafted in December
2024 and amended in February 2025. However, Reddit also
says “Since March 2025, this DPIA has also specifically
discussed impacts on child privacy...”180.
178Representations, paragraph 81.
179Representations, paragraph 81(1).
180Representations, paragraph 81(2).
107 c) . Reddit says in the Representations
that this was originally drafted in May 2024 and was last
updated in June 2025. However, “In 2025, a specific section
on risks to child privacy was added...” 181.
d) . Reddit says in the
Representations that this was originally drafted in January
2025 and updated in February 2025 18.
e) . Reddit says in the Representations
that this is a draft DPIA. The DPIA’s Version History indicates
it was first drafted in March 2025 and last updated in August
2025 183.
f) Reddit says
in the Representations that this was conducted in September
2022 prior to project launch in October 2022. Reddit explains
that “The did not differentiate risks to children
from risks to adults...”184.
g) . Reddit says in the Representations that
this was conducted in April 2023 prior to product launch in
May 2024 and that “The did not
differentiate risks to children from risk to adults...”18.
h) Reddit says in the Representations that this
was conducted in November 2022 ahead of a project launch
in “Q1 2023” and that “The did not differentiate
181Representations, paragraph 81(3).
182Representations, paragraph 81(5).
183Representations, paragraph 81(6).
184Representations, paragraph 81(7).
185Representations, paragraph 81(8).
108 risks to children from risks to adults...”.
i) Reddit says in the Representations that this
was conducted in December 2022 and that “The
187.
did not differentiate risks to children from risks to adults...”
209. Reddit therefore did not conduct a DPIA/PIA which in substance
specifically considered the risks to the rights and freedoms of
children who are likely to access its service, arising from the
processing of their data, until January 2025. The Representations
do not provide a specific date when the documents were prepared,
but for the purposes of this Penalty Notice the Commissioner
assumes, in Reddit’s favour, a date of 1 January 2025.
210. The Commissioner has not reached a conclusion as to whether the
DPIAs conducted by Reddit in and after January 2025 are compliant
with Article 35(7) UK GDPR. However, the DPIAs conducted in or
after January 2025 did at least specifically consider the processing
of children’s personal data. As this Penalty Notice is concerned with
the period in which Reddit had not conducted any DPIA which
specifically considered the processing of the personal data of
children, the Relevant Period of the DPIA Infringement therefore
ends on 31 December 2024.
Reddit’s submission that its DPIA had no effect in practice
211. Finally, Reddit submits in the Representations that even if it had
conducted a child-specific DPIA earlier, it would not have
approached its provision of the Platform or its processing of personal
186
187Representations, paragraph 81(9).
Representations, paragraph 81(10).
109 data differently, and no harm was caused by the absence of such a
DPIA before May 2025. Therefore, in Reddit’s view any infringement
of Article 35 UK GDPR is immaterial or causally irrelevant. 188The
Commissioner rejects this submission:
a) A DPIA is a highly important assessment and an essential part
of a controller’s accountability obligations and should be
carried out prior to the commencement of processing. This is
made clear by the requirements of Article 35, the
Commissioner’s guidance and the Children’s Code. Reddit did
not carry out a relevant DPIA that specifically considered the
processing of the personal data of children until January 2025.
This was despite repeated queries and requests from the ICO
from September 2021 to May 2025. The absence of a timely
DPIA that specifically assessed the risks of Reddit’s processing
of children’s personal data, and a timely consideration of
whether mitigation measures were required on the Platform
prior to processing, was a clear breach of Reddit’s obligations
under Article 35 UK GDPR. This was particularly serious
because in failing to carry out a timely DPIA, Reddit failed to
properly assess the risks to the rights and freedoms of
children inherent in the processing of their personal data,
before it began the processing, despite this being a clear
requirement under the UK GDPR which is reiterated in the
Children’s Code:189
“[…] DPIAs are not just a compliance exercise. Your DPIA
should consider compliance risks, but also broader risks to the
rights and freedoms of children that might arise from your
188
189Representations, paragraph 135.
Age Appropriate Design Code, Data Protection Impact Assessments.
110 processing, including the potential for any significant material,
physical, psychological or social harm.”
b) While Reddit may have concluded, in 2025, that no changes
were required to the Platform or to its processing of personal
data, that conclusion was reached in the light of the facts and
matters that pertained in 2025, including the imminent
introduction of age assurance on the Platform. It does not
follow that Reddit would have reached the same conclusion
had it conducted a DPIA in a timely manner, in the light of the
facts and matters that pertained earlier in the Relevant Period.
Had it conducted a timely DPIA, Reddit may well have
concluded that mitigation measures were required.
212. In the light of the foregoing, the Commissioner has concluded that
Reddit failed to comply with Article 35 UK GDPR from 25 May 2018
to 31 December 2024.
V. DECISION TO IMPOSE A PENALTY
213. For the reasons set out below, the Commissioner has decided to
impose a penalty of £14,472,500 on Reddit in respect of the
Infringements in accordance with section 155(1)(a) DPA.
(1) Legal framework: penalty notices
214. Section 155(1)(a) DPA provides that, if the Commissioner is
satisfied that a person has failed, or is failing, as described in section
149(2) DPA, the Commissioner may, by written notice, require the
person to pay to the Commissioner an amount in sterling specified
in the notice.
111215. When deciding whether to issue a penalty notice to a person, and
when determining the appropriate amount of the penalty, section
155(2)(a) DPA requires the Commissioner to have regard to the
matters listed in Article 83(1) and (2) UK GDPR, in so far as they
are relevant in the circumstances of the case.
216. Article 83(1) UK GDPR requires any penalty imposed by the
Commissioner to be effective, proportionate and dissuasive in each
individual case.
217. Article 83(2) UK GDPR requires the Commissioner to have due
regard to the following factors when determining whether to issue a
penalty notice and the appropriate amount of any such penalty in
each individual case:
a) the nature, gravity and duration of the infringement, taking
into account the nature, scope, context and purpose of the
processing concerned, as well as the number of data subjects
affected and the level of damage suffered by them;
b) the intentional or negligent character of the infringement;
c) any action taken by the controller or processor to mitigate the
damage suffered by data subjects;
d) the degree of responsibility of the controller or processor,
taking into account technical and organisational measures
implemented by them pursuant to Articles 25 and 32;
e) any relevant previous infringements by the controller or
processor;
112 f) the degree of cooperation with the Commissioner in order to
remedy the infringement and mitigate the possible adverse
effects of the infringement;
g) the categories of personal data affected by the infringement;
h) the manner in which the infringement became known to the
Commissioner, in particular whether, and if so, to what extent,
the controller or processor notified the infringement;
i) where measures referred to in Article 58(2) have previously
been ordered against the controller or processor concerned
with regard to the same subject-matter, compliance with
those measures;
j) adherence to approved codes of conduct pursuant to Article
40 or approved certification mechanisms pursuant to Article
42; and
k) any other aggravating or mitigating factor applicable to the
circumstances of the case, such as financial benefits gained,
or losses avoided, directly or indirectly, from the infringement.
218. Section 157 DPA and Article 83 UK GDPR impose a statutory
maximum on the penalty that may be applied to a given
infringement. There are two levels of maximum fine, depending on
the statutory provision that has been infringed. These are referred
to as the “standard maximum amount” and the “higher maximum
amount”. The cases in which the standard and higher maximum
amounts apply are summarised at Annex 2 to the ICO’s Data
113 Protection Fining Guidance, dated March 2024 (the “Fining
Guidance”). 190
219. Paragraphs 220-278 below set out the Commissioner’s
assessment of whether it is appropriate to issue a penalty in
relation to the Infringements set out in Section IV above. This
assessment involves consideration of the factors in Article 83(1) and
(2) UK GDPR. The order in which these considerations are set
191
out below follows the Fining Guidance:
a) seriousness of the infringement (Articles 83(2)(a), (b) and (g)
UK GDPR);
b) relevant aggravating or mitigating factors (Article 83(2)(c)-
(f), (h)-(k) UK GDPR); and
c) effectiveness, proportionality and dissuasiveness (Article
83(1) UK GDPR).
(2) Reddit’s overarching submission that the Commissioner
should exercise his discretion not to impose a penalty in the
circumstances of this case
220. Reddit submitted in its Representations that the Commissioner
should exercise his discretion in this case not to take enforcement
action. In particular, it said that it is important to Reddit that the
Platform should be pseudonymous, and that Reddit had struck a
balance between retaining pseudonymity in order to protect the
ECHR rights of the majority of its users while adopting various risk
mitigation measures such as moderation to protect the rights of
190
191Data Protection Fining Guidance, Annex 2 | ICO.
Data Protection Fining Guidance | ICO.
114 children. Reddit submitted that the Commissioner should not
second-guess that balancing exercise. The Commissioner does not
accept these submissions, for the reasons set out in paragraphs
171-183. None of these submissions therefore displace the
Commissioner’s assessment, set out in detail below, that it is
appropriate to issue a penalty, having regard to the factors in Article
83(1) and (2) UK GDPR and the Fining Guidance.
(3) Seriousness of the Infringements
221. The Commissioner’s assessment of the seriousness of any
infringement includes consideration of:
a) its nature, gravity and duration;
b) whether it was intentional or negligent; and
c) the categories of personal data affected.
The nature, gravity and duration of the Infringements (Article 83(2)(a)
UK GDPR)
222. In assessing the seriousness of the Infringements, the
Commissioner has given due regard to their nature, gravity and
duration.
i. Nature of the Infringements
223. The assessment of the nature of any infringement involves
consideration of the relevant circumstances of the case and the
115 specific provision(s) of the UK GDPR that has/have been infringed.
Relevant circumstances include:
a) whether the infringement prevented the provision concerned
from being applied effectively or prevented the objective it
sought to protect being fulfilled; and
b) whether the infringement is subject to the standard maximum
fine or the higher maximum fine (as to which see paragraph
218 above). 192
224. Taking those matters into account, the Commissioner concludes
that:
a) As set out at Section IV(4) above, children require specific
protection with regard to their personal data. Compliance with
the provisions Reddit is found to have infringed is necessary
to ensure that:
i. processing of children’s personal data is fair (Article
5(1)(a) UK GDPR);
ii. personal data relating to children is processed
lawfully (i.e. only where an appropriate lawful basis
applies), including by restricting reliance on the lawful
basis of consent for children under 13 years old
(Articles 6 and 8 UK GDPR); and
iii. children’s rights are afforded due consideration prior
to high-risk processing (Article 35 UK GDPR).
192
Fining Guidance, paragraph 57.
116 b) The Commissioner finds that, by failing to comply with these
provisions, Reddit failed to ensure that children were afforded
the protections provided by the UK GDPR, as set out at Section
IV(4) above.
c) The infringement of Article 8 UK GDPR is a substantive and
serious breach. The requirement for parental consent is not
merely a technical requirement but is fundamental to the
protection of children under 13 years old online. This is
because a child’s online activities warrant parental oversight
of the nature and quantity of personal data they share and the
content they see on websites and apps, such as the Platform.
Achieving this oversight requires effective compliance with
Article 8.
d) The Infringements include findings of infringement of Articles
5(1)(a) and 6 UK GDPR, which require personal data to be
processed fairly and lawfully. An infringement of either of
these provisions is subject to the higher maximum statutory
penalty,193 which is indicative of a higher degree of
seriousness.
ii. Gravity of the Infringements
225. When assessing the gravity of the Infringements, the Commissioner
has considered the nature, scope and purposes of Reddit’s
processing, as well as the number of data subjects affected and the
194
level of any damage they have suffered. As set out in the Fining
193
194Article 83(5)(a) UK GDPR.
