The UK information regulator has fined the social news service Reddit £14.5m for using the data of children under the age of 13 unlawfully and potentially exposing them to inappropriate and harmful content.

The hefty punishment from the Information Commissioner’s Office (ICO) is the largest fine yet for a breach of children’s privacy and comes after the US-based company introduced age checks in July, including age verification to access mature content. Prior to this, the ICO said, there were “a large number of children under 13 on the platform and Reddit did not have a lawful basis for processing their personal information”.

Reddit asks users to declare their age when opening an account but the ICO said relying on self-declaration presented risks to children as it was easy to bypass. The regulator also found Reddit failed to carry out a data protection impact assessment to assess and mitigate risks to children before January 2025.

“Children under 13 had their personal information collected and used in ways they could not understand, consent to or control,” said John Edwards, the information commissioner. “That left them potentially exposed to content they should not have seen. This is unacceptable and has resulted in today’s fine.”

It is the third largest financial punishment the ICO has issued, after a £20m fine for a British Airways data breach affecting more than 400,000 customers in 2018, and an £18.4m fine for the Marriott Hotel group when more than 300m customer records were affected in a 2014 attack.

Reddit said it would appeal against the decision. “The ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety,” a spokesperson said.

The company said it did not require users to share information about their identities, regardless of age, “because we are deeply committed to their privacy and safety”. It says it removes users under the age of 13 because they are not allowed. Its user agreement states that “by using the services, you state that you are at least 13 years old”.

Since last July, Reddit started requiring UK users who want to view mature content such as pornography to show they are over 18 by uploading a selfie or a photo of their government ID, in order to comply with the Online Safety Act.

Edwards said: “Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they’re not exposed to risks through the way their data is used. To do this, they need to be confident they know the age of their users and have appropriate, effective age assurance measures in place. Reddit failed to meet these expectations.”