United Kingdom

Reddit, Inc.

16,610,000 €

GDPR enforcement action by Information Commissioner (ICO) on 2026-02-23.

Rank · Sector

#23

of 369 in Media, Telecoms and Broadcasting

Rank · United Kingdom

of 28

Rank · All fines

#35

of 3,051

Case details

Authority: Information Commissioner (ICO)
Date: 2026-02-23
Controller / Processor: Reddit, Inc.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 (1) a), b), f) GDPR, Art. 8 GDPR, Art. 35 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The UK DPA has imposed a fine of £14,472,500 (EUR 16,610,000) on Reddit, Inc. The controller offers a social media platform that is also available in the UK. The platform enables users to interact with each other and also, but not exclusively, includes content that may be inappropriate for children. The controller failed to implement an age-verification procedure even though minors were using the platform. The controller also failed to implement an adequate cookie consent procedure to obtain adequate consent from minors. Lastly, the controller failed to carry out a risk assessment regarding the processing of minors' data.

---Update---
The controller has appealed against the DPA's decision to the First-tier Tribunal.

Open original source Links to the regulator's original publication or another source.