Regulator announcement; this article does not establish payment or the outcome of any subsequent appeal.
What happened
The ICO’s enforcement entry records a £14,472,500 penalty against Reddit in February 2026. It found that the service lacked robust age assurance and therefore lacked a lawful basis for processing information about children under 13. It also identified the absence of an appropriate data protection impact assessment before January 2025.
Source: ICO — original source ↗
What it means for your website
The practical question is whether the design of a service matches the people who actually use it. A family-facing website, community forum or learning platform may need a more careful assessment than a basic business brochure. Avoid treating an age box as a universal solution. Ask what it achieves, how easily it can be bypassed and what additional information it collects. Where children may be affected, get advice that covers both the product and the data practices behind it. A high website scan score is not proof that these wider obligations have been met.
Three useful next steps
- Consider the likely audience, not just the intended audience.
- Review privacy risks before launching new account features.
- Document why the selected safeguards are appropriate.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
ICO — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.