The key UK statistics on how children's personal data is handled online — the reach of the ICO's Children's Code, what the regulator found when it examined platforms' age assurance and privacy settings, how many under-13s are signing up despite the minimum age, and the fines now landing for children's-data failures, with the data period stated next to every figure.
The authoritative UK numbers on children's online privacy come from a small set of official releases: the Information Commissioner's Office (ICO) publishes progress updates on its Children's Code strategy, Ofcom's annual Children and Parents: Media Use and Attitudes report measures how UK children actually use connected services, and the Department for Science, Innovation and Technology (DSIT) draws those strands together in its evidence reviews. This page pulls the headline figures from each source into one place.
It is scoped deliberately to the data-protection story — the Children's Code, age assurance and children's-data enforcement — rather than the separate online-harms and content-moderation debate that Ofcom and the NSPCC lead on. Every figure carries its data period, and every source is linked in full at the end.
Key facts and figures
- 11.7 million children in the UK could see their online privacy improved through the ICO's Children's Code strategy work (ICO strategy update, December 2025).
- 5 million child users, approximately, were affected by platform improvements between April 2024 and July 2026; the ICO describes the total as close to five million.
- 17 platforms popular with children — including Discord, Pinterest and X — had their age-assurance practices reviewed by the ICO (ICO, December 2025).
- 12 of 32 social-media and video-sharing platforms raised ICO concerns over children's privacy settings; 13 of the 32 let children share their geolocation (ICO, December 2025).
- £14.47 million was the Reddit penalty issued on 23 February 2026 and announced the following day; Reddit has appealed.
- 32% of parents correctly identified 13 as the minimum age used by most social media platforms in Ofcom’s 2026 report.
- 55% of UK children aged 3–17 play games online, according to Ofcom’s May 2026 report.
- 99% of UK children aged 8–17 go online, according to parents surveyed for Ofcom’s May 2026 report.
Checked on 15 October 2026. The latest sources used here are the ICO’s August 2026 progress update and Ofcom’s May 2026 report. Historical December 2025 platform-review figures remain dated. Ofcom changed its survey method for 2026, so comparisons over time are indicative rather than exact.
How many UK children does the Children's Code cover?
The ICO’s December 2025 strategy update estimated potential improvements to privacy for up to 11.7 million UK children. That is a potential reach estimate, not a count of children whose settings changed or a definition of the code’s legal scope.
The Children’s Code, formally the Age Appropriate Design Code, is a statutory code under the Data Protection Act 2018 with 15 standards for relevant online services likely to be accessed by under-18 s. It explains how to comply with data protection law in areas such as high-privacy defaults, age-appropriate design and data minimisation. Geolocation and profiling have specific exceptions and safeguards; the code does not ban every use of profiling involving children.
In its August 2026 update, the ICO estimated that improvements introduced from April 2024 to July 2026 had affected close to five million child users across several platforms. This supersedes the earlier estimate of more than three million to October 2025. The total describes affected users, not a measured reduction in harm or a national compliance rate.
Ofcom’s May 2026 report found that 88% of children aged 3–7 and 99% aged 8–17 go online, according to their parents; 55% of 3–17 s play games online. The ICO’s August update reports a review of 10 popular mobile games and engagement with the platforms delivering seven of the reviewed gaming experiences.
What did the ICO find when it examined platforms' age assurance?
In December 2025, the ICO reported reviewing age assurance at 17 platforms popular with children, including Discord, Pinterest and X. In March 2026 it wrote to six high-risk social media and video-sharing services about minimum-age enforcement. Its August update records continuing engagement. Age assurance should be proportionate to risk; alternatively, services can apply the code’s protections to all users where appropriate.
The December 2025 snapshot recorded privacy-setting concerns at 12 of 32 social media and video-sharing platforms assessed, with 13 allowing children to share geolocation. By August 2026 the ICO reported improvements to default location settings and further transparency changes to Snapchat and Instagram maps. The old counts describe that review cohort at that time, not the current prevalence of failures across all platforms.
The August 2026 update also covers reviews of 14 age-assurance providers and the 10-game programme. These are targeted regulatory exercises. A service being reviewed is not itself evidence that it has broken the law, and recommendations or commitments should be distinguished from completed changes.
What are the limits of self-declared age checks?
The ICO’s Reddit investigation found inadequate age assurance and unlawful processing of children’s information. Its March 2026 letter asked platforms enforcing minimum ages to move beyond self-declaration alone because children can easily bypass it. Reddit’s February 2026 penalty is under appeal, so the ICO’s findings should be identified as the regulator’s decision rather than a completed judicial determination.
The Children’s Code requires a risk-based approach to age assurance, or application of its standards to all users where appropriate. Under-13 s’ information is not automatically unlawful to process. When relying on consent to offer an information society service directly to an under-13, parental authorisation is required; other lawful bases may be available where their conditions are met. Children’s best interests and higher protection needs still apply.
