Privacy
ICO Investigates TikTok, Reddit, and Imgur Over Alleged Misuse of Children's Data
Why This Alert Is Important
The U.K. Information Commissioner’s Office (ICO) has launched a major investigation into the handling of children's personal data by social media platforms TikTok, Reddit, and Imgur. Organizations must ensure they align with evolving regulations, such as the U.K. Children’s Code, to avoid enforcement actions, reputational risks, and potential fines.
Overview of the ICO Investigation
On March 11, 2025, the ICO announced separate investigations into TikTok, Reddit, and Imgur to assess their compliance with data protection laws regarding children's personal information. With growing concerns over how these companies collect, use, and share data from young users, this probe highlights the increasing regulatory scrutiny on digital platforms and the importance of compliance with children's data protection laws.
TikTok: The investigation focuses on how TikTok uses data from 13–17-year-olds to power its content recommendation algorithms, potentially exposing young users to privacy risks and harmful content.
Reddit and Imgur: These platforms are being scrutinized for their age verification measures and how they assess whether users are underage. The ICO aims to determine whether they effectively prevent unauthorized data collection from children.
This move follows the ICO's enforcement actions in 2024, where multiple social media platforms were required to strengthen privacy protections for underage users. The agency has made it clear that failure to comply with the U.K. Children’s Code and data protection laws will lead to regulatory consequences.
Implications of the ICO's Investigation
The ICO’s actions signal a firm stance on children's privacy and data protection, reinforcing key industry concerns:
- Algorithmic Transparency: Social media companies must ensure their recommendation systems do not exploit minors' data for engagement-driven content delivery.
- Stronger Age Verification: Platforms must implement robust age assurance mechanisms to prevent underage users from accessing inappropriate content or having their data misused.
- Regulatory Compliance: Non-compliance with the U.K. Children’s Code and broader data protection laws may result in enforcement actions, including hefty fines and operational restrictions.
As regulators globally focus on safeguarding children's digital rights, companies handling minors' data must prioritize compliance to mitigate legal and reputational risks.
The ICO’s investigation into TikTok, Reddit, and Imgur underscores the escalating regulatory scrutiny surrounding children’s data protection. Social media platforms must ensure that their age verification mechanisms are robust and that data processing practices comply with frameworks like the U.K. Children’s Code. Failure to do so may result in significant penalties and reputational harm. Organizations should adopt comprehensive consent management solutions to streamline compliance across all digital touchpoints. Additionally, leveraging automated data discovery and governance tools can help companies maintain defensible records of processing activities and ensure regulatory compliance.
Data Privacy Tip
Ensure compliance with global children's data protection laws by implementing robust age assurance mechanisms, transparent data collection practices, and strict content moderation. Learn how to build a privacy-first framework with Exterro’s resource:
Mastering Consent Management: A Comprehensive Global Framework for Businesses