The regulator wrote to Reddit about its missing child safety checks one day after its own code's compliance deadline passed. The fine did not arrive for another four and a half years.
Estimated reading time: 8 minutes
In short. The ICO's Children's Code required every online service likely to be used by children to bring its data practices into line by 2 September 2021, including a working way to check who is a child. The regulator's own risk assessment flagged Reddit and Imgur's owner MediaLab as high risk in May 2021, and wrote to Reddit the day after the deadline passed. Reddit's own penalty notice records it had no age checks of any kind until July 2025; the fine, £14,472,500, did not follow until February 2026, and Reddit is appealing it. MediaLab, contacted three years later than Reddit despite being flagged the same week, chose to leave the UK market rather than build the checks. Three documented mistakes: four stars.
On 3 September 2021, one day after the compliance deadline for its own flagship code on children's data protection, the Information Commissioner's Office wrote to Reddit asking how the platform was getting on. At the time, Reddit's website had no age checks of any kind. Anyone could land on it and read what was there; anyone who wanted to post, or to see content marked for adults, was simply asked to tick a box declaring they were over 18. Nobody checked. That letter was not the end of the story about Reddit and children's data. ICO's own penalty notice, published five years later, shows it was closer to the start.
What the code requires
The Children's Code exists because Parliament told the Commissioner to write it. Section 123(1) of the Data Protection Act 2018 requires the Commissioner to "prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children" [5]. The Commissioner's own foreword to the resulting code puts the scale of what that covers plainly: "One in five UK internet users are children, but they are using an internet that was not designed for them" [1]. Organisations in scope, which the code says explicitly is not limited to services aimed at children, were told to conform by 2 September 2021 [2].
Standard 3 of the code, age appropriate application, is where that promise becomes a specific instruction: "Take a risk-based approach to recognising the age of individual users and ensure you effectively apply the standards in this code to child users. Either establish age with a level of certainty that is appropriate to the risks to the rights and freedoms of children that arise from your data processing, or apply the standards in this code to all your users instead" [3]. On enforcement, the code is equally direct about its own intentions: "We will monitor conformance to this code through a series of proactive audits, will consider complaints, and take appropriate action to enforce the underlying data protection standards," targeting "organisations and individuals suspected of repeated or wilful misconduct or serious failure to comply with the law" [4].
The claims, tested
| The code's own words | What the record actually shows | Verdict |
|---|---|---|
| Standard 3 requires services likely to be accessed by children to "establish age with a level of certainty that is appropriate to the risks" or apply the code's protections to everyone [3], in force since 2 September 2021 [2] | Reddit's penalty notice: "Until July 2025, Reddit had no form of age assurance that users were required to pass through in order to access the Platform" [8] (page 7). MediaLab's penalty notice finds it "failing to implement any measures to check the age of users" of Imgur [10] (page 23), and MediaLab later told the ICO it was "no longer investigating age assurance in relation to the UK market" because it planned to leave instead [10] (page 21) | Standard 3's deadline was nearly four years in the past by the time either company acted. One built no age check at all until forced to; the other never built one, and left the market instead |
| The code's enforcement section: "We will monitor conformance to this code through a series of proactive audits," part of being "proactive in identifying and mitigating new or emerging risks" [4] | The ICO's own risk assessment on 18 May 2021 flagged social media and messaging as high risk, catching Reddit, and separately flagged MediaLab's Imgur, then ranked the eleventh most common site or app for UK children watching video content [8] (page 13), [10] (page 9). Reddit received its first letter the next day, 3 September 2021 [8] (page 13). MediaLab did not hear from the ICO until 21 August 2024, over three years after the same risk assessment named it [10] (page 9) | The proactive audit worked immediately for one company flagged in May 2021. Reaching the next one identified in the very same assessment took more than three years, with no explanation on the record for the gap |
| The Children's Code strategy, running since April 2024, targets "social media platforms (SMPs) and video sharing platforms (VSPs)"; government's own proposals now name Snapchat, TikTok, YouTube, Instagram, Facebook and X as platforms the ICO is "currently engaging with as part of our Children's code strategy" [6] | Two years into that strategy and five years past the code's own deadline, exactly two fines have been issued: Reddit, still under appeal to the First-tier Tribunal as of today [7], and MediaLab, which has since left the UK market [9]. Of the largest platforms, the ICO's own words describe only "commitments" from Snapchat, an "open letter," and services where "we're considering... whether further action is required" [6] | The strategy has reached two companies with finished, published enforcement outcomes. The platforms carrying most of the child audience it names are still at the letter-and-commitment stage, with no published date for anything firmer |
The mistakes, counted
Standard 3's age-check requirement was still unmet by both companies the code has actually fined (1). The deadline for online services to establish who is a child, in some proportionate way, was 2 September 2021 [2]. Reddit's own penalty notice records it had no age assurance mechanism of any kind until it introduced one in July 2025, nearly four years later, and that it failed to carry out a data protection impact assessment on the risk to children until January 2025 [8] (pages 4, 7). MediaLab never built one at all: it told the ICO in 2025 that it was abandoning age-assurance work for the UK market because it had decided to leave that market instead, geo-blocking UK users by the end of September 2025 [10] (pages 20-21).