Fining Guidance, paragraph 58.
117 Guidance at paragraph 59, such damage may be physical, material
or non-material and may include actual or potential harm.
226. As to the nature of the processing, the Commissioner has regard to
the fact that the Infringements involved high-risk processing of
children’s personal data.95
227. As to the scope of the processing and the number of data subjects
affected, the number of UK children between the ages of 3 and 12
who were potentially affected by the Processing Infringements
ranged between 136,191 and 304,182 in the years 2020-2024. The
DPIA Infringement relates to a failure by Reddit to conduct an
assessment of the impact of its processing operations insofar as
they related to children and, consequently, the number of UK
children who were potentially affected by this DPIA Infringement
ranges from between 469,291 and 557,639 in the years 2020-2024
(see further Section III(7)(b) and Annex 2).
228. As to the purpose of the processing, the Commissioner has had
regard to the fact that processing of the personal data of children
under 13 years old was not part of Reddit’s main business or
commercial activities during the Relevant Period. Reddit has
nonetheless failed to comply with the UK GDPR in circumstances
where the Platform was made available to children between 13-17
years old, and was likely to be accessed without restriction by
children under 13 years old in circumstances where Reddit did not
have any age assurance measures in place to prevent those children
from accessing the Platform.
229. The need for special protection in relation to children’s personal data
195
These are relevant factors identified in the Fining Guidance, paragraph 59.
118 is explained at Section IV(4) above. The Infringements involved a
failure to comply with provisions of the UK GDPR which, when
properly implemented, would serve to provide those protections.
Consequently, in assessing the level of damage suffered, the
Commissioner has had regard to the extent to which the
Infringements affected children’s rights and freedoms or otherwise
led to them suffering, or being likely to suffer, harm.
230. In April 2025, the Commissioner’s staff undertook a review of the
content available on the Platform. While users have been required
to verify their age as a precondition of accessing NSFW content since
14 July 2025 (as set out at paragraph 60 above), the
Commissioner’s research produced evidence of Reddit’s approach to
age assurance in the context of accessing NSFW content throughout
the Relevant Period. This research found that:
a) While logged-out of a Reddit account, potentially harmful
content related to suicide and eating disorders was returned
in response to entering the search terms ‘r/suicide’ and ‘ED’.
b) When accessing Reddit while logged-in to an account, ‘Mature
196
content’ was off by default on all operating systems,
meaning that content flagged as ‘mature’ would not be
delivered to users in search results or otherwise included as
recommendations to such users. Mature content control
options were found in device settings (iOS) and app settings
(Android).
c) There was a simple toggle within settings which could be used
to switch mature content on, which read: “Show mature
196
The research was conducted using an iOS device and separately using an Android
device, both in the Reddit App and via a web browser (Google Chrome, in the case of
the Android device, and Safari, in the case of the iOS device).
119 content (I’m over 18). See Not Safe for Work mature and adult
content in your feeds and search results.” No age verification
methods were deployed when users used this toggle; users
were required to simply confirm that they were 18 years old
or over.
d) Once mature content was switched to ‘on’:
i. Links to pornographic content which is potentially
harmful to children were returned in response to
entering the search term ‘r/nsfw’.
ii. Such links also appeared in Reddit’s ‘suggested
search’ in response to simply entering the search
term ‘r’19.
iii. The content referred to in sub-paragraphs (i) and (ii)
above was flagged to the user as ‘NSFW’ content.
231. Examples of the potentially harmful content referred to in paragraph
230 above are set out in Annex 3.
232. In the NOI, the Commissioner incorrectly stated that Ofcom’s Online
Nation Report 2024 reported that during the period June 2023 to
June 2024, 8-11% of children had experienced their most recent
‘potentially harmful encounter’ on Reddit. In fact, the actual figure
was 0-1%. The Commissioner acknowledges this mistake which was
made on a straightforward misreading of very similar colours in the
relevant table. The Commissioner has taken this into account in
considering the seriousness of the Infringements in the light of
197The naming convention for Subreddits on Reddit’s Platform is to categorise each
community with a leading ‘r/’, such that a search for ‘r’ brings up a list of suggested
Subreddits below the search bar.
120 Reddit’s Representations.
233. In any event, Reddit’s own risk assessments, as required by the
OSA, conclude that there are non-trivial risks to children of
experiencing harms related to illegal content. In particular, as set
out at paragraph 182(b),
’.
’. However, the CRA was
carried out after the age assurance measures were introduced by
Reddit in July 2025.
234. In addition, the absence of a timely DPIA (until January 2025) which
at least considered the processing of the personal data of children,
and consequently the absence of a timely consideration of whether
mitigation measures were required on the Platform, was serious as
it was a clear requirement of the UK GDPR (see paragraph 211(a)).
235. Further, the terms of the User Agreement were not framed in a way
that children could understand and, as set out at paragraphs 169
and 175(c), included their personal data being processed for the
purposes of personalisation of content and targeted advertising,
forms of processing likely to result in a high risk to the rights and
freedoms of individuals. As Reddit did not use effective age
assurance during the Relevant Period, and its Platform is on its own
case aimed at adults, there was potential for inappropriate content
to be recommended to children under 13 years old. It also included
processing, transfer and storage of information in and to the United
States and other countries, potentially leading to a loss of control of
their personal data.
121236. In the light of the above, the Commissioner concludes that the
Infringements were serious. They involved high-risk processing
activities, in respect of the personal data of a significant number of
children. They led to children whose personal data was unlawfully
processed by Reddit being likely to have seen, or at least being at
198
risk of seeing, content that is potentially harmful to children. The
Commissioner considers that they are likely to have suffered, or to
have potentially suffered, damage as a result of Reddit’s processing
of their personal data.
iii. Duration of the Infringements
237. As stated at paragraph 60 of the Fining Guidance, the longer the
duration of an infringement, the more weight the Commissioner is
likely to attribute to this factor. This is because of the greater
potential for harm to have occurred.
238. As stated at paragraphs 6 and 78 above, the Commissioner has
concluded that the Infringements commenced on 25 May 2018 (the
date of the entry into force of the DPA and GDPR). The DPIA
Infringement concluded on 31 December 2024, when Reddit is
assumed to have completed a risk assessment that specifically
considered the processing of children’s personal data, as set out at
paragraphs 198-210 of this Penalty Notice. The Relevant Period for
198Section 60(2) of the Online Safety Act 2023 lists three types of ‘Content that is
harmful to children’. These have been categorised by Ofcom’s Guidance on Content
Harmful to Children as: ‘Primary Priority Content (PPC)’, which includes pornographic
content, suicide content, self-injury content, and eating disorder content; ‘Priority
Content (PC)’, which includes content which is abusive or incites hatred, violent content,
bullying content, dangerous stunts and challenges content, and harmful substances
content; and ‘non-designated content which is harmful to children (NDC)’, which includes
any other content not included in PPC or PC which “presents a material risk of significant
harm to an appreciable number of children in the UK” (see pp.5-7).
122 the Processing Infringements concluded on 8 July 2025 (the date on
which the Commissioner issued the NOI) and extends to over seven
years.
The intentional or negligent character of the Infringements (Article
83(2)(b) UK GDPR)
239. Where there is evidence of intent on the part of a controller the
Commissioner may regard the infringement as particularly serious.
An infringement is committed intentionally where the evidence
shows the controller knew its conduct was likely to constitute an
infringement of the UK GDPR or DPA, but it either deliberately
continued with the conduct or was indifferent as to whether it
199
infringed the UK GDPR or DPA . As explained in the Fining
Guidance, an infringement is committed negligently where a
200
controller breached the duty of care required by UK GDPR or DPA.
240. The Commissioner has concluded that the Infringements are
negligent, rather than intentional, in nature because:
a) Reddit ought to have been aware that it was processing the
data of children under 13 years old unfairly and without a
lawful basis because no consent had been given or authorised
by the holder of parental responsibility over such child users.
It ought also to have been aware that it was inappropriate to
rely on contractual necessity as a lawful basis for processing
the data of under 13s, in particular because there was no valid
offer made to or contract in place with children under 13 years
old who, in line with Reddit’s User Agreement, were not
permitted by Reddit to be on the Platform. In addition, Reddit
199See paragraphs 64 and 65 of the Fining Guidance.
200See paragraphs 66 and 67 of the Fining Guidance.
123 ought to have been aware that it could not have a legitimate
interest in processing the personal data of children under 13
years old in circumstances where its User Agreement did not
permit such users on the Platform.
b) Reddit ought to have been aware that it was required to
conduct a DPIA in respect of its processing of children’s
personal data.
241. Negligent infringements may still be serious 201 and the Fining
Guidance is clear that the Commissioner may decide to issue a
penalty notice in cases where a controller or processor is found to
have acted negligently.202
242. In reaching his conclusion regarding Reddit’s negligence, the
Commissioner has considered the following matters:
a) Pursuant to Article 24(1) and (2) UK GDPR, controllers are
responsible for implementing appropriate technical and
organisational measures to allow them to demonstrate that
processing is performed in accordance with the UK GDPR,
including through the implementation of appropriate data
protection policies. It follows that Reddit is responsible for
ensuring that its users’ personal data is processed in a lawful
manner (Article 5(1)(a) UK GDPR) and through the use of
appropriate technical and organisational (age assurance)
measures (Article 25(1) UK GDPR) to meet the requirements
of the UK GDPR, namely Article 8.
b) Reddit permitted children over 13 years old to use the
201Fining Guidance, paragraph 63.
202Fining Guidance, paragraph 63.
124 Platform and was aware that children of all ages were in fact
accessing the Platform. Reddit should have considered what
measures were required to prevent children under 13 years
old from accessing the Platform and ensure that Reddit was
not processing their personal data unlawfully.
c) Despite that, Reddit decided not to implement measures to
safeguard children’s rights. It took that view without assessing
whether such safeguards were required under data protection
law and without carrying out a relevant DPIA to assess
potential harms and mitigations.
243. In particular, the Commissioner considers the failure to carry out a
DPIA that specifically considered the risks to the rights and freedoms
of children who were likely to access its service to be at least
negligent on the basis that this is a clear requirement under UK GDPR
for the reasons set out at paragraph 211(a).
Categories of personal data affected (Article 83(2)(g) UK GDPR)
244. The categories of personal data affected by an infringement are
relevant to the assessment of its seriousness. In particular, special
category data (Article 9 UK GDPR), personal data relating to criminal
convictions and offences (Article 10 UK GDPR) and personal data
falling within the definitions of ‘sensitive processing’ in Part 3 and
Part 4 DPA deserve special protection, and the Commissioner is
likely to consider infringements involving the processing of such
data as being particularly serious. 203 Other categories of personal
data in relation to which infringements are likely to be more serious
include location data, private communications, passport or driving
203
Finding Guidance, paragraphs 70-71.
125 licence details, and financial data.04
245. The personal data processed by Reddit in relation to Logged-in Users
and Logged-out Users is described at paragraphs 47-48 above.
246. The Commissioner has had regard to Reddit’s explanation that
geolocation, profiling and data sharing are ‘off’ by default.05
247. The Commissioner has also had regard to his conclusion that Reddit
is likely to be processing some special category data, as set out at
paragraph 49 above.
Conclusion on the seriousness of the Infringements
248. Having considered the nature, gravity and duration of the Processing
Infringements, as well as their negligent nature and the categories
of personal data affected, the Commissioner has categorised the
Processing Infringements as having a high degree of seriousness.
