Reddit began forcing many of its European users to prove their age on June 24, and it chose an invasive way to do it. Anyone the platform’s automated systems flag as possibly under 18 now has to hand over a government ID or a live face scan to a third party before opening a single mature community. The rollout covers the European Union and Norway, and Reddit frames the whole thing as compliance with censorship and digital ID EU law.
If you refuse the check and you keep your account, though, the mature side of Reddit vanishes from view. Agree to it, and you feed your identity into Persona, the outside verification firm Reddit leans on to decide whether you are old enough to read what you came to read.
The screening starts before anyone asks for a document. Reddit runs software that monitors your every move and estimates your age from how you behave on the site, reading your posting history, and the words you use.
If you look like an adult to the machine, nothing changes. If you look like a teenager, the mature communities lock until you verify. The company has not published the full list of signals it weighs, which leaves users to reverse-engineer a system that has already decided something about them.
The net catches far more than adult content. Users posting screenshots of the verification flow reported that some mental health support communities are tagged NSFW, which drags them behind the same wall. Someone reaching out during a crisis can find themselves asked to show a passport first. Reddit built its name on letting people speak without one attached, and that is the exact thing the check strips away.
Teenagers face a separate set of rules. Accounts held by 13 to 15-year-olds are locked to the most restrictive privacy settings with no way to loosen them, covering chat, followers, and whether the profile surfaces in search. Yet, keep in mind, everyone’s privacy has already had to be invaded to get to this point.
Users who are 16 or 17 start with the same defaults but can change them. Reddit presents this as protection, and some of it does protect, though it arrives welded to the identity demand rather than offered instead of it.
The expansion follows months of regulatory pressure, most of it out of the United Kingdom. British regulators fined Reddit £14.47 million, roughly $19 million, earlier this year after finding the company had unlawfully handled children’s personal information between May 2018 and July 2025.
Reddit had let people self-declare their age at signup, a method the Information Commissioner’s Office said children could get around without effort. “It’s concerning that a company the size of Reddit failed in its legal duty to protect the personal information of UK children,” Information Commissioner John Edwards said.
Reddit’s answer named the tension the regulator would not. The company said it “didn’t require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety.” It called the demand for more data “counterintuitive and at odds with our strong belief in our users’ online privacy and safety,” and it is appealing. Follow the regulator’s logic to its end and a platform has to identify everyone in order to shield the few who are children.
That commitment has a paper trail. Reddit’s chief executive, Steve Huffman, told users a few months ago that the company had no wish to learn who they are. “We are not doing sitewide human verification,” he wrote in a post about confirming people are human rather than bots. “We don’t need or want your identity.”
He described government ID checks as the company’s “least preferred” method, reserved for places where the law leaves no room. The system now reaching European users runs on the method he ranked dead last.
Persona deserves a harder look than the word “verification” invites. Security researchers found an exposed Persona development environment sitting on a US government-authorized server, and the company’s chief executive, Rick Song, confirmed it was genuine.
What sat inside went well past an age gate. Researchers counted 269 separate verification checks run on each person, facial recognition matched against watchlists, risk and similarity scores generated for every user, searches across internet and government databases, financial data checks, and several forms of biometric analysis on the selfie you upload.
Persona’s own privacy policy fills in the rest. The company says it may pull identifiers, device details, and location data from outside sources, among them data brokers, marketing partners, and “publicly available sources…such as open government databases.” An age check, on paper, becomes an identity profile assembled from wherever the data happens to live.
Reddit says it never sees the photos, that Persona hands back only a verification status and a birthdate. That answer covers Reddit and leaves everything else wide open. Whatever Persona builds out of your face, your ID, and the broker records it buys sits outside Reddit’s walls and outside the regulator’s stated concern.
