The ICO also said Reddit had not carried out a Data Protection Impact Assessment focusing on the risks of using children’s personal information before January 2025, even though children between 13 and 18 were allowed to use the platform.
Confirmation of the fine follows the issuing of provisional decision against Reddit last year. It is the second and largest the ICO has issued for failing to comply with its Children’s Code, following a £250,000 penalty issued to MediaLab, operator of Imgur, earlier this month.
The ICO said Reddit was issued a larger fine due to its size, the number of children affected by its infringement, and the degree of potential harm caused.
Edwards said the ICO would continue to monitor companies for relying on users to self-declare their age, saying it is “not enough when children may be at risk.”
“I therefore strongly encourage industry to take note, reflect on their practices and urgently make any necessary improvements to their platforms,” he said.
A Reddit spokesperson said the company plans to appeal the ICO’s decision.
“Reddit doesn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety. The ICO’s insistence that we collect more private information on every U.K. user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety,” the spokesperson said.