The UK Information Commissioner's Office (ICO) says improvements made under its Children's code strategy have affected close to 5 million child users between April 2024 and July 2026, according to its August 2026 progress update. The strategy has produced two large fines in 2026, a final TikTok penalty in September 2026, and a monitoring program aimed at 17 platforms that still rely on self-declared ages.
How many children has the Children's code strategy reached?
The ICO's August 2026 progress update estimates that improvements made between April 2024 and July 2026 have affected close to 5 million child users across several platforms. Its December 2025 update gave a lower figure for the earlier window: over 3 million child users from April 2024 to October 2025. The ICO also said in December 2025 that at least 1 million UK children had benefited directly from changes it secured.
These are the ICO's own estimates of child users affected by platform changes, not a count of audited compliant services. The regulator describes the 5 million figure as an estimate based on improvements at several high-profile platforms.
The December 2025 update also reported that 11 social media platforms had made positive changes since the strategy launched. The ICO scrutinized 32 social media and video sharing platforms in total, so the strategy has so far produced visible change at roughly one in three of them.
Reach is growing quickly, but it measures platform changes rather than a pass rate across the whole market.
What is the UK Children's code, and when did it start?
The Age Appropriate Design Code, known as the Children's code, is the ICO's statutory code of practice for online services likely to be accessed by children. It contains 15 standards, including best interests of the child, data protection impact assessments, default settings, geolocation, profiling and nudge techniques. The ICO issued it on 12 August 2020, and it came into force on 2 September 2020 with a 12-month transition period.
Figure 1: Key dates for the Children's code and the ICO's enforcement under it. Source: ICO, Children's code guidance and press releases (2020 to 2026).
The code is not a standalone statute. The ICO enforces it through UK GDPR, so a fine such as Reddit's is issued for unlawful processing of children's data rather than for a code breach as such. Any business with a UK-facing app, game, or website that children are likely to use can generate a privacy policy that matches the transparency standard, but it still needs the underlying design choices to match.
A code that dates to 2020 is now being tested by fines, not guidance.
How many platforms changed their default privacy settings?
Of the 32 platforms the ICO scrutinized, it had questions about 12 on default privacy settings. Since March 2025 it has confirmed good practice or secured changes at nine, according to its December 2025 update. Dailymotion, Hoop, Twitch and Viber made changes, Soda, Vimeo and Wizz App showed good practice, and Vero and WeAre8 made partial changes.
Figure 2: Outcomes for the nine platforms with default-settings results. Source: ICO, Children's Code Strategy progress update, December 2025.
Other outcomes sat outside those nine. Befriend moved to 18+, Flickr restricted access to users aged 18 and over, and Triller became unavailable in the UK. On geolocation, the ICO found that 13 of the 32 platforms allow children to share their location. It is engaging with Snap and Meta over the map features on Snapchat and Instagram, and by August 2026 both had improved transparency, with Snap also improving user controls.
Age assurance remains the weakest area, and it is the same gap behind our data on how many children use social media underage. The ICO identified 17 platforms that rely primarily on self-declaration and made them the next phase of its work. It also contacted six organizations about profiling to estimate age, and only two used it to remove under-13s, both alongside self-declaration. The ICO's position is that profiling cannot replace a proper age gate where one is required.
Most movement so far is on defaults, while age checks are where the next enforcement is likely to land.
How large are the ICO's children's privacy fines?
The ICO has issued three significant penalties tied to children's data. Reddit was fined £14.47 million on 24 February 2026 for failing to use children's personal information lawfully, and MediaLab.AI, owner of Imgur, was fined £247,590 on 5 February 2026. TikTok's £12.7 million penalty dates from 2023 and became final in September 2026.
Figure 3: Fine amounts in millions of pounds; MediaLab's £247,590 shown rounded. Source: ICO enforcement notices and press releases, 2023 to 2026.
The ICO found Reddit had no lawful basis for processing the data of children under 13 because it did not apply effective age assurance, and that it carried out no data protection impact assessment before January 2025 even though 13 to 18 year olds could use the platform. Reddit's terms already barred under-13s, but it had no age checks until July 2025. Reddit appealed to the First-tier Tribunal on 1 April 2026.
Note
Reddit's appeal is ongoing as of October 2026, so the £14.47 million figure could change. The ICO's own analysis of TikTok estimated that up to 1.75 million UK children under 13 used the platform in 2020, and the Upper Tribunal rejected TikTok's argument in August 2026 that the processing fell under a special purposes exemption.
| Platform | Fine | Year | Status |
|---|---|---|---|
| £14.47 million | 2026 | Appealed 1 April 2026 | |
| TikTok | £12.7 million | 2023 | Final, September 2026 |
| MediaLab (Imgur) | £247,590 | 2026 | Issued 5 February 2026 |
| Platforms with default-setting changes or good practice | 9 of 12 questioned | 2025 | Confirmed December 2025 |
Source: ICO enforcement pages and Children's code strategy updates.
