The UK’s data protection watchdog has fined the owner of image-sharing platform Imgur nearly £250,000 after finding serious failures in how the site handled children’s personal data.
The Information Commissioner’s Office (ICO) has imposed a £247,590 penalty on MediaLab.AI, Inc, concluding that the company allowed children to access Imgur for years without putting in place even basic age-checking safeguards required under UK data protection law.
Following a long-running investigation, the regulator found that MediaLab failed to establish the age of Imgur users, processed the personal data of children under 13 without parental consent, and did not carry out a data protection impact assessment to identify or mitigate risks to younger users.
Because Imgur had no effective way of determining who was using the platform, children were exposed to potentially harmful content, including material relating to eating disorders, antisemitism, homophobia, and sexually explicit or violent imagery. The ICO said personal data was being used to shape content recommendations without any protections appropriate for children.
John Edwards, the UK Information Commissioner, said the company had failed in its legal duty to protect young users. He said MediaLab had allowed children to use Imgur without effective age checks while collecting and processing their data, exposing them to serious risk.
He added that age assurance plays a crucial role in protecting children’s personal information and preventing it from being used in ways that may cause harm, such as recommending age-inappropriate content. Companies that ignore the fact children use their services, he warned, should expect enforcement action.
The ICO’s investigation covered a four-year period between September 2021 and September 2025, during which MediaLab was found to have breached the UK General Data Protection Regulation. Under UK law, online services can only rely on consent as a lawful basis for processing data relating to children under 13 if that consent is given by a parent or carer.
Although Imgur’s terms stated that children under 13 required parental supervision, the ICO found that MediaLab had no mechanisms in place to enforce this or obtain parental consent.
In setting the penalty, the regulator took into account the length of time the breaches occurred, the number of children affected, the level of potential harm, and MediaLab’s global turnover. The ICO also noted that MediaLab accepted its provisional findings and committed to implementing appropriate safeguards should Imgur resume processing children’s data in the UK.
The watchdog said further regulatory action could follow if those commitments are not met.
The fine forms part of the ICO’s broader push to improve how digital platforms protect children’s personal information online. UK data protection law gives children enhanced protections, reinforced through the Children’s Code, also known as the Age Appropriate Design Code, which sets clear expectations for online services likely to be accessed by under-18s.
The ICO has stressed that platforms must either apply the Children’s Code protections to all users or implement proportionate and robust age assurance measures to tailor safeguards appropriately.
