The UK Information Commissioner’s Office (ICO) fined MediaLab.AI, Inc., Imgur’s owner, £247,590 after finding that children’s personal data was processed unlawfully on Imgur. The regulator said MediaLab had no effective age checks, no verified parental-consent process for under-13 users and no child-focused data protection impact assessment (DPIA).
Who was fined?
The legal recipient of the penalty is MediaLab.AI, Inc., the company that owned or operated Imgur during the relevant period. Imgur is the platform; it is not the separate legal entity named in the ICO’s penalty notice. The action was not a personal fine against users and was not imposed on a separate “Imgur UK” company. See the ICO enforcement decision.
As an Amazon Associate I earn from qualifying purchases.
How much was the penalty?
The final penalty is £247,590. On September 10, 2025, the ICO had issued a notice of intent proposing £393,000. After considering MediaLab’s representations and updated financial information, the regulator reduced the amount before issuing the final decision.
The ICO said its assessment considered the estimated number of children affected, potential harm, the length of the infringements and MediaLab’s worldwide turnover. The relevant UK GDPR penalty framework allows up to £17.5 million or 4% of worldwide annual turnover, whichever is higher; that is a statutory ceiling, not an indication that this case approached it. The ICO’s public explanation and penalty notice are available at ico.org.uk and the monetary penalty notice.
What the ICO found
The final decision identifies infringements of Articles 5(1)(a), 6, 8 and 35 of the UK GDPR:
- No effective age assurance: MediaLab did not use measures capable of reliably determining users’ ages.
- No verified parental consent: Where consent was the proposed legal basis, MediaLab had no mechanism to obtain and verify a parent’s or carer’s consent for children under 13.
- No valid lawful basis: Without knowing which users were under 13 or obtaining the required consent, the company could not lawfully process those children’s personal data on that basis.
- No child-focused DPIA: MediaLab did not complete the required data protection impact assessment before high-risk processing involving children.
The infringement period ran from September 27, 2021, to September 30, 2025, according to the final enforcement record.
Why Imgur’s under-13 wording was not enough
Imgur’s terms said the service was not intended for children under 13, while also allowing a child younger than 13 to use it under parental supervision. The ICO found that this wording was not an operational safeguard. MediaLab had no practical system to establish a user’s age, enforce the restriction or verify parental supervision and consent. The relevant findings appear in paragraphs 52–54 of the penalty notice.
Recommended Free Tools
A minimum-age statement is therefore different from age assurance. A platform that is likely to be accessed by children cannot simply rely on its terms if it has no proportionate way to identify children and apply the appropriate protections.
How many children may have been affected?
Because MediaLab did not collect sufficient age information, the ICO could not use a definitive account-level count. Instead, its penalty notice gives estimates for 2021–2023:
| Group | ICO estimate | What the figure means |
|---|---|---|
| Users under 13 | Approximately 46,000–96,000 | A regulator estimate, not a confirmed list of affected children |
| Users aged 13–17 | Approximately 24,000–101,000 | A regulator estimate for the same period |
The under-13 range relates specifically to the parental-consent issue. The DPIA finding concerns processing involving children more broadly, including those under 18; those legal age groups should not be treated as interchangeable.
Rank #3
What risks did the regulator identify?
The ICO said that without reliable age information, Imgur could not apply safeguards designed for children or prevent them from encountering age-inappropriate material. Its announcement referred to potential exposure to content involving eating disorders, homophobia, antisemitism, and sexual or violent imagery. That does not mean MediaLab deliberately directed every category at children. The concern was that the platform lacked the age information needed to manage those risks. See the ICO announcement.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe enforcement action is about processing children’s personal data and the controls around that processing, not a finding that every child saw objectionable content.
Why did Imgur leave the UK?
Imgur introduced a UK geo-block on September 30, 2025, after the ICO had issued its proposed-penalty notice. The ICO described the withdrawal as a commercial decision by the company, not an order banning Imgur. The regulator also made clear that leaving the UK did not remove responsibility for earlier processing; the infringement period ended when the block prevented UK access.
MediaLab told the ICO that it stopped investigating age-assurance options for the UK because of the associated costs and the timing of its withdrawal. The ICO’s September statement is at ico.org.uk.
What UK users can and cannot do now
Imgur’s current UK access notice says people in the UK cannot log in, view content or upload images. Imgur-hosted embeds also do not display for UK visitors, so images can disappear from third-party websites. The notice says UK users can still use Imgur’s support process to request data access or deletion without logging in.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is this an Online Safety Act fine?
No. The penalty is a data-protection enforcement action under the UK GDPR, specifically Articles 5(1)(a), 6, 8 and 35. It sits alongside the wider UK debate about online safety and age assurance, but it was not a fine issued under the Online Safety Act.
Best Value
What would be required for a UK return?
The penalty notice records MediaLab’s stated position that any UK relaunch would need a remediation programme. It said that programme could include:
- a child-focused DPIA;
- age-assurance controls proportionate to the platform’s risks;
- verifiable parental consent for under-13 users; or
- potentially, an 18-plus age gate if Imgur returned as an adult-only service.
These were commitments or representations recorded by the ICO, not evidence that the measures had already been completed.
Key dates in the case
| Date | Event |
|---|---|
| September 27, 2021 | Start of the infringement period identified in the final decision, following MediaLab’s acquisition of Imgur. |
| February 2025 | The ICO announced investigations into Imgur and other platforms’ handling of UK children’s data and age assurance. Investigation announcement. |
| September 10, 2025 | The ICO issued a notice of intent proposing a £393,000 penalty. Children’s Code progress update. |
| September 30, 2025 | Imgur restricted access from the UK. |
| February 4, 2026 | The final £247,590 decision was dated. |
| February 5, 2026 | The ICO publicly announced the fine. |
| February 26, 2026 | The ICO published the monetary penalty notice. |
What the decision means for platforms
The case illustrates several compliance principles relevant to any service likely to be used by children:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Being marketed to adults, or saying children are not the intended audience, does not remove the need to assess likely child access.
- Age assurance should be proportionate to the risks created by the service and its content.
- Platforms must either apply child-protection measures broadly or reliably distinguish users by age and use the correct legal basis for each group.
- Under-13 parental consent and protections for children under 18 are related but distinct obligations.
- Leaving a market may stop future processing there, but it does not erase liability for historical conduct.
The Imgur action forms part of the ICO’s wider Children’s Code enforcement programme, which examines how online services use children’s personal information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