Ofcom’s Online Safety Act duties are separate from UK GDPR. Highly effective age assurance is required in specified circumstances, including preventing children from accessing pornography, and its children’s safety framework addresses other harmful content. It is not a blanket requirement for every online service merely because a child might use it. Operators must assess which duties apply to their service.
What does the latest survey show about children’s online access?
Ofcom’s May 2026 report found widespread connectivity: 88% of 3–7 s and 99% of 8–17 s went online. These estimates come from parents’ reports. The study interviewed 5,008 parents of children aged six months to 17 and 3,426 children aged 8–17; different questions use different age groups and bases.
Age restrictions are not always well understood. Thirty-two per cent of parents identified 13 as the minimum age used by most social media platforms. A quarter of parents said they would allow a profile before the relevant minimum age, while 62% said they would not. These are attitudes, not a count of actual underage accounts.
Mobile ownership rises sharply around the transition to secondary school: 56% of 10-year-olds and 83% of 11-year-olds owned a mobile, while the figure was 98% for 16–17 s. The report’s revised methodology limits direct comparison with earlier editions. The table uses its latest measures without converting survey percentages into unsupported population counts.
| Age group | Measure | Figure | Data period / source |
|---|---|---|---|
| 8–17 | Go online, according to parents | 99% | Ofcom, May 2026 |
| 3–7 | Go online, according to parents | 88% | Ofcom, May 2026 |
| 3–17 | Play games online | 55% | Ofcom, May 2026 |
| 10 | Own a mobile phone | 56% | Ofcom, May 2026 |
| 11 | Own a mobile phone | 83% | Ofcom, May 2026 |
| 16–17 | Own a mobile phone | 98% | Ofcom, May 2026 |
| Parents of children aged 6 months–17 | Correctly identify 13 as the usual platform minimum age | 32% | Ofcom, May 2026 |
What fines have UK platforms received for children's data failures?
The ICO issued Reddit a £14,472,500 penalty on 23 February 2026, announced on 24 February, for children’s privacy failures. Reddit appealed in April and the ICO’s August update says litigation remains ongoing. The decision is an example of the regulator’s approach; it does not establish an automatic penalty or a universal rule that self-declaration alone makes every processing activity unlawful.
MediaLab, the owner of Imgur, received a £247,590 penalty in February 2026, following its earlier notice of intent. TikTok’s separate £12.7 million penalty became final after it withdrew its appeals in September 2026. The withdrawal also allowed the ICO’s investigation into TikTok’s recommender systems for 13–17-year-olds to continue; an investigation is not a finding of infringement.
Our fines guides set out the wider enforcement context. Children’s-data cases can concern lawful basis, fairness, transparency, age assurance and design safeguards. Their amounts and procedural status need to be read case by case.
Frequently asked questions
What does the ICO Children's Code require of platforms handling children's data?
The statutory code contains 15 standards for relevant online services likely to be accessed by children under 18. It covers matters including best interests, high-privacy defaults, minimisation and age-appropriate design. Geolocation and profiling have specific safeguards and exceptions. Compliance depends on the service and processing, not on a single age-check method.
How many UK children have been affected by Children's Code platform changes?
The ICO’s August 2026 update estimates that platform improvements between April 2024 and July 2026 affected close to five million child users. This is a programme reach estimate, not a count of proven harms prevented or a national compliance rate.
Why can self-declared age checks be inadequate?
Children can easily enter a false age. The ICO expects services enforcing a minimum age to use an effective, proportionate approach, and the Children’s Code permits applying its protections to all users where appropriate. Under-13 data is not automatically unlawful: parental authorisation is needed where consent is the basis for an information society service offered directly to an under-13, while other lawful bases have their own conditions.
What fines have UK platforms received for children's data protection failures?
Reddit received a £14.47 million penalty in February 2026, which it has appealed. MediaLab received a £247,590 penalty that month. TikTok’s separate £12.7 million penalty became final when its appeals were withdrawn in September 2026. Investigations and proposed penalties should not be counted as final fines.
How many children go online in the UK?
Ofcom’s May 2026 report found that 88% of children aged 3–7 and 99% aged 8–17 go online, according to their parents. It also found 55% of 3–17 s play games online. These measures do not count underage social media accounts, and the revised survey methodology limits direct annual comparisons.
Related guides
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- ICO Complaints Statistics UK: Volumes, Outcomes & Trends
- AI and Data Privacy Statistics UK: Adoption, Risk & Regulation
- What is personal data under GDPR? A UK guide
- GDPR lawful basis and consent explained
Sources & references
- ICO — Children’s code strategy progress, August 2026
- ICO — social media, age assurance and recommender systems
- ICO — mobile gaming review
- ICO — earlier strategy snapshot, December 2025
- Ofcom — Children and Parents: Media Use and Attitudes, May 2026
- ICO — Age Appropriate Design Code
- ICO — Reddit penalty notice, 23 February 2026
- ICO — TikTok appeals withdrawn, September 2026
- Ofcom — age assurance and children’s access duties
Protecting children's data starts with teams that understand the Children's Code and the UK GDPR — train yours to handle personal data safely and lawfully.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.