On 24 February 2026, the UK Information Commissioner’s Office fined Reddit £14.47 million for using children’s personal information unlawfully. Buried in the press release is the sentence that should reset how every consumer platform thinks about age. UK Information Commissioner John Edwards: “Relying on users to declare their age themselves is not enough when children may be at risk and we are focusing now on companies that are primarily using this method.”
Read that again as an engineering statement, not a press quote. The most common age control on the internet — the “I am over 18” checkbox, the date-of-birth dropdown, the self-attested age at signup — has just been declared legally insufficient by a regulator that issues fines scaled to global turnover. The checkbox was always a hope dressed as a control. The ICO just put a price on the hope.
This post is about why this fine generalizes far beyond Reddit and far beyond the UK: why self-declaration fails as a control, why it fails twice under the law most teams aren’t thinking about, and what “effective and proportionate” age assurance actually requires.
This was a data protection fine, not an online-safety fine
The first thing to register is which regulator acted and under which law. This was not Ofcom enforcing the Online Safety Act. It was the ICO enforcing UK GDPR and the Age Appropriate Design Code — the Children’s Code. That distinction is the whole story.
Most product teams file “age assurance” under content gating: keep minors away from adult material, satisfy the OSA, move on. The ICO reframed it as a data-processing problem, and the logic is airtight. If you cannot establish how old a user is, you cannot establish a lawful basis for processing that user’s personal data when the user is a child. The ICO found that Reddit “failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13.” Every under-13 account on the platform was, in the regulator’s view, unlawful processing — not because of what those children saw, but because the company never had a lawful footing to collect their data in the first place.
This is the second front that the dual ICO–Ofcom compliance picture has been pointing at. A platform can be entirely focused on its OSA obligations and still be exposed under data protection law for the exact same gap. Two regulators, two legal theories, one missing control. The ICO has said explicitly it will “work closely with Ofcom to ensure efforts are coordinated.” Treating age assurance as a single-regulator problem is now a planning error.
What Reddit actually did — and why it still wasn’t enough
It is worth being precise about Reddit’s posture, because it is the posture of most of the internet. Reddit’s terms of service prohibited under-13s from using the platform. That is the classic defense: we don’t allow children, it’s in the terms. The ICO’s response was that a prohibition in the ToS is a disclaimer, not a control. Reddit “did not have measures in place to check the age of users accessing its platform until July 2025,” and the ICO’s own estimates indicated a large number of under-13s were on it anyway. A rule you do not enforce is not a safeguard; it is a sentence in a document no child reads.
When Reddit did act, in July 2025, it added age verification to access mature content and asked users to declare their age when opening an account. The ICO’s verdict on the self-declaration half: it “presents risks to children as it is easy to bypass.” That is the crux. Adding a self-declared age field is not adding assurance. It is adding a field.
This is the same category error we flagged when platforms leaned on payment instruments: a credit card is not proof of age, and a self-asserted birthday is not proof of anything at all. Both feel like checks. Neither is one.
Why the checkbox always fails
Strip away the legalese and self-declaration fails for a reason that is structural, not fixable with better copy. Look at the incentives of the three people who encounter the field.
The motivated minor lies. A 12-year-old who wants in types a birth year that clears the gate; the cost of lying is one keystroke and there is no penalty for getting caught, because nothing checks. The honest adult clicks through on autopilot, contributing no signal because the field was never adversarial for them. And the platform retains no usable evidence either way — a stored “user said they were 19” is worthless in front of a regulator, because it records the question, not the answer’s truth.
Self-declaration is optimized for the one thing it is good at: conversion. It is a frictionless UX speed bump that lets a signup flow continue while looking like due diligence. That is precisely why it is everywhere, and precisely why the ICO singled out companies “primarily using this method.” The control with the best completion rate is the control with the least evidentiary value. Those two facts are the same fact.
Self-declaration fails you twice
Here is the part teams miss. The Reddit decision names two principal failings, and self-declaration is implicated in both.
The first is the lawful-basis gap above: no robust age check means no lawful basis for processing children’s data. The second is procedural — Reddit “had not carried out a data protection impact assessment (DPIA) focusing on the risks of using children’s personal information before January 2025,” even though teenagers were permitted on the platform. The DPIA failure is its own count, and it compounds the first: you cannot meaningfully assess the risk your processing poses to children if you have no reliable idea which of your users are children.
So a self-declaration-only posture is not one weak control. It is a control that simultaneously (a) fails to keep underage users out, (b) deprives you of a lawful basis for the data you then collect from them, and (c) makes the mandatory risk assessment impossible to do honestly. One missing capability, three distinct findings. That is how a single design shortcut turns into a £14.47M penalty.
