The UK Information Commissioner’s Office (ICO) has launched investigations into three major social media and video-sharing platforms – TikTok, Reddit, and Imgur – over concerns about their handling of children’s personal data. These probes focus on potential breaches of UK data protection laws, particularly for users aged 13 to 17. The ICO is examining TikTok’s recommender systems, which use algorithms to suggest content to young users, amid fears that these systems could expose children to inappropriate or harmful material by leveraging their personal data. Meanwhile, Reddit and Imgur are under scrutiny for their age assurance measures, with the ICO assessing whether these platforms accurately verify users’ ages to restrict access to age-inappropriate content and ensure services are properly tailored for younger audiences.
These investigations follow the ICO’s broader 2024 review of 34 social media and video-sharing platforms, which identified gaps in compliance with the Children’s Code. While 11 companies were warned last August to improve their data practices, TikTok, Reddit, and Imgur now face deeper scrutiny. The regulatory landscape is tightening further with the upcoming enforcement of key provisions in the Online Safety Act, set to take effect from July 2025, which will require platforms to conduct child safety risk assessments and implement stronger protections against harmful content.
Companies operating in this space must take immediate action to ensure compliance. This includes reviewing recommender systems to prevent harmful content exposure, disabling targeted advertising for children by default – as mandated by both the Children’s Code and the EU’s Digital Services Act – and enforcing strict privacy settings, such as making children’s profiles private by default and restricting geolocation sharing. Robust age verification mechanisms will also be critical to avoid regulatory penalties.
The ICO has emphasised that protecting children’s data remains a top priority, and with Ofcom adopting a more aggressive enforcement stance under the Online Safety Act, platforms that fail to comply risk significant fines and reputational damage. The message is clear both in the UK and other jurisdictions including Australia: businesses must prioritise child safety and data protection or face serious consequences as regulatory scrutiny intensifies in 2025.