The following factors have been taken into account:
a) The high level of importance of protecting children’s personal
data, as set out in Recital 38 UK GDPR and Standard 1 of the
Children’s Code.
b) The absence of any age assurance measures on the Platform
at account creation or in order to access the Platform
throughout the Relevant Period.
c) The large number of UK children under 13 years old accessing
the Platform, estimated to be about 226,000 users and about
204Finding Guidance, paragraph 72.
205As stated by Reddit representatives during a meeting with ICO staff on 9 January
2025.
126 80,000 account holders in 2024 206.
d) The fact that Reddit was negligent in failing to implement age
assurance measures, despite Reddit being aware that there
were children under 13 years old using the Platform (even by
its own estimate of the number of children using the
Platform 207 between 2021-2023). In its Representations,
Reddit emphasises that there was uncertainty during the
Relevant Period about what age assurance measures might
comprise. 208However, this is not a case where Reddit adopted
ineffective or insufficient age assurance measures - Reddit did
not adopt any age assurance to prevent children under 13
years old accessing the Platform during the Relevant Period
despite its User Agreement prohibiting them from using its
Platform. The Commissioner accepts that approaches to age
assurance have developed over the Relevant Period. This is
not surprising given changes in technology and, indeed, the
UK GDPR accounts for such developments. For example,
Article 8(2) UK GDPR refers to ”taking into consideration
available technology” when making reasonable efforts to
verify that consent is given or authorised by a holder of
parental responsibility, and Article 25(1) refers to “[t]aking
into account the state of the art“. However, as above, Reddit
did not do anything to prevent children under 13 years old
from accessing the Platform beyond stating that the Service
was for those aged 13 and above, despite the Commissioner
raising this with Reddit in September 2021 (see paragraph 25)
The Commissioner does not consider Reddit’s uncertainty
206See Table 2 and Table 4, respectively, in Annex 2.
207Reddit response of 1 March 2024 to information notice dated 31 January 2024:
“…based on data we have seen from third parties like the vast
majority of Reddit users ( ) are older than 18, and are over 13.”
208The Representations, paragraphs 35 and 36.
127 about what age assurance measures to use is an adequate
reason for it not to have introduced any measures during the
Relevant Period to check whether children under 13 years old
were accessing its Platform.
e) The risk of children under 13 years old being exposed to
content that is potentially harmful to children (for example,
pornography and content related to suicide) and of this
content causing significant harm to them, as a consequence
of the Relevant Processing.
f) The personal data of children under 13 years old having been
shared with third parties, used for marketing purposes, used
for profiling purposes, and used for content recommendations
including potentially for recommending further harmful
content, given the absence of age assurance on the Platform.
g) The User Agreement having been framed in a way that
children under 13 years old could not understand it.
h) Reddit’s failure to implement appropriate age assurance
measures to prevent children under 13 years old from
accessing the Platform and thereby prevent Reddit from
processing their personal data unlawfully, in particular given
the Commissioner:
i. raised concerns about the potential presence of
children on the Platform in the light of the standards
set out in the Children’s Code via correspondence
with Reddit dated 13 September 2022; and
ii. raised further questions about the numbers of child
users on the Platform during the Relevant Period, any
128 processes Reddit had in place to remove such users
from the Platform, and any age assurance measures
Reddit had in place via information notices dated 14
July 2023 and 31 January 2024.
i) In addition to the above, the processing of the personal data
of children under 13 years old without a lawful basis, infringes
the fundamental data protection principles (Article 5(1)(a)) of
the UK GDPR. As noted by the Irish Data Protection
Commission and the EDPB, lawfulness of processing is one of
the “fundamental pillars of data protection law… processing of
personal data without a legal basis is a clear violation of the
209
data subjects’ fundamental right to data protection.”
249. In relation to the DPIA Infringement, the Commissioner has
categorised this as having a high degree of seriousness. The
following factors were taken into account:
a) A DPIA is a highly important assessment designed to help
controllers systematically analyse, identify and minimise data
protection risks. As such, DPIAs are an essential part of a
controller’s accountability obligations. DPIAs must be carried
out prior to the commencement of processing where a type of
processing is likely to result in a high risk to the rights and
freedoms of individuals, so that mitigation measures can be
adopted, where necessary, before the processing commences.
The ICO’s guidance and Children’s Code are clear that a DPIA
is required where an ISS provider offers an online service
likely to be accessed by children. However, until January
209
Irish DPC, Meta (Instagram), 2 September 2022, paragraph 543 (citing the EDPB’s
corresponding decision, paragraph 239).
129 2025, Reddit failed to undertake a DPIA specifically in relation
to the processing of children’s personal data, meaning that it
had been engaging in high-risk processing for over six and a
half years without having first carried out a DPIA.
b) The failure to carry out a relevant DPIA until January 2025 is
rendered more serious by the number of children under 13
years old accessing the Platform during the Relevant Period
(estimated to be about 226,000 users and about 80,000
account holders in 2024 210), as well as the fact that children
between the ages of 13 and 17 are likely to have accessed the
Platform and seen content that is potentially harmful to
children as a consequence of Reddit processing their personal
data (see paragraph 175).
c) Reddit was aware that there were children under 13 years old
using the Platform and its User Agreement expressly
permitted children between the ages of 13 and 17 to access
the Platform. Reddit therefore knew (or ought to have known)
that it was engaging in high-risk processing activities, as it
intended to offer online services directly to children, and was
consequently required to carry out a DPIA before the
processing commenced, pursuant to Article 35(1) UK GDPR
211
(see paragraphs 193-212 above).
d) Reddit is a large and sophisticated organisation which is
unlikely to have faced resourcing constraints that would have
210See Table 2 and Table 4, respectively, in Annex 2.
211Reddit response of 1 March 2024 to the Commissioner’s information notice dated 31
January 2024: “…based on data we have seen from third parties like
the vast majority of Reddit users ( ) are older than 18, and nearly are over
13.”
130 prevented it from carrying out a DPIA specifically relating to
the processing of children’s personal data during the Relevant
Period of the DPIA Infringement. Indeed, it submitted to the
ICO that it has conducted “hundreds of privacy reviews” (see
paragraph203 above).
e) The importance of completing a DPIA specifically relating to
the processing of children’s personal data was highlighted to
Reddit by the ICO early on in the Investigation, as far back as
September 2021. 212 Despite that, Reddit did not complete a
relevant DPIA until January 2025.
(4) Relevant aggravating or mitigating factors
Action taken to mitigate the damage suffered by the data subjects
(Article 83(2)(c) UK GDPR)
250. When deciding whether to impose a penalty notice, the
Commissioner will have regard to any action taken by the controller
or processor to mitigate the damage suffered by data subjects
following the infringement. The Commissioner is more likely to take
into account measures implemented prior to the controller or
processor becoming aware of the Commissioner’s investigation as a
mitigating factor. Measures that are only implemented after the
start of the Commissioner’s investigation are less likely to be
213
regarded as a mitigating factor.
212For example, the ICO’s letter to Reddit, dated 3 September 2021, requested
confirmation of whether Reddit had carried out a DPIA in accordance with the Children’s
213e.
Finding Guidance, paragraph 77.
131251. The Commissioner finds that Reddit did not implement appropriate
measures to mitigate the damage suffered by data subjects as a
result of the Infringements prior to the commencement of the
Investigation, or indeed for most of the duration of the
Investigation.
252. During a meeting with ICO staff on 9 January 2025, 214 Reddit
representatives stated that Reddit intended to introduce limited age
assurance in the form of an age-gate to be applied to mature
content for UK users, but did not intend to implement a site-wide
age-gate. During the same meeting, Reddit committed (for the first
time) to carrying out a DPIA for the processing of children’s personal
data.
253. In a letter to the ICO dated 30 January 2025, Reddit advised that:
• “Data Privacy Impact Assessment: We have taken your
feedback and are currently conducting a DPIA relating to
children’s access to Reddit. We expect this DPIA to be completed
within the first quarter of 2025.
• Self-declared age and account-level settings for under
18s: Based on your feedback, we are reviewing options for
implementing a self-declared age gate as part of the Reddit
account registration process, balancing the collection of age with
our data minimization principles and the privacy expectations of
the adult users who make up the vast majority of the Reddit user
base. We hope to roll out this work as part of our broader age
assurance work in Q3. As mentioned, we are also reevaluating
214
See ICO note of meeting as amended by Reddit.
132 our ads personalisation settings, and will ensure, at highest
priority, to minimize data processing for known under 18 users
on the Platform. We will update you when we have more certainty
on the rollout timing.
• Review for under 13 accounts: We have taken your feedback
and are actively experimenting with using a machine-learning
model to proactively identify instances of users asserting they
are <13 on the Platform. We would then investigate accounts
identified by that model, and take action against accounts that
we believe belong to users <13.”
254. In the Representations, Reddit states that it “now uses a third party
age verification tool that requires users to provide photo
identification or a facial image before they can access mature
content. Reddit also now requests that users provide their age at
account sign-up on the Reddit app in the UK, and will imminently be
215
launching the same feature on web”. Later in the
Representations, Reddit states that "In Q3 2025, Reddit began to
roll out the Persona solution [the third party age assurance tool] on
the platform. It also began to request that users enter their age
upon sign-up.” 216
255. The Commissioner notes the above measures and commitments by
Reddit, and the fact that Reddit has now carried out a relevant DPIA.
However, Reddit’s “self-declared age gate as part of the Reddit
account registration process” and its use of “a third party age
verification tool that requires users to provide photo identification or
a facial image before they can access mature content” were both
implemented after the Relevant Period. No relevant DPIA was
215
216Representations, paragraph 3(8).
Representations, paragraph 44.
133 carried out before the Relevant Processing commenced or at any
time during the Relevant Period of the DPIA Infringement. In the
circumstances, the Commissioner considers that there are no
relevant actions taken by Reddit to mitigate the damage, or
potential damage, suffered by data subjects.
256. In the Representations, Reddit submitted that the Commissioner
has not fully considered Reddit’s purported mitigating factors 217. In
particular, Reddit submitted that the Service is targeted at adults,
and only 1% of users are aged under 13. However, as set out in
paragraph 68(e), throughout the Relevant Period, Reddit intended
to offer online services to children, as it permitted children aged 13
and above to use the Platform. Further, as set out in Section III (7)
and the evidence in Annex 2, a significant number of children aged
under 13 used the Platform during the Relevant Period.
257. Reddit also cites as a mitigating factor the fact that children aged
under 13 were not permitted to use the Service during the Relevant
Period and were removed from it when identified. However, Reddit
had no form of age-gating to prevent children under 13 years old
accessing the Platform. Further, in a letter to the Commissioner
dated 11 August 2023, Reddit advised that “[t]o date, in light of our
privacy-centric data collection practices and the data minimization
principle, we have not had the capability to proactively detect under-
13 accounts. We are, however, currently exploring methods by
which we might do so, including through the use of automated tools
incorporating machine learning and artificial intelligence.” In the
Representations 21, Reddit says that it is “continuing to explore the
possibility of using automated models to infer users’ age bands.
However, Reddit will only deploy such technology once confident
217
218Representations, paragraph 157(3).
Representations, paragraph 58.
134 that it is both accurate and minimally privacy-intrusive. Because use
of the Service by Underage Users is prohibited and rare by design,
it is likely that a paucity of representative data will pose difficulties
for an automated model to detect Underage Users”. Instead, Reddit
relies on reports being made by other users. However, in its letter
to the ICO dated 11 August 2023, Reddit confirmed that between 2
September 2021 and 14 July 2023, it received 446 reports of
suspected creation or use of UK Reddit accounts by children under
13 years old, which consisted of 236 unique accounts. Reddit
subsequently determined that 168 of those accounts had self-
identified or otherwise indicated that the account holder was under
13 years old. The figure of 168 is substantially lower than the
significant number of children under 13 years old who were using
the Platform during the Relevant Period, as set out in Section III (7)
and the evidence in Annex 2.