Fines now run from a few hundred thousand pounds to more than £14 million. The U.S. side of the same issue, including the FTC's COPPA penalties, is covered in our children's online privacy data for 2026.
What does the ICO do when a platform falls short?
The ICO questions a platform, then looks for either good practice, changes or a formal step. Services that also face rules outside the UK can compare them in our children's online privacy statistics and our COPPA fines and settlements roundup. Reddit received a notice of intent on 8 July 2025 and MediaLab on 10 September 2025. Both fines followed in February 2026.
Figure 4: The path from review to final penalty, as reflected in ICO updates for Reddit, MediaLab and TikTok. Source: ICO, Children's code strategy updates (December 2025 and August 2026).
On 12 March 2026 the ICO sent an open letter to social media and video sharing platforms and wrote directly to major services about age assurance. Snap has since committed to improved age checks at sign-up. The ICO also expanded the strategy to mobile games, since about 90% of UK children play games on digital devices, citing Ofcom's Online Nation 2024 report, and opened a monitoring program covering 10 popular mobile game platforms.
For smaller services, the pattern is clear. The path from questions to a fine runs through documented age assurance and a completed impact assessment.
What do children say about age checks?
An ICO survey of more than 4,000 children aged 8 to 17 and their parents, with fieldwork from 5 to 30 January 2026, found that 52% of children said they would find a way to bypass age checks. It found 31% of parents had helped their child around an age limit, and 41% of children had tried to get around parental controls or monitoring tools.
Figure 5: Selected results from the ICO survey of 4,000+ children aged 8 to 17 and parents, January 2026: parents using controls or monitoring tools, children who would bypass age checks, children who tried to bypass controls, children who talk or play with people they only know online, and parents who helped a child around an age limit. Source: ICO news release, August 2026.
Among children who said a parent had previously helped them get around an age limit, 64% said they would bypass age checks. Of those who tried to get around parental controls, 49% found it easy. The survey also found that 36% of children talk or play with people they only know online, or do not know at all. The ICO does not name the survey firm in its release.
A service that relies on a date-of-birth field is relying on a check that about half of children say they would defeat.
The Bottom Line
Close to 5 million child users have been affected by ICO-driven changes in just over two years, and the enforcement record now includes a £14.47 million Reddit fine, a final £12.7 million TikTok penalty and a £247,590 MediaLab fine. The pattern is consistent: the ICO questions a platform, secures changes where it can, and fines where processing of children's data is unlawful. Nine of the 12 platforms questioned on default settings improved or showed good practice, but 17 platforms still depend on self-declared ages, and half of surveyed children say they would get around a check. Any UK-facing service that children might use should document its age assurance approach, complete a data protection impact assessment, and keep its privacy notice readable for a young audience.
Frequently Asked Questions
How many children has the ICO's Children's code strategy affected? The ICO estimates its strategy has protected close to 5 million child users between April 2024 and July 2026, up from over 3 million reported for April 2024 to October 2025.
How much has the ICO fined platforms over children's privacy? Three penalties stand out: £14.47 million against Reddit (February 2026, under appeal), £12.7 million against TikTok (issued in 2023, final after TikTok withdrew its appeals in September 2026), and £247,590 against MediaLab, owner of Imgur (February 2026).
How many standards does the Children's code contain? The Age Appropriate Design Code has 15 standards, from best interests of the child and data protection impact assessments to default settings, geolocation, profiling and nudge techniques. It came into force on 2 September 2020.
Do children actually bypass online age checks? 52% of children said they would find a way to bypass age checks, according to ICO research of more than 4,000 children aged 8 to 17 and their parents, with fieldwork from 5 to 30 January 2026.
Where the Numbers Come From
- ICO: Children's Code Strategy progress update (December 2025). Over 3 million child users, 32 platforms, 12 questioned, nine outcomes, 13 geolocation, 17 self-declaration, 11 platforms with positive changes.
- ICO: Children's code strategy progress update (August 2026). Close to 5 million child users, Reddit and MediaLab fines.
- ICO: Reddit issued with £14.47m fine for children's privacy failures (February 2026). Reasons, appeal, MediaLab £247,590.
- ICO: TikTok withdraws two appeals and accepts £12.7m fine (September 2026). Final penalty, 1.75 million under-13 estimate, Upper Tribunal ruling.
- ICO: Enforcement action: TikTok (May 2023). £12.7 million penalty dated 15 May 2023.
- ICO: Background to the Children's Code. In force 2 September 2020.
- ICO: Age appropriate design: a code of practice for online services. 15 standards, 12-month transition.
- ICO: New research reveals growing gap between parental confidence and children's digital reality (August 2026). Survey of 4,000+ children aged 8 to 17, fieldwork 5 to 30 January 2026.
- ICO: Open letter to tech firms on age checks (12 March 2026). Open letter date.
Note: All figures verified as of October 2026. The ICO updates its strategy progress reports a few times a year, and the Reddit appeal is unresolved.
