Image: Tada Images / Shutterstock.com
The UK is getting serious—and Reddit is footing the bill. The British data protection authority ICO has imposed a fine of £14.47 million (around €16.5 million) on the US platform. The reason: Reddit did not adequately protect children because the platform was too lax about age verification for a long time.
As Siegel reports, this raises a dilemma that many services have so far elegantly sidestepped: if you want to protect minors, you need to know who is a minor. And to do that, you need age information—in other words, more data.
The new trick: collect more data to protect data better?
Since last summer, stricter rules have been in place in the UK to protect children and young people from risky content. As a result, not only porn providers but also well-known platforms and services now rely on age verification checks.
Now the ICO is tightening the screws once again on the issue of data protection: minors should be given special protection. However, if a platform relies solely on simple self-declaration ("I am over 13"), the authority believes this is too easy to circumvent. The result: the platform has no reliable way of knowing which accounts are actually "children's accounts" – and therefore cannot treat their data with the necessary care.
Why Reddit is getting into trouble
The ICO essentially accuses Reddit of failing to adequately inform children under the age of 13 about the consequences of data use—and of not doing enough to prevent this with its previous age checks. In addition, the authority criticizes the fact that a mandatory review of its own risks and protective measures was not carried out in the required form.
The head of the agency, John Edwards, phrased it as a warning shot to the entire industry: "I therefore urge the industry to rethink its practices and urgently make the necessary improvements to its platforms," said agency head John Edwards.
Reddit counters: That's the opposite of data protection.
Reddit does not want to simply accept the decision and has announced that it will appeal. The company is turning the argument around: if the authority requires more rigorous age verification, this could mean that more sensitive information will have to be collected.
Reddit says: "The data protection authority's demand that we collect more private information about every user in the United Kingdom is incomprehensible," according to an initial statement. Privacy and security are protected precisely by collecting only a small amount of data.
What this means for other platforms
This is not an isolated case. The ICO has already taken action against other services and announced further proceedings. The message is clear: anyone operating in the UK must do more to protect children and young people—and do so in a verifiable manner.
A critical look
In order to protect children, platforms may end up collecting more identity data. This could backfire, especially in the event of data leaks. If "protection" means that every user must first submit a digital ID document, this is not progress, but a huge new point of attack. The government wants security—but if it makes data collection mandatory to achieve this, it may be creating the very risk it wanted to reduce.
Source: spiegel.de
