PENALTY NOTICE
MEDIALAB.AI, INC.
Penalty Notice to MediaLab.AI, Inc. under
Section 155(1) Data Protection Act 2018
4 February 2026
CONTENTS
I. INTRODUCTION AND SUMMARY .............................................. 3
II. RELEVANT LEGAL FRAMEWORK................................................ 7
III. BACKGROUND TO THE INFRINGEMENTS .................................. 8
(1) The Children’s Code and the background to the
Investigation ..................................................................... 8
(2) Corporate background .................................................... 10
(3) The Platform ................................................................... 12
(4) MediaLab’s processing of personal data .......................... 15
(5) Child users of the Platform .............................................. 18
(a) The Platform’s Terms of Service and MediaLab’s
approach to children using the Platform ....................... 19
(b) The number of children using the Platform in the UK ... 21
IV. FINDINGS OF INFRINGEMENT ............................................... 23
(1) The Relevant Period ........................................................ 24
(2) MediaLab’s status as a controller .................................... 24
(3) Scope of the UK GDPR and DPA 2018 .............................. 25
(a) Material scope ................................................................. 25
(b) Territorial scope .............................................................. 25
(4) Special protections for children ....................................... 26
(5) The Lawful Basis Infringements ...................................... 28
(a) Legal framework ............................................................. 29
(b) MediaLab’s stated position ............................................. 30
(c) Findings on Article 5(1)(a), Article 6 and Article 8 UK
GDPR ............................................................................... 31
(6) The DPIA Infringement ................................................... 34
(a) Legal framework ............................................................. 35
(b) Findings on Article 35 UK GDPR ..................................... 38
V. DECISION TO IMPOSE A PENALTY ......................................... 40
(1) Legal framework: penalty notices ................................... 40
(2) Seriousness of the Infringements ................................... 43
(3) Relevant aggravating or mitigating factors ..................... 58
(4) Effectiveness, proportionality and dissuasiveness .......... 66
1
(5) The Commissioner’s conclusion on whether to impose a
penalty ............................................................................ 68
VI. CALCULATION OF THE PENALTY ............................................ 68
(1) Statutory Maximum Penalty ............................................ 69
(2) Step 1: Assessment of the seriousness of the
Infringements ................................................................. 73
(3) Step 2: Accounting for turnover ...................................... 74
(4) Step 3: Calculation of the starting point .......................... 75
(5) Step 4: Adjustment to take into account any aggravating
of mitigating factors ........................................................ 76
(6) Step 5: Adjustment to ensure the penalty is effective,
proportionate and dissuasive .......................................... 79
(7) Conclusion - Penalty ........................................................ 82
VII. FINANCIAL HARDSHIP ........................................................... 82
VIII. PAYMENT OF THE PENALTY .................................................... 83
IX. RIGHTS OF APPEAL ................................................................ 84
ANNEX 1......................................................................................... 85
ANNEX 2......................................................................................... 87
ANNEX 3......................................................................................... 99
2
DATA PROTECTION ACT 2018
(PART 6, SECTION 155)
ENFORCEMENT POWERS OF THE INFORMATION COMMISSIONER
PENALTY NOTICE
To: MediaLab.AI, Inc.
FAO:
Of: 1222 6th Street
Santa Monica
California
CA 90401
I. INTRODUCTION AND SUMMARY
1. Pursuant to section 155(1)(a) of the Data Protection Act 2018 (“DPA
2018”), by this written notice (“Penalty Notice”), the Information
Commissioner (the “Commissioner”) requires MediaLab.AI, Inc.
(“MediaLab”) to pay the Commissioner a penalty of £247,590.
2. This Penalty Notice is issued in respect of the Commissioner’s findings
of infringement of the following provisions of the UK General Data
Protection Regulation (“UK GDPR”):
a) Articles 5(1)(a), 6 and 8 UK GDPR (the “Lawful Basis
Infringements”); and
b) Article 35 UK GDPR (the “DPIA Infringement”),
together, the “Infringements.”