258. In the Representations, Reddit submitted that a mitigating factor
was that ”subreddit communities are actively edited and monitored
by mods in accordance with the Reddit Rules” 219. However, as set
out at paragraphs 182(c), (d) and (e), moderation is of limited
effectiveness at reducing the potential for harm to children.
259. The Commissioner therefore rejects Reddit’s contention in the
Representations that he failed to fully or fairly identify and apply all
relevant mitigating factors for the reasons set out above.
The degree of responsibility of the controller or processor (Article
83(2)(d) UK GDPR)
260. When deciding whether to impose a penalty notice, the
219
Representations, paragraph 157(3).
135 Commissioner will also have regard to the degree of responsibility
of the controller or processor, taking into account technical and
organisational measures implemented by them pursuant to, among
other things, Article 25 UK GDPR. 220Controllers and processors are
required and expected to take responsibility for complying with their
obligations under the UK GDPR. 221 In assessing this factor, the
Commissioner will consider how far the controller or processor did
what it could be expected to do in terms of implementing technical
and organisational measures, taking into account:
a) its size and resources; and
b) the nature and purpose of the processing. 222
261. As to Reddit’s failure to implement appropriate technical and
organisational measures to establish the age of its users, the
Commissioner:
a) notes that those failures occurred despite Reddit’s knowledge
that children were likely to be using the Platform; and
b) considers that, given Reddit’s size and resources (as to which
see paragraph 36 above), Reddit can reasonably have been
expected to have implemented such measures to ensure it did
not unlawfully process the personal data of children under 13.
262. More generally, the Commissioner considers that Reddit was wholly
responsible for implementing sufficient controls to prevent children
under 13 years old from accessing its Platform so as to avoid the
unlawful processing of their personal data, in circumstances where
220Fining Guidance, paragraph 78.
221Fining Guidance, paragraph 79.
222Fining Guidance, paragraph 79.
136 Reddit was the sole controller in relation to the Infringements. The
Commissioner has had regard to these matters and considers that
they do not change his overall conclusion on whether it is
appropriate to impose a penalty notice.
Any relevant previous infringements of the controller or processor
(Article 83(2)(e) UK GDPR)
263. The Commissioner is not aware of any relevant previous
infringement of the UK GDPR or DPA committed by Reddit.
Therefore, this factor is not relevant to the Commissioner’s decision.
The degree of cooperation with the Commissioner (Article 83(2)(f) UK
GDPR)
264. Pursuant to Article 31 UK GDPR, controllers and processors are
required to cooperate with the Commissioner in the performance of
his tasks. The Commissioner’s tasks include the monitoring and
223
enforcement of the UK GDPR and the conduct of investigations
224
into the application of the UK GDPR. Paragraph 87 of the Fining
Guidance explains that such cooperation may include, for example,
responding to requests for information and attending meetings.
265. The Commissioner considers that the ordinary duty of cooperation
is required by law and meeting this standard is therefore not a
mitigating factor.25 The Commissioner may nonetheless consider it
appropriate to have regard to cooperation by a controller or
processor as a mitigating factor where that controller or processor
has responded to requests during an investigation in a way that:
223Article 57(1)(a) UK GDPR and s.115(2)(a) DPA.
224Article 57(1)(h) UK GDPR and s.115(2)(a) DPA.
225Fining Guidance, paragraph 87.
137 a) enables the enforcement process to be concluded significantly
more quickly or effectively; or
b) significantly limits the harmful consequences for people’s
rights and freedoms that might otherwise have occurred. 226
266. Reddit responded to informal requests for information during the
Investigation and responded to information notices, as well as
attending a meeting at the Commissioner’s offices (at Reddit’s
request) and a further virtual meeting (at the Commissioner’s
request).
267. However, the Commissioner considers that Reddit’s level of
cooperation during the Investigation did not go beyond what is
reasonably expected of any controller in such circumstances.
Further, the Commissioner notes (as set out above at paragraphs
198-208) that Reddit was repeatedly asked, over a significant period
of time, for any DPIAs which considered the processing of children’s
data, but which were not provided, in respect of certain DPIAs, until
as late as the Representations. The Commissioner also notes that in
respect of the OSA risk assessments, Reddit agreed, then refused,
to provide them, before eventually agreeing (see paragraph 33). The
Commissioner has therefore considered whether those delays
amount to a lack of cooperation that could be regarded as being an
aggravating factor. However, in the overall circumstances of the
Investigation, the Commissioner concludes that the matter of
cooperation should be treated as a neutral, rather than a mitigating
or aggravating, factor.
226
Fining Guidance, paragraph 88.
138The manner in which the Infringements became known to the
Commissioner (Article 83(2)(h) UK GDPR)
268. When deciding whether a penalty is appropriate, the Commissioner
will have regard to the manner in which the infringement became
known to him, in particular whether the controller or processor
notified the Commissioner of the infringement.227The Commissioner
may view a controller or processor bringing an infringement to the
Commissioner’s attention of its own volition as a mitigating factor in
circumstances where the Commissioner was not already aware of
228
the infringement. Unless the infringement was self-reported, the
way in which the Commissioner finds out about it — for example,
following a complaint, media coverage or through the
Commissioner’s own intelligence — will generally be considered as
neutral.229
269. The Infringements became known to the Commissioner due to an
investigation of Reddit (and other organisations) as part of the
Commissioner’s work to assess conformance with the Children’s
Code. The manner in which the Infringements became known to the
Commissioner is therefore a neutral factor.
Measures previously ordered against the controller or processor
(Article 83(2)(i) UK GDPR)
270. The Commissioner has not previously imposed measures referred to
in Article 58(2) UK GDPR on Reddit. This factor is therefore not
227Fining Guidance, paragraph 90.
228Fining Guidance, paragraph 91.
229Fining guidance, paragraph 93.
139 relevant to the Commissioner’s conclusions.
Adherence to approved codes of conduct or certification mechanisms
(Article 83(2)(j) UK GDPR)
271. There are no relevant codes of conduct or approved certification
mechanisms in this case. This factor is therefore not relevant to the
Commissioner’s conclusions.
Any other applicable aggravating or mitigating factors (Article
83(2)(k) UK GDPR)
272. Pursuant to Article 83(2)(k) UK GDPR, when considering whether to
impose an administrative fine and when determining the level of any
fine, the Commissioner is required to consider any other aggravating
or mitigating factors applicable in the circumstances of the case,
such as financial benefits gained, or losses avoided, directly or
indirectly, from the infringement.
273. The Commissioner has considered whether Reddit benefitted
financially from its failure to implement appropriate technical and
organisational measures in respect of age assurance to ensure that
it did not process the personal data of children under 13 years old
unlawfully. The Commissioner has not seen evidence that Reddit has
benefitted financially and therefore does not consider this as a
relevant aggravating factor.
274. The Commissioner does not consider that there are any other
relevant aggravating or mitigating factors.
140(5) Effectiveness, proportionality and dissuasiveness
275. When considering whether to issue a penalty notice, the
Commissioner will consider whether it would be:
a) effective, in the sense of achieving the objective of ensuring
compliance with data protection legislation or providing an
appropriate sanction for the infringement (or both);
b) proportionate, in the sense that the fine should not exceed
what is appropriate and necessary in the circumstances to
meet those objectives; and
c) dissuasive, meaning that imposing a fine should be a genuine
deterrent to future non-compliance. 230
276. In making the decision, the Commissioner will first consider whether
issuing a penalty notice is effective and dissuasive, before then
considering whether it is proportionate to do so.231
277. The Commissioner has concluded that the imposition of a penalty
would, in the circumstances of this case, be an effective means of
ensuring compliance with the UK GDPR and sanctioning the
Infringements, and would also be dissuasive. The Commissioner has
also concluded that a penalty is a proportionate regulatory
response, having regard to the factors addressed above in relation
to the seriousness of the Infringements.
230
231Fining Guidance, paragraph 103.
Fining Guidance, paragraph 104.
141 (6) The Commissioner’s conclusion on whether to impose a
penalty
278. For the reasons set out above, the Commissioner has decided to
impose a penalty on Reddit in respect of the Infringements.
VI. CALCULATION OF THE PENALTY
279. The process the Commissioner follows in deciding the appropriate
amount of any penalty which may be imposed in an individual case
is described in the Fining Guidance, which sets out a five-step
penalty setting mechanism: 232
a) Step 1: An assessment of the seriousness of the infringement
to determine an appropriate starting point for the penalty.
b) Step 2: Accounting for the turnover of the undertaking
when assessing the starting point for the penalty.
c) Step 3: Calculating the starting point for the penalty based
on the outcomes of Steps 1 and 2.
d) Step 4: Adjusting the starting point for the penalty based
on any relevant aggravating or mitigating factors.
e) Step 5: Adjusting the penalty to ensure that it is effective,
proportionate and dissuasive, whilst not exceeding the
relevant statutory maximum.
232
Fining Guidance, paragraph 106.
142280. In carrying out the assessment, the Commissioner is mindful that
the aim of Steps 1 to 4 is to identify a fine amount that is effective,
proportionate and dissuasive, and the purpose of Step 5 is to
provide the opportunity for a cross-check on the overall result. The
assessment of the appropriate level of the penalty is not a
mechanistic exercise. It involves evaluation and judgement, taking
233
to account all the relevant circumstances of the case.
(1) Statutory Maximum Penalty
281. The Commissioner has concluded that Reddit infringed Article
5(1)(a), Article 6, Article 8 and Article 35(1) UK GDPR.
282. An infringement of Article 5(1)(a) or Article 6 UK GDPR is subject to
a maximum statutory penalty at the higher rate of £17.5 million, or,
in the case of an undertaking, 4% of the worldwide turnover in the
preceding financial year (whichever is higher). 234
283. An infringement of Article 8 or Article 35(1) UK GDPR is subject to
the standard maximum statutory penalty of £8.7 million, or, in the
case of an undertaking, 2% of the worldwide annual turnover in the
preceding financial year, whichever is higher. 235
284. Pursuant to Article 83(3) UK GDPR, if a controller or processor
infringes several provisions of the UK GDPR in the course of the
same or linked processing operations, the total amount of any
penalty imposed cannot exceed the amount specified for the gravest
236
infringement.
233
Fining Guidance, paragraph 107.
234Article 83(5)(a) UK GDPR and Section 157(1)(a) DPA.
235Article 83(4)(a) UK GDPR and Section 157(1)(a) DPA.
236Fining Guidance, paragraph 33.
143285. The Commissioner has made a determination that Reddit infringed
Articles 5(1)(a), 6, 8 UK GDPR (i.e. the Processing Infringements)
and Article 35 UK GDPR (i.e. the DPIA Infringement). Despite the
findings of infringement of several Articles of the UK GDPR, the
Commissioner considers that the Infringements arise from the same
or linked processing operations and therefore the overall fine that
can be imposed by the Commissioner cannot exceed the maximum
statutory amount that applies to the gravest of the individual
infringements identified (as set out in Articles 83(4) and 83(5) UK
GDPR). In this case, the higher maximum amount applies to
infringements of Articles 5(1)(a) and 6 UK GDPR, and therefore the
maximum statutory amount of the fine that may be imposed on
Reddit is £17.5 million or 4% of worldwide turnover (whichever is
237
higher).
