Loading story…
UK regulators issued major penalties against online services for inadequate age assurance controls intended to protect children. The Information Commissioner’s Office (ICO) fined Reddit £14.47 million for unlawfully processing children’s data, alleging that despite a stated under-13 prohibition, Reddit did not introduce an age assurance mechanism until July 2025 and had not completed a required data protection impact assessment (DPIA) before January 2025. The ICO said these failures potentially exposed minors to inappropriate content and left under-13 users’ personal data collected and used without a lawful basis; Reddit said it intends to appeal.
Separately, communications regulator Ofcom fined porn operator 8579 LLC £1.35 million under the UK Online Safety Act for failing to deploy “highly effective” age checks (e.g., photo ID matching or credit card checks) to prevent minors from accessing adult content. Ofcom also imposed an additional £50,000 penalty for allegedly ignoring information requests and warned of an ongoing £1,000/day penalty until compliant age verification is implemented, amid broader concerns from civil liberties groups about the privacy and cybersecurity risks of stringent age-verification regimes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Following the ICO penalty, Reddit said it plans to appeal and argued that the regulator's approach would force it to collect more private identity information from U.K. users. The company maintained that this would conflict with privacy and safety goals.
The U.K. Information Commissioner's Office fined Reddit £14.47 million, finding it unlawfully processed personal data of children under 13 and failed to implement effective age assurance. The ICO also said Reddit had not completed a required data protection impact assessment before January 2025.
Ofcom fined porn company 8579 LLC £1.35 million for not deploying required age verification on its adult sites, and added a further £50,000 for allegedly ignoring information requests. The regulator also warned of an ongoing £1,000-per-day penalty until an effective age-check system is in place.
The U.K. Information Commissioner's Office sent Reddit provisional findings alleging failures in age assurance and unlawful processing of under-13 users' data. The regulator said Reddit had not adequately protected children and had not completed a required DPIA before January 2025.
Reddit implemented age assurance controls in July 2025, including age prompts at account creation and third-party identity verification for users seeking mature content in the UK. The move came after the platform had previously relied largely on self-declared ages.
Ofcom required pornographic websites to implement "highly effective" age assurance measures, such as photo ID matching or credit card checks, under the U.K.'s Online Safety Act. This requirement was described as being in force from July 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcearstechnica.com
Open sourcecybersecuritynews.com
Open sourcetherecord.media
Open sourceico.org.uk
Open sourcego.theregister.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK regulators **Ofcom** and the **Information Commissioner’s Office (ICO)** issued warnings to major social media and video platforms (including **Facebook, Instagram, Snapchat, TikTok, and YouTube**) demanding “urgent steps” to implement more robust **age assurance** controls to prevent access by children under 13. Regulators signaled potential enforcement if platforms continue relying primarily on easily bypassed self-declared ages, arguing this enables unlawful collection and use of children’s data and exposes under-13s to services not designed for them; Ofcom requested companies report back on their plans by the end of April. In the US, the House Energy and Commerce Committee advanced the **Kids Internet and Digital Safety (KIDS) Act** on a party-line vote amid Democratic objections that the bill could reduce platform accountability for harms to minors. Criticisms focused on provisions that could **preempt certain state laws**, a **knowledge requirement** that opponents argue may let companies claim ignorance of minors’ presence, and the lack of a proactive **“duty of care”** requirement; proposed amendments to strengthen protections were not adopted.
Jun 29, 2026
A growing regulatory push to require **online age verification**—particularly for access to pornography and other age-restricted content—is accelerating in the U.S. and U.K., with policymakers framing it as a child-safety measure and critics warning of privacy and free-speech risks. An **FTC** commissioner publicly endorsed age verification as a tool to protect children online, pointing to widespread state-level adoption in the U.S. and noting that court outcomes have been mixed, including a **U.S. Supreme Court** decision upholding a Texas law requiring pornography sites to verify users’ ages. In the U.K., the **Online Safety Act (OSA)** is driving direct service changes: **Aylo** (parent company of Pornhub and other tube sites) said it will **restrict access in the United Kingdom** rather than implement the OSA’s age-checking approach for all visitors, while allowing continued access for users who have already verified their identity. Aylo argued the framework diverts traffic to unregulated sites and creates privacy risks, while **Ofcom** countered that services can either implement compliant age checks or block U.K. access and urged development of effective device-level solutions.
Jun 29, 2026
Ofcom has opened an investigation into **Telegram** over evidence that the platform may have been used to share child sexual abuse material (**CSAM**), citing information from the Canadian Centre for Child Protection and its own assessment under the UK **Online Safety Act**. The regulator said the probe will examine whether Telegram is meeting its duties to prevent illegal content and child sexual abuse and exploitation risks on user-to-user services. Telegram denied the allegations, saying it has largely eliminated public CSAM distribution since 2018 through detection systems and cooperation with NGOs, and argued the action may reflect broader pressure on privacy-focused platforms. The UK regulator also launched investigations into **Teen Chat** and **Chat Avenue** over suspected failures to protect children from grooming, with Chat Avenue additionally facing scrutiny over possible exposure of minors to harmful content including pornography. Ofcom is separately examining **X** over nonconsensual sexually explicit content reportedly generated through the Grok AI chatbot account. Under the Online Safety Act, Ofcom can order platforms to make corrective changes, levy fines of up to **£18 million** or **10% of qualifying worldwide revenue**, and in serious cases seek court orders to disrupt or block access to non-compliant services in the UK.
Jun 29, 2026