The code's own proactive risk assessment worked, but at wildly different speeds for companies flagged on the same day (2). On 18 May 2021, the ICO ran a single risk assessment that identified both Reddit's sector and MediaLab's Imgur as high risk to children [8] (page 13), [10] (page 9). Reddit got a letter the next working day after the code's own deadline, 3 September 2021. MediaLab did not get its first letter until 21 August 2024 [10] (page 9), over three years after the same assessment named it, despite Imgur's own ranking as one of the more commonly used video platforms among UK children at the time it was flagged. The tool that is meant to make enforcement proactive rather than complaint-driven produced two very different outcomes from one assessment.
Five years after the deadline, the strategy's completed enforcement record is two companies, neither now offering a compliant, available UK service (3). Reddit's £14,472,500 fine, reduced from a proposed £17,573,750 after its written representations [8] (pages 4-5), is under appeal to the First-tier Tribunal with no published outcome [7]. MediaLab's £247,590 fine came after the company had already told the ICO it intended to leave the UK altogether, "on the basis that market conditions are such that operations are no longer viable in this region" [10] (page 20), and it geo-blocked UK users rather than build the checks. The platforms named in the government's own current proposals as carrying the largest child audiences, Snapchat, TikTok, YouTube, Instagram, Facebook and X, remain at the stage the ICO itself describes as commitments and engagement, not enforcement [6].
Credit where due
The risk assessment behind all of this was right. The ICO identified Reddit and MediaLab as high risk in May 2021, years before either was fined, and both penalty notices are detailed, evidenced documents rather than a nominal slap: 209 pages for Reddit, 111 for MediaLab, each working through years of correspondence, statutory information notices and the companies' own submissions [8] [10]. The strategy's August 2026 update also shows real work that never needed a fine to succeed: Snapchat and Instagram changed their interactive map features to make location sharing clearer to children after ICO engagement, not enforcement, and a campaign aimed at parents reached an estimated 1.2 million UK households [6]. And the ICO did not go easy on the smaller target: MediaLab, a far smaller company than Reddit, was pursued and fined on the same legal grounds, not waved through because the numbers were smaller.
Verdict
Four stars, from three documented mistakes. The Children's Code is a real, specific standard, and the ICO's risk-based approach to finding non-conformant services genuinely worked: it named Reddit and MediaLab as risks years before either faced a penalty. What the record does not support is the code's own promise of proactive, timely enforcement. Reddit ran with no age checks for almost four years after the ICO first asked about them, and the fine for that arrived four and a half years after the letter. MediaLab was flagged in the same week as Reddit and waited three years longer for its first letter, then left the UK rather than fix the problem. Two results from five years of a proactive code aimed at every online service children use is not proof the mechanism is broken. It is proof that, so far, it moves years slower than the platforms it is meant to police.
Sources
- Age appropriate design: a code of practice for online services, ICO
- Transitional arrangements, ICO Children's Code
- 3. Age appropriate application, ICO Children's Code
- Enforcement of this code, ICO Children's Code
- Data Protection Act 2018, section 123, legislation.gov.uk
- Children's code strategy progress update, August 2026, ICO
- Reddit issued with £14.47m fine for children's privacy failures, ICO, 24 February 2026
- Penalty Notice: Reddit, Inc., ICO, 23 February 2026
- Imgur owner MediaLab fined over children's privacy failures, ICO, 5 February 2026
- Penalty Notice: MediaLab.AI, Inc., ICO, 4 February 2026