286. As explained in the Fining Guidance, in such cases, the
Commissioner may decide to impose a fine for each infringement
arising from the same or linked processing operations, provided that
the sum of those penalties does not exceed the applicable statutory
maximum. 238 In the present case, the Commissioner has made a
decision to impose separate fines for (i) the Processing
Infringements and (ii) the DPIA Infringement. This is because certain
aspects of the DPIA Infringement and the Processing Infringements
are different, such as the period of infringement and the ages of
children whose personal data was impacted by each of the
Infringements. The sum of the two fines cannot exceed the higher
maximum amount.
237
238Fining Guidance, paragraph 40.
Fining Guidance, paragraph 42.
144287. As above, in the case of an undertaking, the higher maximum
amount is either £17.5 million (the fixed amount) or 4% of the
undertaking’s total worldwide annual turnover in the preceding
financial year (the turnover based amount), whichever is greater.
The Fining Guidance explains the concept of an undertaking for the
purpose of imposing an administrative fine at paragraphs 23–31. In
particular, paragraphs 28-30 of the Fining Guidance state as
follows:
“In this context, an undertaking does not correspond to the
commonly understood notion of a legal entity or a company under,
for example, English commercial or tax law. Instead, an undertaking
may comprise one or more legal or natural persons forming a ‘single
economic unit’, rather than a single entity characterised as having
legal personality.
Whether or not an individual controller or processor forms part of a
wider undertaking depends on whether it can act autonomously or
whether another legal or natural person, for example, a parent
company, exercises decisive influence over it.
Where a parent company owns all, or nearly all, the voting shares
in a subsidiary, there is a presumption that the parent company
exercises decisive influence over the subsidiary’s conduct. This
presumption may be rebutted. However, the burden is on the
parent company to provide sufficient evidence to demonstrate that
the subsidiary acts independently.” 239
239The approach set out in the Fining Guidance is consistent with the decision of the
CJEU in Case C‑383/23, ILVA A/S ECLI:EU:C:2025:84 (13 February 2025), in which the
Court held that when assessing the amount of the administrative fine to be issued to a
subsidiary within the Lars Larsen Group, the group in its entirety was the relevant
undertaking and the maximum statutory fine had to be calculated on the basis of the
group’s total worldwide annual turnover in the preceding financial year.
145288. The relevant controller responsible for the Infringements in respect
of UK data subjects is Reddit, Inc. The Commissioner is therefore
entitled to calculate the maximum fine based on the turnover of
Reddit, Inc. (which the Commissioner understands constitutes the
total turnover of the entire Reddit undertaking).
240
289. Reddit’s financial results for the financial year 2024 (“FY24”)
show the consolidated turnover of the undertaking (i.e., the
corporate group) for the year ended 31 December 2024 (the
preceding financial year). Reported consolidated revenue (turnover)
241
for the period was $1.3 billion. The Commissioner has used the
average of the GBP/USD exchange rates on the first and last trading
days of the period 242(2 January 2024 and 31 December 2024) to
convert Reddit’s USD-denominated turnover to GBP. On this basis,
Reddit’s total worldwide annual turnover for 2024 was
£1,033,795,817.76.
290. In calculating the separate penalty for the Processing
Infringements, 4% of £1,033,795,817.76 is £41.35 million. 243As
this is greater than the fixed amount for the higher maximum
statutory penalty of £17.5 million, the maximum fine the
Commissioner can impose on Reddit for the Processing
Infringements is £41.35 million.
240
Reddit’s 2024 Form 10-K.
241On 1 January 2024, Reddit changed the functional currency of its UK subsidiary,
Reddit U.K. Limited, from USD to GBP as the future operating cash flows of the UK
subsidiary were expected to be in GBP. However, the turnover considered for the
purposes of this Penalty Notice is that of Reddit, Inc. Reddit, Inc.’s functional currency is
US Dollars, since the majority of its revenue and operating expenses are denominated
in that currency.
242Available at GBP exchange rates | Bank of England | Database (accessed 18 February
2026).
243Rounded down from £41,351,832.71.
146291. In calculating the separate penalty for the DPIA Infringement, 2%
of £1,033,795,817.76 is £20.675 million. 244As this is greater than
the fixed amount for the standard maximum statutory penalty of
£8.7 million, the maximum fine the Commissioner can impose on
Reddit for the DPIA Infringement is £20.675 million.
292. In calculating the total penalty for the Infringements, the total
amount cannot exceed the higher maximum statutory penalty of
£41.35 million as this is the amount specified for the gravest
infringement in this case, which is the infringements of Article
5(1)(a) and Article 6 UK GDPR.
293. In the Representations, Reddit submitted that the Processing
Infringements and the DPIA Infringement are “indelibly linked” and
that Reddit is being fined “twice for the same ultimate alleged
245
wrong” . The Commissioner has carefully considered the
Representations. However, he does not consider that Reddit is being
fined twice for the same wrong. As set out above at paragraph 285,
the Infringements do arise from the same or linked processing
operations and therefore the total amount of the fine is subject to
the applicable statutory maximum. In this case, that is the higher
statutory maximum. The requirement to have a lawful basis for
processing personal data under Article 6 UK GDPR is separate from
the obligation to complete a DPIA under Article 35 UK GDPR. This is
made clear by the fact that an infringement of Article 35 UK GDPR
is subject to a different statutory maximum to an infringement of
Articles 5(1)(a) and 6 UK GDPR. Furthermore, there is a key
distinction between the Infringements in terms of the data subjects
to which they relate. The DPIA Infringement applies to children
generally, including those aged 13-17 years old, and in that respect
244
245Rounded down from £20,675,916.36.
Representations, paragraph 158(1).
147 is entirely distinct from the Processing Infringements which apply
specifically to the unlawful processing of the personal data of
children under 13 years old. In addition, the period of infringement
for the DPIA Infringement is different from that of the Processing
Infringements, which further indicates that Reddit is not being
punished twice for the ’same wrong’.
(2) Step 1: Assessment of the seriousness of the Infringements
294. As set out in paragraphs 109 to 115 of the Fining Guidance, the
Commissioner determines a starting point for a penalty by first
assessing the seriousness of the infringement. The Commissioner’s
assessment of the seriousness of the Infringements is set out at
Section V(3) above.
295. As stated at paragraph 248 of this Penalty Notice, the Commissioner
has concluded that the Processing Infringements have a high
degree of seriousness. For infringements that have a high degree of
seriousness, the Commissioner uses between 20% to 100% of the
relevant legal maximum as the starting point. 246 As set out at
paragraph 282 above, the relevant legal maximum is 4% of
turnover. The Commissioner has, taking into account all the
circumstances and the reasons given above in Section V(3) relating
to seriousness, concluded that the Processing Infringements
warrant a starting point of 25%. This is a reduction from the starting
point of 30% in the NOI. This reduction has been made taking into
account Reddit’s Representations and, in particular, the factual error
made in the NOI in relation to the misreading of Ofcom’s Online
Nation Report 2024 (set out above at paragraph 232)
246
Fining Guidance, paragraph 110.
148296. As stated at paragraph 249 of this Penalty Notice, the Commissioner
has categorised the DPIA Infringement as having a high degree of
seriousness. For infringements that have a high degree of
seriousness, the Commissioner uses between 20% and 100% of the
relevant legal maximum as the starting point. 247As set out at
paragraph 283 above, the relevant legal maximum is 2% of
turnover. The Commissioner has, taking into account all the
circumstances and the reasons given above in Section V(3) relating
to seriousness, concluded that the DPIA Infringement warrants a
starting point of 20%. This is a reduction from the starting point of
25% in the NOI. This reduction has been made taking into account
Reddit’s representations and the reduced period for the DPIA
Infringement (as set out above at paragraph 210).
(3) Step 2: Accounting for turnover
297. Having assessed the seriousness of the infringements, the
Commissioner has next considered whether any adjustments are
required to account for turnover, as set out in paragraphs 116 to
129 of the Fining Guidance. This step permits the Commissioner to
adjust the starting point to reflect the size of the undertaking. This
approach aids the Commissioner in ensuring that the proposed
penalty figure is effective, proportionate and dissuasive.
298. Where the higher statutory amount in Article 83(5)(a) UK GDPR is
applicable and the global turnover of the relevant undertaking in the
previous financial year is greater than £437.5 million, no adjustment
is required to the starting point. Where the standard maximum
amount in Article 83(4)(a) is applicable and the global turnover of
the relevant undertaking in the previous financial year is greater
247
Fining Guidance, paragraph 110.
149 than £435 million, no adjustment is required to the starting point.
This is because the undertaking’s size is already deemed to be
reflected by the use of a percentage figure to calculate the statutory
maximum and the Commissioner will consider whether it is
appropriate to impose a penalty up to the amount allowed by law. 248
That was the position in this case.
(4) Step 3: Calculation of the starting point
299. The starting point for the penalty in this case has been calculated as
follows:
Processing Infringements
Statutory Maximum Amount (£41.35 million) x Adjustment for
seriousness (25%) x Turnover adjustment (not applicable) =
£10,337,500.
DPIA Infringement
Statutory Maximum Amount (£20.675 million) x Adjustment for
seriousness (20%) x Turnover adjustment (not applicable) =
£4,135,000.
Total Starting Point
Therefore, the total starting point for the Infringements is
£14,472,500.
248
Fining Guidance, Table B: Ranges for adjustment based on the turnover of the
undertaking.
150(5) Step 4: Adjustment to take into account any aggravating or
mitigating factors
300. The Commissioner next considers any aggravating or mitigating
factors. These factors may warrant an increase or decrease in the
penalty calculated at the end of Step 3.
301. The relevant aggravating and mitigating factors in relation to the
Infringements are set out at Section V(4) above. In summary, in
respect of any of the Infringements:
a) Reddit did not indicate that it would introduce age assurance
measures or carry out a DPIA until the Investigation had been
underway for some time. As stated in the Representations,
Reddit has only recently introduced an age verification tool,
but only in respect of access to mature content. As explained
in paragraphs 254 and 255 above, Reddit has also recently
introduced a simple self-certification age-gate when signing-
up to the Platform on the App. The Commissioner remains
concerned that this is not an effective age assurance measure
given the nature of Reddit’s processing of children’s data, as
it is easily circumvented. In its Representations, Reddit says
that it incurred considerable business time and resources on
the Persona system and other measures to comply with the
OSA, and that the penalty should be reduced accordingly. 249
The Commissioner rejects this submission on the basis that
these measures were only implemented after the end of the
Relevant Period in compliance with Reddit‘s OSA obligations,
and not as mitigation in relation to the Processing
Infringements. In the circumstances, the Commissioner does
249
Representations, paragraph 158(4).
151 not consider there are any mitigating or aggravating factors
warranting an adjustment to the amount of the penalty (see
paragraphs 250-259 above).
b) Reddit is wholly responsible for the Infringements. However,
although the Commissioner considers the failures occurred
despite (i) Reddit’s knowledge that children were likely to be
using the platform and that (ii) Reddit can reasonably have
been expected to implement measures to ensure it did not
process the personal data of children under 13 years old
unlawfully, the Commissioner has decided that these matters
have been adequately reflected in the assessment of
seriousness. Therefore, the Commissioner has decided that
this potentially aggravating factor does not warrant an
increase in the amount of the penalty (paragraphs 260-262
above).
c) The Commissioner is not aware of any previous infringements
by Reddit (paragraph 263 above); nor has he previously
imposed measures referred to in Article 58(2) UK GDPR on
Reddit (paragraph 270 above). These factors are therefore not
relevant to the Commissioner’s calculation of the penalty.
d) Reddit has cooperated with the Commissioner to the extent
required by law. The Commissioner therefore considers this is
a neutral factor in the assessment (paragraphs 264-267
above).
e) The Infringements became known to the Commissioner
through the ICO’s proactive engagement with various
organisations following the introduction of the Children’s Code
152 (paragraphs 268-269 above). The Commissioner considers
this is a neutral factor in the assessment.
f) There are no relevant codes of conduct or approved
certification mechanisms in this case (paragraph 271 above).
