Platform choosing an age-verification workflow while bearing controller responsibilities
Reddit
Reddit is the platform examined for UK age checks and a separate data-protection enforcement action. Its published verification arrangement uses Persona as a processor under Reddit's instructions. The relevant records distinguish implementation of an access gate from the earlier processing failures addressed by the regulator.
Verification outputs and the appealed penalty
The ICO notice records Reddit's account that Persona identity-document and facial checks were introduced for UK not-safe-for-work access on 14 July 2025. Persona's customer FAQ says the document route returns birthdate and the selfie route estimated age, with personal data deleted within three days; these are provider representations. The ICO imposed GBP14,472,500 on 23 February 2026 for specified earlier UK GDPR processing and impact-assessment failures. An appeal was recorded on 1 April 2026; payment and a final tribunal outcome were not established.
23 February 2026 decision;1 April 2026 appeal update
GBP 14,472,500 notice concerns processing from 25 May 2018 through 8 July 2025 and DPIA failures through 31 December 2024. Appeal recorded 1 April 2026; no payment or final tribunal outcome established. This is a data-protection penalty, not an OSA fine or direction to procure Persona. Financial details: value: 14,472,500; currency: GBP; kind: penalty imposed not payment; period: 23February2026 notice
ID route returns birthdate; selfie route estimated age. FAQ promises personal data deletion within 3 days. Claimed outputs/deletion, not independently observed behaviour or universal binary token.
ICO notice records Reddit representations: Persona ID/facial checks introduced 14 July 2025, after the notice’s processing period. Not proof all current alternatives work in UK.
Persona's original FAQ HTML was captured; Reddit ordinaryGET403, readable web substitute retained as derivative. No guessed email-inference supplier, fee or link to VerifyMy is earned. Current provider summaries must not be backdated to2025 retention arrangements.
Current Reddit Help, updated24June2026, names Persona for ID/selfie verification, describes account-signal and third-party email inference, and lists app-store age signals depending on region/device. This generic page does not establish that every option is available to every UK user. Reddit says it stores verified age/status and receives no verification photos. The customer-specific Persona FAQ identifies Reddit as controller and Persona as processor under Reddit's instructions; it says ID-route birthdate or selfie-route estimated age is returned and personal information deleted within three days. These are published provider representations; contractual schedules and deletion evidence were not obtained. The date of birth return should not be reduced to a universal binary over18 token.
ICO notice records Reddit representations: Persona ID/facial checks introduced 14 July 2025, after the notice’s processing period. Not proof all current alternatives work in UK.
ID route returns birthdate; selfie route estimated age. FAQ promises personal data deletion within 3 days. Claimed outputs/deletion, not independently observed behaviour or universal binary token.
23 February 2026 decision;1 April 2026 appeal update
GBP 14,472,500 notice concerns processing from 25 May 2018 through 8 July 2025 and DPIA failures through 31 December 2024. Appeal recorded 1 April 2026; no payment or final tribunal outcome established. This is a data-protection penalty, not an OSA fine or direction to procure Persona.