Back to school transition: protecting children's data after the Reddit fine
Back to school, back online: what organisations should learn from the Reddit fine
The ICO's enforcement action early this year against Reddit is a useful reminder that children's privacy obligations do not only apply to services designed for children. They apply to services that children are actually using.
This distinction matters!
Many organisations still assume children's privacy is someone else's problem because their product is aimed at adults. The regulator's position is increasingly clear: what matters is not who a service was built for, but whether children are likely to access it.
The conversation is becoming even more important as we look ahead to the Government's planned restrictions on under-16 social media accounts from spring 2027 and the growing use of age assurance technologies.
That creates an interesting challenge. Organisations need to know enough about their users to protect children, while still respecting principles such as data minimisation, fairness and transparency.
In my latest blog, I explore:
📚 What the Reddit and Imgur decisions tell us about the regulator's expectations
📚 Why the Children's Code applies more broadly than many organisations realise
📚 How the UK GDPR accountability principles look when viewed through a child's eyes
📚 The role of DPIAs, age assurance and AI governance
📚 Practical steps organisations can take between now and spring 2027
As children head back to the classroom, organisations might consider a quick revision session of their own, and review the first place regulators look when marking your homework.
10 minute read
September means packed lunches, forgotten PE kits and the annual scramble for new school shoes. For many children, particularly those starting secondary school, it also means a first smartphone, new group chats and a growing collection of online accounts.
While parents are focused on uniforms and timetables, organisations should be paying attention to something else; a fresh intake of young users entering the digital world. When children start using new apps and services, questions about age assurance, privacy by design and children's rights move from theory to practice very quickly.
This year, those conversations are happening against a very different regulatory backdrop. The Information Commissioner's Office has moved from encouragement to enforcement, the Government has committed to restricting social media for under 16s from spring 2027, and the technologies being deployed to check children's ages are themselves artificial intelligence systems that need governing. I thought it would be useful to set out what has actually changed, and what organisations can sensibly do between now and then.
The ICO's Lessons for Organisations
In February 2026 the ICO fined Reddit £14.47 million for failures relating to children's personal information. Days earlier it had fined MediaLab, the owner of Imgur, £247,590 on similar grounds. On 18 August the regulator published a progress update on its Children's Code strategy, confirming that it had also secured commitments from Snapchat to strengthen age assurance, improved transparency from Instagram and Snapchat on location sharing, completed risk reviews of fourteen age assurance providers, and opened a review of the mobile gaming sector.
The Reddit findings are worth reading closely, because they are interesting. Reddit's terms said that under 13s were not permitted. Until July 2025 there was no mechanism to check. The ICO found a significant number of children under 13 using the platform, with no lawful basis for processing their information. Separately, Reddit had not carried out a Data Protection Impact Assessment (DPIA) addressing risks to children before January 2025, despite knowingly serving 13 to 18 year olds. As the ICO noted when announcing the enforcement action, relying on users to self declare their age is not enough where children may be at risk.
Neither Reddit nor Imgur is a children's service. That is precisely why the decisions matter. The Children's Code applies to information society services likely to be accessed by children, which is a far wider category than services designed for them. Whilst many organisations still assume the Code is somebody else's problem, the key question is not "Was this built for children?" but "Are children using it?".
Before the Bell Rings: A Children's Privacy Refresher
The Children's Code is a statutory code issued under section 123 of the Data Protection Act 2018. It is not a separate regime with separate penalties. It is the lens through which the ICO reads the obligations you already hold under the UK GDPR, which is why the Reddit penalty is a UK GDPR penalty. The clearest way to approach compliance is therefore to work through the seven principles in Article 5 and ask what each one means when the data subject is nine years old.
Lawfulness, fairness and transparency. Article 8 sets the age at which a child can consent to the processing of their personal data in relation to information society services at 13 in the UK. Where a child is under 13, consent must be authorised by a person with parental responsibility. If your chosen lawful basis depends on consent, but you cannot establish whether the user is old enough to provide it, you may be unable to rely on that lawful basis. Transparency must also be age appropriate, meaning privacy information should be presented in a way that children can understand.
Purpose limitation. Data collected to provide a service to a child should only be used for that purpose. Using the same information for advertising, increasing engagement, or training AI models are separate activities that require their own clear justification.
Data minimisation. This is where age assurance creates a genuine balancing act. Organisations should collect the minimum information needed to determine a person's age, not retain copies of passports, driving licences or other documents where a less intrusive solution would achieve the same result.
Accuracy. An incorrect age is not a minor error. It determines which protections a child receives, which defaults apply, and whether profiling is switched on.
Storage limitation. Information collected to verify a user's age should not be kept any longer than necessary. Once the age check is complete, identity documents, facial images and similar evidence should normally be deleted. Retention of age assurance data is one of the simplest areas to get right, yet it is often overlooked.
Integrity and confidentiality. A breach involving children's location data, school information or images carries a severity that adult equivalents do not. Security decisions should reflect that weighting.
Accountability. This is the principle Reddit fell foul of most visibly. The ICO found that risks existed, and that the organisation had never assessed them.
Before Class Begins: The DPIA
Standard 2 of the Children's Code requires a data protection impact assessment for services likely to be accessed by children. In practice, the DPIA is where compliance comes together on paper, and it is often the first document a regulator will ask for.