This factor is therefore not relevant to the Commissioner’s
conclusions.
g) There are no other relevant aggravating or mitigating factors
(paragraphs 272-274 above).
302. In the light of those considerations, the Commissioner’s conclusion
is that no adjustment to take account of aggravating or mitigating
factors is appropriate.
(6) Step 5: Adjustment to ensure the fine is effective,
proportionate and dissuasive
303. As set out in paragraph 142 of the Fining Guidance, “…the aim of
Steps 1 to 4 of the calculation is to identify a fine amount that is
effective, proportionate and dissuasive. The purpose of Step 5 is to
provide the opportunity to check that is the case. It allows the
Commissioner to increase or decrease the penalty as necessary,
having regard to all the relevant circumstances of each individual
case.”
304. When reaching a decision as to whether a fine is effective,
proportionate and dissuasive, the Commissioner will have regard to
all the relevant circumstances of each individual case. This
includes:
a) the seriousness of the infringement;
153 b) any aggravating or mitigating factors;
c) the controller or processor’s size and financial position; and
d) the need for effective deterrence. 250
305. The Commissioner considers that a penalty of £14,472,500 would be
effective, proportionate and dissuasive, as set out below. As set out
in paragraphs 144 to 146 of the Fining Guidance, the Commissioner
first considers whether the amount of the penalty is effective, then
whether it is dissuasive, and finally whether it is proportionate.
306. The Commissioner considers that the penalty for the Infringements
is effective. As explained at paragraph 103 of the Fining Guidance,
‘effective’ means that imposing a fine achieves the objective of
ensuring compliance with data protection legislation or providing an
appropriate sanction (or both). A penalty in the amount of
£14,472,500 is an appropriate, but not excessive, sanction for the
Infringements which the Commissioner considers to be of a high
degree of seriousness. Further, the penalty will achieve the
objective of effectively ensuring Reddit’s future compliance with the
important provisions of the UK GDPR that are the subject of this
Penalty Notice.
307. As explained at paragraph 103 of the Fining Guidance, ‘dissuasive’
means that imposing a fine is a genuine deterrent to future non-
compliance. The intention behind ensuring fines are ‘dissuasive’ is
to promote compliance with data protection legislation. There are
two aspects to deterrence in this context. First, there is a need to
deter the controller or processor that is the subject of the fine from
250
Fining Guidance, paragraph 147.
154 engaging in the same infringing conduct again (referred to as
‘specific deterrence’). Second, there is a need to deter others from
committing the same infringement in the future (referred to as
‘general deterrence’).
308. The Commissioner considers that the penalty is an effective
deterrent, both as regards Reddit specifically, and controllers
generally, in relation to future infringements of the UK GDPR and/or
DPA, including, in particular, infringements regarding the processing
of personal data relating to children.
309. The Commissioner further considers that the penalty will reinforce
the importance which the Commissioner attaches to compliance
with the obligations imposed by Articles 5(1)(a), 6, 8 and 35 UK
GDPR and signal that there are serious consequences for controllers
which breach their obligations under these provisions. In particular,
the penalty will encourage Reddit to ensure that it has a lawful basis
in respect of each of its processing operations and that such
processing operations are fair, and will deter Reddit from unlawfully
processing the personal data of children under 13 years old. Further,
it should ensure that, in respect of any future high-risk processing
operations which Reddit is considering engaging in, it carries out the
necessary DPIA prior to engaging in any such processing and
consults the Commissioner prior to processing where this DPIA
indicates that the processing would result in a high risk in the
absence of measures taken by the controller to mitigate the risk. In
relation to general deterrence, the penalty will put on notice those
controllers who currently prohibit children under 13 years old from
using their services, but who do not have any appropriate age
assurance measures to prevent such children from using their
services, that processing their personal data is unlawful and could
result in enforcement action. It will also underline the importance to
155 controllers generally of carrying out DPIAs where their processing is
likely to result in a high risk to the rights and freedoms of people,
particularly children.
310. As explained in paragraph 103 of the Fining Guidance,
‘proportionate’ means that imposing a fine does not exceed what is
appropriate and necessary in the circumstances to meet the
objectives of ensuring compliance with data protection legislation or
providing an appropriate sanction for the infringements (or both).
311. In considering whether imposing a fine is proportionate, the
Commissioner will take into account all the relevant circumstances,
including the seriousness of the infringements, the harm or other
impact on data subjects, and the controller’s size and financial
position.
312. The Commissioner considers that the penalty is proportionate taking
into account the high degree of seriousness of the Infringements.
In particular, the Commissioner has considered the significant
number of children impacted by the Infringements. The
Commissioner estimates that in 2024 approximately 537,000
children visited the Platform in the UK, with around 226,000 of these
children being under 13 years old (see Section III(7)).
313. In addition, the Commissioner has had regard to the fact that the
Infringements are likely to have led to harm, as set out in
paragraphs 230-236 above. Furthermore, the Commissioner has
had regard to the fact that Reddit’s own risk assessments – carried
out in response to the coming into force of the OSA – concluded that
there are non-trivial risks, both to children and to users of the
Platform generally, of experiencing harms related to illegal content
as well as content which is compliant with the Reddit Rules. Based
156 on this evidence, the Commissioner has concluded that the
Infringements led to children whose personal data was unlawfully
processed by Reddit being likely to have suffered damage (see
paragraph 233).
314. In the circumstances — namely, the high degree of seriousness of
the Infringements, the significant number of children using the
Platform, and the risk of them having suffered damage — the
Commissioner considers that the penalty is proportionate.
315. Further, the penalty of £10,337,500 for the Processing
Infringements is 0.999% of Reddit’s turnover in 2024. The proposed
penalty of £4,135,000 for the DPIA Infringement is 0.399% of
Reddit’s turnover in 2024. The total proposed penalty of
£14,472,500 is 1.399% of Reddit’s turnover in 2024. This is well
below the statutory maximum of 4% of turnover (£41.35 million)
and, in the circumstances, the Commissioner considers that the
penalty is proportionate.
316. In reaching a decision on proportionality, the Commissioner has also
considered Reddit’s SEC Filings 251(in particular for the year ended
2024) which provide the most up-to-date picture of Reddit’s financial
performance. Publicly available records are limited given Reddit’s
history as a private company but comparative financial information
from Reddit’s 2024 Quarterly Reports (Form 10-Q) and Securities
Registration Statement of 19 March 2024 (Form S-1/A) provide the
Commissioner with details of its profit and loss dating back to the
251‘SEC Filings’ refer to filings by publicly traded companies with the U.S. Securities and
Exchange Commission. Forms 10-Q, 10-K and S-1/A, alongside other regulatory filings,
can be found on the Investor Relations section of Reddit’s website. Available at:
https://investor.redditinc.com/financials/sec-filings/default.aspx (Accessed 28 February
2025).
157 quarter ended 31 March 2021 and of its balance sheet and cash flows
from 2022 onwards.
317. Quarterly revenues have grown consistently over the 2021-2024
period with the exception of ‘seasonality’ (increased advertiser spend
in the fourth quarter followed by a weaker first quarter). In the year
ended 31 December 2024, Reddit achieved revenue of $1.3bn, an
increase of 62% on the prior year period.
318. As well as strong revenue growth, Reddit has growing employee
numbers 252, and has a detailed strategy for growing users and
engagement (for example, by growing its international (beyond the
US) user base). 253 Whilst Reddit has historically struggled with
254
profitability, its management appears confident about the
255
prospect of achieving profitability in future . Reddit is very well-
resourced and has access to significant additional sources of
financing (for instance, $0.75 billion available via a revolving credit
256
facility) .
319. In the circumstances, the Commissioner considers that the penalty
is proportionate, taking into account Reddit’s size and financial
position.
320. The Commissioner has also had regard to the fact that children merit
specific protection, as set out in Recital 38 UK GDPR which says that
“Children merit specific protection with regard to their personal
data, as they may be less aware of the risks, consequences and
252See page 26 of Form 10-K.
253
254See page 8 of Form 10-K.
Of the periods for which the Commissioner has information (2021 – 2024), Reddit
achieved net income i.e. profit, in only Q4 2021, Q4 2023, and Q3 and Q4 2024.
255See Reddit’s Q4'24 Earnings Call Transcript.
256See page 41 of Form 10-K.
158 safeguards concerned and their rights in relation to the processing
of personal data” (see paragraphs 87-90).
321. Further, the Commissioner has had regard to the Children’s Code,
in particular Standards 1, 2 and 3. Standard 1 states that “The best
interests of the child should be a primary consideration when you
design and develop online services likely to be accessed by a child”.
Standard 2 states that controllers should “Undertake a DPIA to
assess and mitigate risks to the rights and freedoms of children who
are likely to access your service, which arise from your data
processing. Take into account differing ages, capacities and
development needs and ensure that your DPIA builds in compliance
with this code”. Standard 3 states that controllers should “Take a
risk based approach to recognising the age of individual users and
ensure you effectively apply the standards in this code to child
users”. This is important because the “ultimate aim of the Children’s
Code is to ensure that online services likely to be accessed by
children are appropriate for their use”. The Commissioner’s
Children’s Code strategy seeks to ensure that social media and video
sharing platforms comply with data protection law and conform with
the standards of the Children’s Code. The Commissioner therefore
considers that the penalty will encourage conformance with the
Children’s Code and highlight the importance of protecting the
personal data of children using online services. In the
Representations, Reddit stated that ”[n]othing [in] the DPA 2018 or
the GDPR suggests that one purpose for promulgating a Code is to
increase penalties in this way...”. The Commissioner rejects this
submission as the Children’s Code is not relied on to increase the
penalty. Rather, it is relevant here, at Step 5, as a factor in
determining whether the penalty as calculated is effective,
proportionate and dissuasive.
159 322. In the Representations, Reddit submitted that the penalty is
excessive compared to the penalty given to TikTok in April 2023.
The Commissioner has considered these representations but does
not consider that the penalty is excessive compared to the TikTok
penalty on the basis that (i) the Commissioner is not bound by
previous decisions, (ii) the Fining Guidance was not in place at the
time of the earlier penalty, (iii) the circumstances of the cases are
different, including the age assurance measures in place on that
other platform, and its relevant turnover, and (iv) the TikTok
penalty does not appear to have had the desired general deterrent
effect given that it did not lead to Reddit taking steps to ensure that
personal data of children aged under 13 was processed lawfully.
323. Finally, when exercising his discretion to decide the appropriate
257
amount of a penalty , the Commissioner is mindful of the fact that
the setting of a penalty is not a mechanistic assessment, but one of
258
evaluation and judgement. In all the circumstances, the
Commissioner is satisfied that the penalty is effective, proportionate
and dissuasive and does not exceed the statutory maximum
amount, and that it is not necessary to adjust the penalty at this
Step 5.
(7) Conclusion: Penalty
324. For the reasons set out above, the Commissioner has decided to
impose a penalty on Reddit in the amount of £14,472,500.
VII. FINANCIAL HARDSHIP
257See Doorstep Dispensaree Limited v The Information Commissioner [2024] EWCA Civ
1515, paragraph 57.
258Fining Guidance, paragraph 143.
