Reddit, Inc – €16,932,825 Fine (United Kingdom, 2026)

Reddit, Inc. (the controller) operates the online website and mobile application Reddit (the Platform), a social news, discussion and content rating platform. Between May 2018 and July 2025, the controller had no form of age assurance that users were required to pass through in order to access the Platform. Users with an account were asked to declare whether they were over 18 years old without any age verification. Furthermore, for personal data processing via advertising and analytics cookies for children under 13 years old, the controller did not ensure that the holder of parental responsibility gave consent. In addition, between May 2018 and January 2025, the controller did not conduct any data protection impact assessment in relation to the processing of children’s personal data. The DPA found that the controller breached Article 5(1)(a) UK GDPR by processing the personal data of children under 13 years old on the Platform unlawfully since the processing activities were not fair or transparent and none of the legal bases under Article 6(1) UK GDPR applied. The DPA also held that the controller could not rely on consent under Article 6(1)(a) UK GDPR as a lawful basis for processing the personal data of children under 13 years old on the Platform as it breached Article 8 UK GDPR which required that consent was given or authorised by the holder of parental responsibility. Finally, the DPA found that the controller failed to carry out a data protection impact assessment in accordance with Article 35(1) UK GDPR in respect of the processing of the personal data of children under 18 years old in the context of the provision of an online service. Therefore, the DPA fined the controller £14,472,500 (approximately €16,756,188).