£14.72M
Combined ICO fines in March 2026 (Reddit £14.47M + MediaLab £247,590)
In March 2026 the UK Information Commissioner's Office (ICO) did two things that put age assurance on the front page. First, it imposed substantial fines: Reddit was fined £14.47 million and Imgur owner MediaLab £247,590 for failing to implement adequate age verification and protect children's data. Second, it published an open letter to major tech firms, TikTok, Snap, Facebook, Instagram, YouTube, and X, calling on them to strengthen age checks and protect children's data using "modern, viable" technology. The letter is public, and the expectation is that platforms will respond with concrete plans, not generic statements.
What the ICO expects: "modern, viable" age checks
The ICO's position is that self-declaration of age is not enough. It has explicitly recommended tools such as facial age estimation, digital ID, and one-time photo matching so that under-13s cannot access services that are not designed for them. The fines show that the ICO is willing to act when it finds systemic failures. For Reddit and MediaLab, the cost was both financial and reputational; for others, the open letter is a warning that the same standards will be applied.
What UK platforms should do before the Ofcom deadline
If you operate in the UK, treat age assurance as part of core compliance, not a side project. Document your approach, pick methods the ICO treats as effective, and keep data collection and retention to a minimum. Privacy-preserving age verification, where you store only a verification outcome and an audit ID, lines up with what the ICO asked for in March 2026 while staying inside data-protection rules. A typical B2B setup: integrate by API or plugin, run ID + liveness the first time (or a short re-check for people who already verified elsewhere), store a token and an Audit ID per check, and never keep raw documents or face files on your own systems. The fines and the open letter both say the same thing: the UK timeline is tight, including Ofcom’s 30 April deadline, so picking a provider you can run in production matters now.