160 325. In exceptional circumstances, the Commissioner may reduce a fine
where an organisation is unable to pay due to its financial position.
The Commissioner received no representations from Reddit in
relation to financial hardship.
VIII. PAYMENT OF THE PENALTY
326. The penalty must be paid to the ICO by BACS transfer or cheque by
24 March 2026 or in accordance with any agreed payment plan.
327. Pursuant to paragraph 9(1) of Schedule 16 to the DPA 2018, the
Commissioner cannot take action to recover a penalty unless:
a) the period specified in this Penalty Notice (i.e. by 24 March
2026) has ended;
b) any appeals against this Penalty Notice have been decided or
otherwise ended;
c) if this Penalty Notice has been varied, any appeals against the
penalty variation notice have been decided or otherwise
ended; and
d) the period for Reddit to appeal this Penalty Notice, and any
variation of it, has ended.
328. Under paragraph 9(2) of Schedule 16 to the DPA 2018, in England
and Wales, the Commissioner is able to enforce the payment of the
penalty. The penalty is recoverable:
161 a) if the County Court so orders, as if it were payable under an
order of that court; or
b) if the High Court so orders, as if it were payable under an
order of that court.
IX. RIGHTS OF APPEAL
329. By virtue of section 162 DPA 2018, Reddit may appeal to the First-
tier Tribunal (General Regulatory Chamber) (Information Rights)
against this Penalty Notice. Reddit may appeal to the Tribunal
against the amount of the penalty regardless of whether or not it
appeals against this Penalty Notice.
330. Information about the appeals process is set out in Annex 1 to this
Penalty Notice. Any notice of appeal should be sent or delivered to
the Tribunal so that it is received within 28 days of the date of this
Penalty Notice.
Dated the 23 February 2026
Tim Capel
Interim Executive Director, Regulatory Supervision
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
162 ANNEX 1
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER
1. Section 162(1) of the Data Protection Act 2018 gives any person
upon whom a penalty notice or variation notice has been served a
right of appeal to the First-tier Tribunal (Information Rights) (the
“Tribunal”) against the notice.
2. If you decide to appeal and if the Tribunal considers:-
a. that the notice against which the appeal is brought is not in
accordance with the law; or
b. to the extent that the notice involved an exercise of discretion
by the Commissioner, that he ought to have exercised his
discretion differently,
the Tribunal will allow the appeal or substitute such other decision
as could have been made by the Commissioner. In any other case
the Tribunal will dismiss the appeal.
3. You may bring an appeal by serving a notice of appeal on the
Tribunal at the following address:
General Regulatory
Chamber HM Courts &
Tribunals Service PO Box
11230
Leicester
LE1 8FQ
Email: grc@justice.gov.uk
Telephone: 0300 303 5857
163 a. The notice of appeal should be sent so it is received by the
Tribunal within 28 days of the date of the Penalty Notice.
b. If your notice of appeal is late the Tribunal will not admit it
unless the Tribunal has extended the time for complying with
this rule.
4. The notice of appeal should state:-
a. your name and address/name and address of your
representative (if any);
b. an address where documents may be sent or delivered to
you;
c. the name and address of the Information Commissioner;
d. details of the decision to which the proceedings relate;
e. the result that you are seeking;
f. the grounds on which you rely;
g. you must provide with the notice of appeal a copy of the
penalty notice or variation notice;
h. if you have exceeded the time limit mentioned above the
notice of appeal must include a request for an extension of
time and the reason why the notice of appeal was not
provided in time.
1645. Before deciding whether or not to appeal you may wish to consult
your solicitor or another adviser. At the hearing of an appeal a party
may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.
6. The statutory provisions concerning appeals to the First-tier
Tribunal (General Regulatory Chamber) are contained in sections
162 and 163 of, and Schedule 16 to, theDPA, and Chapter 1 of Part
3 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory
Chamber) Rules 2009 (Statutory Instrument 2009 No. 1976
(L.20)).
165 ANNEX 2
ESTIMATED REDDIT USERS AND ACCOUNT HOLDERS IN THE UK,
AGED UNDER 13, AND 13 TO 17 YEARS OLD
1. Introduction
1.1. This Annex to the Penalty Notice provides analysis and estimates of
the numbers of UK Reddit registered users (i.e. account holders) and
more general users under 13 years old and between the ages of 13 to
17 years old.
1.2. This analysis has been produced by the ICO’s Directorate of Economic
Analysis within the context of the ICO’s investigation into Reddit to
confirm the potential scale of personal data processing of users and
account holders under 13 years old and between the ages of 13 to 17
years old by Reddit. References to “we” and “our” in this Annex
should be interpreted to mean the ICO’s Directorate of Economic
Analysis.
1.3. Reddit, in its responses to information notices in August 2023 and
March 2024, has stated that it “does not collect age or make
inferences based on user personal information” for the purpose of
estimating the total number of Reddit account holders under 13 years
259
old and between 13 to 17 years old. However, it has provided three
alternative sources to indicate the number of Reddit users which we
consider further below.
1.4. In the absence of evidence from Reddit itself as to the number of
children who are Reddit users and account holders under 13 years old
and between 13 to 17 years old who use its Platform, we have
conducted our own analysis and provide our best estimates. In doing
259
Reddit response to ICO letter on 11 August 2023.
166 so we have considered a wide range of evidence, including that
provided by Reddit.
1.5. This Annex is structured as follows:
• Section 2 provides a summary of our best estimates;
• Section 3 explains the methodology adopted to calculate the
estimates;
• Section 4 sets out more detail on our best estimates of the number
of UK Reddit account holders between the ages of 3 to 12 and 13
to 17 years old, as well as supporting evidence;
• Section 5 sets out more detail on our best estimates of the number
of UK Reddit users between the ages of 3 to 12 years old and 13 to
17 years old; and
• Section 6 covers other sources that we have considered and the
limitations that led to them being excluded from our main body of
evidence.
2. Summary of best estimates
2.1. Our analysis shows that from 2021 onwards, when data about Reddit
account holders is available, there have been considerable numbers of
UK children between the ages of 3 to 12 years old and 13 to 17 years
old who are Reddit account holders. Reddit’s child usage data was
introduced in the Ofcom Media Literacy Tracker survey from 2020/21
onwards, and account data is available from 2021 onwards. 260
260
Reported in the 2021 Parents’ and Children’s Online Behaviours and Attitudes survey. See
Ofcom’s Children’s Media Literacy 2020 (Survey 2) aged 3-4 data tables.pdf and Ofcom’s
Children’s Media Literacy 2020 (Survey 2) aged 5-15 data tables.pdf.
1672.2. Our best estimates are provided in Figure 1 below and show that,
between 2021 and 2024, there were between 49,000 and 89,000
account holders in the 3 to 12 years old age group, and between
159,000 and 174,000 in the 13 to 17 years old age group.
2.3. As Figure 1 shows, account holder numbers for the 13 to 17 years old
age group appear relatively stable over the period 2021 to 2023, with
a small decline in 2024. The number of account holders between the
ages of 3 to 12 years old appears to drop considerably in 2023, but
we have found that this is partly due to missing data for 8 to 11 year
olds (in respect of which, see paragraph 4.3 below). This and other
areas of uncertainty around the estimates are discussed in detail in
Section 4 below.
Figure 1: Estimates of Reddit account holders aged 3 to 12 and 13 to 17 during 2021 to
2024
200,000
180,000
160,000
140,000
120,000
100,000
80,000
60,000
40,000
20,000
-
2021 2022 2023* 2024 2021 2022 2023 2024
3 - 12 age group 13 - 17 age group
Number of accounts
Source: ICO estimates based on Ofcom and ONS data.
* The 2023 calculation excludes 8 to 11 year olds, as we explain further in Section 4.
2.4. In addition to estimating numbers of account holders, we have
estimated broader numbers of Reddit users for the two age groups,
including users for news consumption. These results are shown in
Figure 2 below. Our best estimate is that there were between 136,000
168 services. Users can access Reddit content, although they are not able
to post content, comment or send private messages, and some
personal data, such as IP addresses, device information, links clicked
and information from cookies may be collected (see paragraphs 47-48
261
of the Penalty Notice). In order to access additional functionalities,
users need to set up an account. This distinction leads to the
expectation that the number of users would be higher than the
number of account holders.
Data sources
3.2. We have considered a wide range of publicly available data, in line
with the guidance in the Government Functional Standard for
Analysis.262 These include research and datasets from public bodies
and regulators, children’s charities, academic sources, research
organisations and technology companies that could be used to reliably
estimate the number of Reddit users and account holders between the
ages of 3 to 12 years old and 13 to 17 years old.
3.3. To ensure the robustness of our estimates, we have considered only
data from publicly available sources, such as other regulators, or
research conducted by independent organisations that have either
been peer reviewed, or provide details of the research methodology,
assumptions and limitations.
3.4. The period of interest is from 2018 to the present. We have identified
three relevant data sources that meet our requirements and have
used these to provide our best estimates. These three data sources
each provide relevant information for Reddit from 2020 onwards.
3.5. All three sources use surveys. In a survey, information is gathered in
relation to a sample of the population of interest. This is
261Ibid.
262See Government Functional Standard GovS 010: Analysis - GOV.UK (accessed 18
February 2026).
170 advantageous when it is impractical or unduly time-consuming or
costly to collect data in relation to the total population, and if the
sample is representative then it can be used to generalise the findings
from the sample to the population with a high degree of confidence.
Source 1 Ofcom Media Literacy Tracker
3.6. The Ofcom Media Literacy Tracker 2020/21 provides data on Reddit’s
263,264
general usage by children under 15 years old. For the 2020/21
Ofcom Media Literacy Tracker, all parents of children aged 3 to 7 who
took part were recruited to answer about, and on behalf of, their
child. In households with children aged 8 to 15 years old, both the
parent and the child were invited to take part. 265 Households
completed the survey online, through panel interviewing. 266
Source 2 Ofcom Children’s Media Literacy Tracker
3.7. From 2021 onwards, the Ofcom Media Literacy Tracker survey was
renamed as the Ofcom Children’s Media Literacy Tracker. The data is
provided by the Parents’ and Children’s Online Behaviours and
Attitudes surveys.
3.8. The Ofcom Children's Media Literacy Tracker 2021 267, 2022 268 ,
269 270
2023 , 2024 provide data on Reddit’s overall usage by children
263
Reddit’s children usage data is introduced in the Ofcom Media Literacy Tracker survey
from 2020/21 onwards, and account data is only available from 2021 onwards (reported in
the 2021Parents’ and Children’s Online Behaviours and Attitudes survey). See Ofcom’s
Children’s Media Literacy 2020 (Survey 2) aged 3-4 data tables.pdf and Ofcom’s Children’s
Media Literacy 2020 (Survey 2) aged 5-15 data tables.pdf.
264
Ofcom’s Children's Media Literacy Tracker 2020/21 does not provide percentages for the
16-17 year group.
265See Ofcom’s Children Media Literacy 2020 Technical Report.
266Ibid.
267See Children's Media Literacy Survey 2021 Online Behaviours and Attitudes Wave 2 Data
268les for 2021 accounts and user data.
See Children's Media Literacy Tracker 2022 - Children's Online Behaviour and Attitudes
Wave 2 Data Tables for 2022 accounts and user data.
269See Children’s Media Literacy Tracker 2023 – Children’s Online behaviour and Attitudes
Data Tables for 2023 accounts and user data.
