Reddit, Inc.

What the regulator decided

Reddit did not apply any robust age-assurance mechanism on its UK service and therefore had no lawful basis under Article 6 or Article 8 UK GDPR for processing the personal data of UK children under 13; the lawfulness and fairness principle in Article 5(1)(a) was breached and Reddit had not carried out a data protection impact assessment to assess and mitigate risks to children, in breach of Article 35 UK GDPR, before January 2025.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR amount approximate. Cite when a scanner finds an online service with under-13 reach and no age-assurance signal beyond a self- declared birth-date - the ICO has now ruled explicitly that self-declaration without verification is not lawful basis under Article 8.