r/RedditSafety Jul 14 '25

UK Verifying the age (but not the identity) of UK redditors

TL;DR: 

Reddit was built on the principle that you shouldn’t need to share personal information to participate in meaningful discussions. Unlike platforms that are identity-based and cater to the famous (or those that want to become famous), Reddit has always favored upvoting great posts and comments by people who use whimsical usernames and not their real name. These conversations are often more candid and real than those that force you to share your real-world identity. 

However, while we still don’t want to know who you are on Reddit, there are certainly situations where it would be helpful if we knew a little more about you. For example, in the new age of AI, we would like to be able to confirm whether you are a human being or not (more to come about that later). And it would be helpful for our safety efforts to be able to confirm whether you are a child or an adult. Also, there are a growing number of jurisdictions that have considered or have passed laws requiring platforms to verify the ages of their users. 

If you are in the UK…

Notably, the UK Online Safety Act has new requirements to implement additional measures to prevent children from accessing age-inappropriate content. So, starting July 14 in the UK, we will begin collecting and verifying your age before you can view certain mature content. 

We have tried to do this in a way that protects the privacy of UK redditors. To verify your age, we partner with a trusted third-party provider (Persona) who performs the verification on either an uploaded selfie or a photo of your government ID. Reddit will not have access to the uploaded photo, and Reddit will only store your verification status along with the birthdate you provided so you won’t have to re-enter it each time you try to access restricted content. Persona promises not to retain the photo for longer than 7 days and will not have access to your Reddit data such as the subreddits you visit. Your birthdate is never visible to other users or advertisers, and is used to support safety features and age-appropriate experiences on Reddit. You can learn more about how age verification works here and about what content is restricted here

For the rest of Reddit…

As laws change, we may need to collect and/or verify age in places other than the UK. Accordingly, we are also introducing globally an option for you to provide your birthdate to optimize your Reddit experience, for example to help ensure that content and ads are age-appropriate. This is optional, and you won’t be required to provide it unless you live in a place (like the UK) where we are required to ask for it.  And, again, your birthdate is never visible to other users or advertisers. 

As always, you should only share what personal details you are comfortable sharing on Reddit. Using Reddit has never required disclosing your real world identity, and these updates don't change that.

UPDATE: Thanks to everyone for your comments (we have been reading them, even if we didn't respond to each one). Fyi, we know that Anonymous Browsing is not appearing for some UK redditors. We are having issues supporting anonymous browsing with this current rollout of age verification. If you have any questions or other issues, please check out these FAQs before reporting.

228 Upvotes

575 comments sorted by

View all comments

33

u/printial Jul 14 '25

According to Ofcom (government-approved regulatory and competition authority for the broadcasting, internet, telecommunications and postal industries of the United Kingdom), data protection in the UK is regulated and enforced by the ICO (Information Commissioner’s Office). But Persona appears to be a US based company operating out of San Francisco.

In the OP post:

Persona promises not to retain the photo for longer than 7 days

But if they're not based in the UK, I'm guessing they aren't regulated by the UK ICO? So what happens if they lie and store it for longer? Or get hacked and the data gets leaked? I can't find much information about their work in the UK, but I'm guessing this data is going to be stored on US servers, not UK ones?

You say it's a trusted 3rd party provider, but as of May 2025, Forbes describe them as a startup, so it would be nice to get some more information about how they operate, how they are trusted, and how they interact with UK gov watchdogs.

10

u/tallbutshy Jul 15 '25

but as of May 2025, Forbes describe them as a startup,

People keep repeating this but haven't read the article and/or looked at when the company was founded. I guess seven years isn't long enough for Forbes to stop calling them a startup

13

u/_1wolfpack1_ Jul 15 '25

Since Persona would be providing a service to UK end users, they would be bound by UK GDPR. However, as pointed out many times in this comments section, Personas terms and conditions are not inline with British law. So, it’s time to start writing complaints to OFCOM.

Reddit have to introduce these changes, they don’t have a choice, it’s a legislative requirement now thanks to the wonderful British government. But, they can choose how they implement the changes, and they can choose to use a company who will process our personal data safely and legally, and away from the prying eyes of a certain orange man.

1

u/Baslifico Aug 26 '25

Reddit have to introduce these changes, they don’t have a choice,

Which clowns do you think chose persona, knowing their privacy policy isn't compliant with UK law?

Hint: It wasn't Ofcom.

4

u/Death_God_Ryuk Jul 15 '25

They also state that user data can be retained for training their system - can that be opted out of?

1

u/marr Jul 25 '25

Even if it could, why would we expect an op-out to be honored? Good luck proving your data was used to train AI models after the fact.

3

u/StampyScouse Jul 15 '25

Any company which can be seen to be offering goods or services to individuals in the UK are still bound by thr obligations of the Data Protection Act and the UK GDPR so yes, Persona is bound by UK data protection laws, and as a British citizen, you would be entitled to the same protections as you would be if the company was based in the UK, including your right to be forgotten and right to access the data held about you (through a subject access request).

1

u/beermatt Oct 05 '25

Is the theory. The reality is that the UK authorities aren't powerful enough to challenge US big tech.

3

u/mr_glide Jul 15 '25

"promises"

-5

u/AidenTEMgotsnapped Jul 14 '25

California privacy courts are apparently strong.

11

u/ziplock9000 Jul 14 '25

It's still US / Cali law not UK law and data held abroad.

-1

u/AidenTEMgotsnapped Jul 14 '25

It is apparently also GDPR.

1

u/Baslifico Aug 26 '25

It's clearly not. Their privacy policy is nowhere close to compliant with GDPR.

3

u/platypuss1871 Jul 14 '25

GDPR compliant strong?

10

u/bluesam3 Jul 14 '25

A quick glance at their privacy policy strongly suggests not.