270
Children’s Media Literacy Tracker 2024 – Children’s Online behaviour and Attitudes Data
Tables for 2024 accounts and user data
171 2024 728 755 770 779 797 819 813 816 835 855 855 844 838 846 817
2023 734 749 758 776 799 794 798 818 839 840 830 824 832 801 788
2022 734 744 762 786 781 786 806 828 830 820 815 822 790 773 771
2021 732 751 775 770 775 796 818 822 810 807 814 782 766 764 759
2020 783 808 807 813 831 855 842 826 817 824 797 781 753 741 723
275
Source: Office for National Statistics, series MYE2.
3.11 .The Ofcom sources provide the percentages of children that use or
have accounts with Reddit. To arrive at our estimates, we have
therefore multiplied the percentages reported in the Ofcom surveys
for each of the age groups with the ONS UK population numbers.
3.12. We have assumed that where Ofcom data have provided a percentage
to indicate user or account holders for an age range, rather than for
individual ages, the percentage can be used as an estimate for each
age in that range.
4. Account number estimates
4.1. This section sets out the account number estimates for Reddit for
children aged 3 to 12 years old and 13 to 17 years old. We have used
the Ofcom Children Media Literacy Tracker for the estimation, noting
that questions addressing Reddit account numbers were introduced to
the Ofcom Children’s Media Literacy Tracker in the 2021 survey.
4.2. Figure 3 below shows account number estimates for children between
the ages of 3 to 12 years old covering the period from 2021 to 2024,
while Table 2 shows how they have been derived. Account numbers of
3- to 12-year-olds have fluctuated from 49,000 to 89,000 for the
period from 2021 to 2024.
Ages 3 to 12 years old
275 Available at: Estimates of the population for the UK, England, Wales, Scotland, and
Northern Ireland - Office for National Statistics (accessed 18 February 2026).
173Figure 3: Estimates of Reddit account holders aged between 3 to 12 years old during 2021
to 2024
100,000
90,000
80,000
70,000
60,000
50,000
40,000
30,000
20,000
10,000
-
2021 2022 2023* 2024
Source: ICO calculations based on Ofcom and ONS data.
4.3 Figure 3 appears to show a notable drop in account holders aged 3 to
12 in 2023, and this can be explained with the aid of Table 2 below.
Table 2 breaks down the ICO’s calculations by age and by year. It
shows that data are omitted for children aged 3 and 4 in 2021, 2022,
and 2023. In 2023, data is also omitted for those aged 8 to 11 in
2023. These data have been rounded down to zero in the Ofcom
dataset. As a result, the total number of children with Reddit accounts
in 2023 is calculated using only the data available for children aged 5,
6, 7 and 12 years old.
174 and estimates have ranged from 136,000 in 2022 to 304,000 in 2020.
The latter was the highest number of users aged 3 to 12 years old
observed in the 2020 to 2024 period.
Figure 5: Estimates of Reddit users aged between 3 to 12 years old during 2020 to 2024
350,000
300,000
250,000
200,000
150,000
100,000
50,000
-
2020 2021 2022 2023 2024
Source: ICO calculations based on Ofcom and ONS data.
(MULTI CODE); based on an effective weighted sample of 2657.
Unweighted sample size total for 2021 was 3355, for 2022 was 3417, for 2023 was 3383
and for 2024 was 3406.
178Figure 6: Estimates of Reddit users between the ages of 13 to 17 during 2020 to 2024
400,000
350,000
300,000
250,000
200,000
150,000
100,000
50,000
-
2020 2021 2022 2023 2024
Source: ICO calculations based on Ofcom and ONS data.
5.4. There are higher numbers of Reddit users amongst the 13 to 17 years
old age group, compared to the 3 to 12 years old age group. The
number of users in the 13 to 17 years old age group has seen
relatively little fluctuation over the years from 2021 to 2024, ranging
from 350,000 in 2021 to 311,000 in 2024. In 2020, the estimated
number of users was 210,000. This number is likely to be an
underestimate because of the lack of data in 2020 for 16- and 17-
year-olds, as shown in Table 5 below.
180 4%). The underlying data for these percentages is from the Ofcom
Children’s Media Literacy 2022 data tables that we have used in our
analysis. We have derived user estimates broken down by each
individual age in the age group 3 to 17 years old, whereas Reddit in
their response referenced percentage use by gender for the
aggregated age group of 3 to 17 years old. We noticed discrepancies
between the percentages reported in the 2023 ‘Children and Parents:
Media Use and Attitudes’ report’ and the corresponding underlying
data tables, where for the age group 3 to 17 years old, boys’ use is
5% and girls’ use is 3%. These discrepancies could be due to
rounding errors.
5.8. Reddit’s reference to only 6% of boys’ and 4% of girls’ use of the
platform in 2022 appears to suggest that it considers these
percentages low. Our analysis demonstrates that although the
percentages may seem low, when these are applied to the number of
children in the UK, they result in annual estimates of approximately
300,000 children between the ages of 13 to 17 years old that have
used Reddit from 2021 to 2024.
Ofcom Teen News Consumption Survey for 12- to 15-year-olds
5.9. Table 6 below provides additional user number estimates for those
between the ages of 12 to 15 years old that use Reddit for news
284
consumption, covering the period from 2021 to 2024. We have
used the Ofcom Children’s News Consumption survey 2021 and the
284
Based on responses to the following question from the Ofcom Children’s News
Consumption Survey 2021 and the Ofcom Teens News Consumption Surveys 2022, 2023
and 2024:
Q: Which, if any, of the following do you use to read, watch, listen to or follow news stories?;
Unweighted sample size total for 2021 was 1,010, for 2022 was 1,001, for 2023 was 1,003
and for 2024 was 1,007.
Sources available at Childrens News Consumption Survey 2021 data tables (XLSX, 4.1 MB)
for 2021 data, Teens News Consumption Survey data tables (XLSX, 3.3 MB) for 2022, Teens
News Consumption Survey data tables for 2023 data, and Teens News Consumption Survey
data tables (XLSX) for 2024 (accessed 31 October 2025).
1826. Other sources considered
6.1. Reddit provided three sources with the percentage of UK users aged
below 13 years old and between the ages of 13 to 17 years old in its
response to the ICO in March 2024. Apart from the Ofcom Children’s
Media Literacy Tracker 2022 that was discussed in the previous
section, the additional two sources are , an audience research
firm, and a multi-platform audience tracker. Reddit has
access to both platforms’ insights via subscription. We have considered
these sources as part of our estimates for the number of Reddit
account holders and users aged 3 to 12 years old and 13 to 17 years
old.
6.2. First, we consider the data, which indicate the percentage of UK
Reddit users between the ages of 16 and 18 years old. surveys
require participants to be above 16 years old and the survey identifies
users that are below 18 years old. 285
• In Q1 2021 of Reddit users were above 18 years old.
• In Q2 2021 of Reddit users were above 18 years old.
• In Q3 2021 of Reddit users were above 18 years old.
• In Q4 2021 of Reddit users were above 18 years old.
• In Q1 2023 of Reddit users were above 18 years old.
• In Q2 2023 of Reddit users were above 18 years old.
• In Q3 2023 of Reddit users were above 18 years old.
285Reddit response Exhibit 1 to ICO letter on 1 March 2024.
184 ANNEX 3
EXTRACTS FROM WALKTHROUGH HARM ASSESSMENT ( APRIL
2025) AND WALKTHROUGH CONCERNING CERTAIN PLATFORM
FEATURES (JANUARY 2026)
CONTENT WARNING
Please note that this document contains content relating to suicide and eating
disorders as well as content of a sexual nature. This content is considered to be
potentially harmful to children and some adults might also find it upsetting. Some
images have been blurred or partially redacted to protect personal data and/or
conceal explicit content.
1. Introduction to Annex 3
1.1. This Annex contains a summary of the research conducted in respect
of the potentially harmful content available on the Platform as well as,
separately, certain features of the Platform, specifically:
a) the Watch feed;
b) the Media search tab; and
c) Reddit’s request that users enter their age at the point at which the
user seeks to open a Reddit account.
2. Background to Harm Assessment
2.1 The examples of content, which are set out in section 7 of this Annex,
are taken from a review of the Platform which was conducted by the
Commissioner’s Intelligence Department on 24 April 2025.
1882.2 The Intelligence Department’s work was conducted using an iOS device
and separately using an Android device.
2.3 The review was of content displayed both on the Reddit App and the
Website. For the purposes of the review, the Website was accessed via
a web browser (Google Chrome, in the case of the Android device, and
Safari, in the case of the iOS device).Evidence was collated within a
secure, non-networked test environment, employing devices used
exclusively for testing, to replicate real user behaviour under controlled
conditions
2.4 The results, set out section 7 below, indicate whether content was
viewed while the user was logged into or out of a Reddit account.
3. Mature content settings
3.1 When accessing Reddit while logged-in to an account, ‘Mature content’
was off by default on all operating systems, meaning that content
flagged as ‘mature’ would not be delivered to users in search results or
otherwise included as recommendations to such users. Mature content
control options were found in device settings (iOS) and app settings
(Android).
3.2 There is a simple toggle within settings which can be used to switch
mature content on, which reads: “Show mature content (I’m over 18).
See Not Safe for Work mature and adult content in your feeds and
search results.” This toggle was used during the research to switch
mature content to ‘on’.
4. Overview of key findings in respect of harm assessment
4.1 Logged-out users - While logged-out of a Reddit account (where
189 clearly no mature content settings were in place), potentially harmful
content relating to suicide and eating disorders was returned in
response to entering the search terms ‘r/suicide’ and ‘ED’.
4.2 Logged-in Users - When mature content was switched to on:
a) Links to pornographic content which is potentially harmful to
children were returned in response to entering the search
term ‘r/nsfw’.
b) Such links also appeared in Reddit’s ‘suggested search’ in
response to simply entering the search term ‘r’.
c) The content referred to in sub-paragraphs (a) and (b) above
were flagged to the user as ‘NSFW’ content.
5. Overview of the Watch feed
5.1. As referred to in paragraph 68(a) of the Notice, Reddit deployed the
Watch feed, which is “an option for video lovers to optimize their feed
for video content”, in or after March 2023.
5.2. Figures 4.1 and 4.2 of this Annex illustrate the way in which a Logged-
in User may find and scroll through the Watch feed within both Reddit’s
Android App and iOS App. The Watch feed is not available via a browser,
either when using a mobile or a desktop.
5.3. A Logged-in User may find the Watch feed by opening a drop-down
menu in the top-left corner of their home feed (i.e., the main landing
page which users see when opening the Platform) and choosing
“Watch”. This allows the Logged-in User to scroll through short-form
videos as illustrated by Figures 4.1.ii to 4.1.iv and 4.2.ii to 4.2.iv.
1906. Overview of the Media search tab
6.1. Reddit deployed the Media search tab in or after October 2023. As per
paragraph 68(a)] of this Notice, the Media search tab allows users “to
browse media results – videos, GIFs, and images – all at once”.
6.2. Figures 5.1, 5.2 and 5.3 of this Annex 3 illustrate the way in which a
Logged-out User of the Platform using a browser and a Logged-in User
of the Platform using Reddit’s Android App or iOS App might find and
scroll through filtered search results using the Media search tab.
191Figures 4.1.iii and 4.1.iv illustrate how the user may scroll through short-form
audio-visual content contained in the Watch feed.
200Figures 5.1.ii and 5.1.iii illustrate how the Logged-out User may filter the search
results using the Media search tab and scroll through the filtered search results,
which consist of audio-visual content.
204 Figures 5.2.ii and 5.2.iii illustrate how the Logged-out User may filter the search
results using the Media search tab and scroll through the filtered search results, which
consist of audio-visual content.
206
