Reddit’s £14.5m fine and the “hard problem” of age assurance

The ICO has issued a £14.47 million fine against Reddit for alleged children's privacy failures, officially signaling the end of the road for the age verification "honour system." But with the full penalty notice yet to be published, what can privacy professionals actually glean from the regulator's press release?In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down the Reddit announcement and explores one of privacy’s hardest problems: the inherent tension between robust age assurance and strict data minimisation. Are you damned if you collect the data, and damned if you don't?We look at the ICO's updated guidance, the rising regulatory bar under the UK's Online Safety Act, and the stark choice regulators are forcing upon platforms: implement complex technical checks, or apply the highest privacy settings to everyone by default.In this episode, Rob covers:The Reddit press release: Why a lack of robust age assurance and missing DPIAs led to a £14.47m penalty.The "honour system": Why simply asking users to type in their birth year is no longer an acceptable compliance strategy for the ICO.The core tension: How businesses are caught between the need to verify age (processing more data) and the strict limits of data minimisation.The nuclear option: The ICO’s alternative compliance route—why treating all your users like children might be the easiest way to avoid regulatory scrutiny.Next steps for privacy teams: How to audit your age assurance mechanisms while we wait for the full Reddit decision to drop.