The Information Commissioner’s Office fined Reddit £14.47 ($19.56) million this week for failing to properly verify the ages of children using the platform.
Because Reddit let users self-declare their age at signup, a method the ICO called trivially easy for children to bypass, the regulator concluded Reddit “did not have a lawful basis for processing the personal information of children under the age of 13.” Children’s data was used “in ways they could not understand, consent to or control,” Information Commissioner John Edwards said.
The UK’s data protection regulator says it’s protecting children. What it’s actually building is a mandatory identity verification system that turns anonymous internet use into a surveillance exercise for every adult in the country.
Reddit rolled out the ICO-compliant fix six days after receiving provisional findings: selfie-based age estimation or government ID upload, processed through identity verification company Persona.
To use Reddit without restrictions in the UK, you now submit your face or your government credentials to a third-party surveillance system. The ICO calls this progress.
Reclaim Your Digital Freedom.
Get unfiltered coverage of surveillance, censorship, and the technology threatening your civil liberties.
Persona’s actual capabilities suggest otherwise. Security researchers recently found an exposed Persona frontend on a US government-authorized server.
Persona CEO Rick Song confirmed it was a genuine development environment. What it revealed: 269 distinct verification checks per user, facial recognition screening against watchlists, risk and similarity scores generated for each person, internet and government database searches for potential matches, financial data checks, and multiple forms of biometric analysis performed on submitted selfies.
It looks more like an identity profiling operation that happens to include an age check.
Persona’s privacy policy extends the picture further. The company says it may collect identifiers, device information, and geolocation data from third parties, including data brokers, marketing partners, and “publicly available sources…such as open government databases.”
Reddit says it doesn’t see photos submitted to Persona and only receives a user’s verification status and provided birthdate. What Persona builds from everything else is outside Reddit’s control and, apparently, outside the ICO’s concern.
Reddit’s own statement named the contradiction directly. A spokesperson said the platform doesn’t “require users to share information about their identities, regardless of age, because we are deeply committed to their privacy and safety,” and that “the ICO’s insistence that we collect more private information on every UK user is counterintuitive and at odds with our strong belief in our users’ online privacy and safety.” The company is appealing.
That appeal is worth watching, because Reddit has identified something the ICO has not answered: how does forcing mass biometric data collection protect privacy?
The UK fined Imgur for a similar reason last month. Instead of building digital ID checks, Imgur blocked access to UK users.
The regulator’s position is that self-declaration “is not enough when children may be at risk.” The solution it has effectively mandated creates a system where every UK user, adult or child, submits to facial recognition, watchlist screening, and identity profiling just to access a social platform.
This is the structural problem with the UK’s approach to online age assurance. The ICO enforces the Age Appropriate Design Code, which it began treating as a hard requirement in September 2021.
Compliance with that code, as regulators have made clear through fines against Reddit and image platform Imgur before it, requires platforms to know who their users are. Knowing who users are requires verification.
Verification, at scale, means biometrics and government IDs fed into systems like Persona that perform hundreds of checks and retain data under privacy policies that permit extensive third-party enrichment.
The ICO is using privacy law as the legal basis for building a surveillance architecture. Children’s data protection, a legitimate concern, becomes the justification for ending anonymous participation in online platforms for the entire UK population. The regulator says it will continue reviewing Reddit’s practices and pressuring other platforms to follow suit. Each enforcement action extends the same logic: prove who you are or lose access.