And the penalty scales in a way that should worry incumbents most. The ICO said it set the amount by reference to “the number of children affected by this infringement, the degree of potential harm caused, the duration of the failings, and Reddit’s global turnover.” Each of those four multipliers rewards exactly the platforms that have run a checkbox the longest at the largest scale. The longer self-declaration has been your answer, the bigger the liability you have been quietly accruing.
This is a pattern, not a one-off
Reddit was not isolated. Weeks earlier, on 5 February 2026, the ICO fined MediaLab, the owner of Imgur, £247,590 for related children’s-privacy failures. The ICO has framed both inside a broader supervision programme set out in its December 2025 Children’s Code strategy update, with a stated focus on high-risk services that rely primarily on self-declaration.
Nor is this a UK peculiarity. The same principle — that asking an age is not assuring it — is converging across jurisdictions: AADC-style design codes, COPPA’s verifiable-consent regime in the US, Australia’s social media age rules, and the expanding patchwork of US state laws. The enforcement risk is no longer theoretical or geographic; it is a standing line item for any service likely to be accessed by children. The checkbox is becoming uninsurable everywhere at once.
The privacy paradox — and the wrong overcorrection
The obvious reaction is to overcorrect: if a checkbox isn’t enough, collect government IDs and dates of birth from everyone and store them. That instinct fails the same Children’s Code it is meant to satisfy. The Code demands data minimization and “a high level of privacy by default” at the same time as effective age assurance. A platform that responds to a self-declaration fine by building a centralized vault of customer IDs has traded a non-control for a fresh liability — a breach magnet and a disproportionate-collection finding waiting to happen.
The ICO is explicit that the standard is proportionality, not maximalism: organisations “should match the age assurance method they use to the level of risk on their platform.” Effective does not mean invasive. The resolution is age assurance that does not become surveillance: verify the fact you need (is this user over the threshold?) without retaining the identity documents you don’t. Privacy-preserving techniques exist precisely so “effective” and “minimal” stop being in tension.
What “effective and proportionate” actually looks like
Translating the ruling into architecture, four properties do the work.
Match the method to the risk. A low-risk surface can lean on age estimation or inference; a service that bars under-13s, or gates genuinely adult content, must enforce that boundary with methods strong enough to resist a motivated user — document plus NFC chip verification for the cases that demand certainty. A single method for every surface is either too weak where it matters or too invasive where it doesn’t.
Return a decision, not a dossier. The output of an age check should be a threshold result — over or under the line — not a stored birthday or a retained ID image. You cannot leak, subpoena, or misuse data you never kept.
Verify once, reuse the result. Re-collecting identity on every interaction is both bad UX and bad data hygiene. A reusable, user-held credential lets a returning user prove the same fact without the platform re-acquiring sensitive data each time.
Keep the evidence, not the identity. The defensible artifact in front of a regulator is the record that a check happened, which method ran, and what assurance level it produced — the evidence trail, not the underlying ID. “We know the age of our users, and here is how” is the answer the ICO is asking for. “We asked them” is the answer that costs £14.47M.
How Xident handles it
Xident is built for the exact gap this fine exposes: knowing the age of your users without becoming the surveillance database the Children’s Code warns against. The first gate is client-side facial age estimation under liveness, returning a threshold classification — over or under 12, 15, 16, 18, 21, or 25 — rather than a self-asserted birthday or a guessed date. Where the result is uncertain or the surface is high-risk, the flow escalates automatically to document OCR, face match, and NFC chip verification, so the boundary that the regulator cares about is enforced by a method a child cannot type their way past.
Crucially, the system is designed to produce a decision and an audit record, not a data hoard. Results are threshold classifications logged with their method and assurance level; Xident does not retain a date of birth or ID image beyond the check itself, which is the data-minimization posture the Children’s Code expects and the breach-surface reduction your security team wants. A reusable Xident token lets returning users prove the same fact without re-collecting identity, and the per-decision evidence trail is the artifact you hand an ICO or Ofcom inquiry. The result is a defensible answer to the only question that mattered in the Reddit case: do you know the age of your users, and can you prove how?
The uncomfortable takeaway from 24 February 2026 is that the most popular age control on the internet is now a documented liability, and the regulator has said it is actively hunting for the platforms that still rely on it. The checkbox was never a safeguard — it was a way to keep signups flowing while gesturing at diligence. Before your next audit, answer one question honestly: if a regulator asked how you know a given user isn’t a child, is your real answer “we asked them”? If it is, you are not looking at a product gap. You are looking at the next press release.
Children’s online safety is a sensitive area, and the regulatory standard is still moving. This post is general information about a public enforcement action, not legal advice; consult qualified counsel for your specific obligations.