A children's DPIA needs to go further than a standard template. It should record how you determined that children are likely to access the service, what age ranges you are designing for, what the best interests of the child require in your specific context, and why your default settings, geolocation, profiling and nudge techniques are set as they are. Where you have chosen not to apply a standard, the reasoning belongs in the document.
Age Assurance: Full Marks Aren't Easy
On 25 March 2026 Ofcom and the ICO issued a joint statement confirming what many had suspected. Services meeting the Online Safety Act's highly effective age assurance duties must simultaneously satisfy the UK GDPR and the Children's Code. Age assurance processing is permitted where it is necessary and proportionate to the risk.
The tension is real. To establish that someone is not a child, you generally process more personal data, not less. Facial age estimation, digital identity and one time photo matching are the methods the ICO currently identifies as viable. Each involves a meaningful expansion of processing in the service of protection. The ICO's review of fourteen age assurance providers found compliance gaps in the supply itself, which is a useful reminder that buying a solution does not transfer the accountability. Under Articles 24 and 28 the controller remains answerable for the processor's conduct.
The Next Lesson: What the Under-16 Restriction Means for AI Governance
In summer 2026, the Government announced plans to prevent under 16s from holding social media accounts from spring 2027. The restrictions are expected to be introduced through secondary legislation, using powers created by amendments to the Online Safety Act 2023 under the Children's Wellbeing and Schools Act 2026.
The Government's consultation on the proposals closed in May, attracting around 116,000 responses. Ofcom is expected to provide further clarity on the practical implementation of children's online safety measures during autumn 2026, including issues closely linked to age assurance and age-related protections. The proposed restrictions are expected to apply to social media platforms that facilitate user interaction and rely on algorithmic content feeds. Services focused primarily on private messaging, education or online commerce are expected to fall outside their scope. The proposals go beyond restricting social media accounts for under 16s. They are also expected to introduce limits on livestreaming by children, stronger protections against contact from strangers, and a minimum age of 18 for the use of romantic companion chatbots.
Taken together, these measures point to a future in which organisations will need to be much more confident about the age of their users, while ensuring that the technologies used to make those assessments are fair, proportionate and appropriately governed. That, in turn, brings a new set of AI governance challenges into focus.
The first is that age assurance technologies are themselves AI-driven inference systems. Facial age estimation does not determine a person's age with certainty. Instead, it generates a probability based on the available data. That becomes particularly challenging around age thresholds, where distinguishing between a 15-year-old and a 16-year-old is often far more difficult than distinguishing between a child and an adult. If accuracy varies across characteristics such as skin tone, disability or other protected characteristics, both fairness and equality considerations come into play. Organisations therefore need processes that allow children who are wrongly excluded to challenge the decision and obtain meaningful human review.
The second is recommendation. Standard 12 of the Code expects profiling to be off by default for children. Recommender systems are profiling, and a service that cannot reliably identify which of its users are children cannot reliably switch them off.
The third, where generative AI features such as companions, tutors and image-generation tools are used by, or accessible to, children, organisations should assess them through a combined children's privacy and AI governance lens. Viewing these as separate compliance exercises can result in duplicated effort and gaps in risk management. A single, integrated framework is often better placed to identify and address the full range of risks.
What does this mean for sports organisations?
The Reddit case may involve a social media platform, but the message for organisations is much broader. Sports clubs, governing bodies and community programmes increasingly engage with children through apps, membership platforms, coaching portals, ticketing systems and online communities.
Many organisations may not consider themselves providers of children's services. However, the regulator's focus is increasingly on whether children are likely to access a service, rather than whether it was specifically designed for them. Sports organisations that collect information about junior athletes, academy players, participants or young supporters may therefore wish to consider whether their approach to children's privacy aligns with the standards expected under the Children's Code.
Getting Your Homework Done Before Spring 2027
The time between now and spring 2027 is best spent focused on a handful of practical steps:
Establish, and record, whether children are likely to access your service. Use actual evidence rather than assumption.
Complete or refresh a children's DPIA, including the best interests assessment and your reasoning on each standard.
Review defaults. High privacy, geolocation off, profiling off, non-essential notifications off, unless you can justify otherwise.
Map every point at which you infer, estimate or record a user's age, and identify the lawful basis and retention period for each.
Ask your age assurance vendor for accuracy and bias testing by age band and demographic group, and record what they tell you.
Bring AI systems that touch children into the same governance record as your children's data processing.
Rewrite privacy information into language the youngest likely user can follow, and test it with someone that age.
Watch the Ofcom implementation guidance this autumn and the draft regulations that follow.
The organisations that struggle in 2027 will mostly be those that decided in 2026 that none of this applied to them. Reddit and Imgur reached that conclusion too.
If you would find it useful to talk through whether your service falls within scope, or to review an existing children's DPIA, I would welcome the conversation.
Does your children's privacy homework pass the test?
As regulatory expectations continue to develop, now is a good time to revisit your approach to children's data protection, age assurance and AI governance. I would be happy to review your current framework and provide practical, documented recommendations for improvement.
Next, I'll be looking at ‘Five DSAR Mistakes Organisations Keep Making’
Stay in the loop
If you found this useful, subscribe to the Roseline Data Privacy monthly newsletter and never miss out on our practical data privacy insights, updates, and tips delivered straight to your inbox. No noise, just what matters.
Sources & further reading
ICO, Reddit issued with £14.47m fine for children's privacy failures
ICO, Code standards
Ofcom and ICO joint statement on age assurance, March 2026
Ofcom, Making life safer online: our priorities for the year ahead