3. On 17 December 2024, the Information Commissioner’s Office (“ICO”)
informed MediaLab that it had initiated an investigation into MediaLab’s
processing of children’s personal data in order to assess its compliance
with the UK GDPR and DPA 2018 (the “Investigation”). 1 The
Investigation followed the introduction of the Commissioner’s Age
1
Letter from the ICO to MediaLab, 17 December 2024
3
Appropriate Design Code 2 (the “Children’s Code”) which sets out 15
standards, underpinned by the requirements of the UK GDPR, which
organisations within its scope are expected to adhere to.
4. This Penalty Notice sets out the Commissioner’s conclusions and the
reasons why the Commissioner has decided to impose a penalty,
including the circumstances of the Infringements and the nature of the
personal data involved.
5. In accordance with paragraph 2 of Schedule 16 to the DPA 2018, the
Commissioner issued a notice of intent (“NOI”) to MediaLab on 10
September 2025 setting out the reasons why the Commissioner
proposed to issue a penalty notice to MediaLab. In that NOI, the
Commissioner indicated that the total amount of the penalty he
proposed to impose was £393,000, comprised of £262,500 for the
Lawful Basis Infringements and £130,500 for the DPIA Infringement.
6. On 29 October 2025, MediaLab made written representations (the
“Written Representations”) in response to the Commissioner’s NOI. 3
In reaching the decision to issue this Penalty Notice, the Commissioner
has taken full account of MediaLab’s representations and, where
appropriate, this Penalty Notice makes specific reference to them.
7. Subject to paragraph 8 below, this Penalty Notice relates to the
processing by MediaLab of personal data relating to the users of the
Imgur website and mobile application (together the “Platform”) who:
a) in respect of the Lawful Basis Infringements, were under 13 years
old; and
b) in respect of the DPIA Infringement, were under 18 years old (the
“Relevant Processing”).
2
Age appropriate design: a code of practice for online services | ICO, which came into
force on 2 September 2020 with a 12-month transition period for organisations to conform
by 2 September 2021.
3
Letter from Kennedys Law LLP to the ICO, 29 October 2025
4
8. However, the Relevant Processing does not include processing
performed by MediaLab that was necessary for the purposes of:
a) identifying and removing users under 13 years old from the
Platform;
b) detecting, preventing and responding to security risks, abuse,
fraud and technical issues which could harm such users; or
c) complying with applicable law.
9. The DPIA Infringement relates to a failure to carry out a data protection
impact assessment (“DPIA”) in respect of prospective high-risk
processing of personal data of users of the Platform who were under the
age of 18.
10. The Commissioner has concluded that MediaLab infringed Article
5(1)(a), Article 6, Article 8 and Article 35 UK GDPR for the reasons
summarised below:
a) MediaLab processed the personal data of children under 13 years
old on the Platform unlawfully in circumstances where none of the
lawful bases for processing in Article 6(1)(a)-(f) UK GDPR applied
to the Relevant Processing, in breach of the requirement that
personal data shall be processed lawfully, fairly and in a
transparent manner in relation to the data subject (Article 5(1)(a)
UK GDPR).
b) The Platform’s Terms of Service 4 (the “Terms of Service”) permit
children under 13 years old to access the Platform under parental
supervision. However, MediaLab did not use any form of assurance
to determine the age of users of the Platform and did not have any
measures in place to obtain parental consent to the processing of
the personal data of users of the Platform under 13 years old.
Therefore, whilst MediaLab confirmed that it sought to rely on
4
Terms of Service — Imgur: The magic of the Internet (accessed 6 August 2025)
5
consent for the processing of the personal data of children under
13 years old on the Platform in accordance with Article 6(1)(a) UK
GDPR, 5 it failed to ensure that consent was given or authorised by
the holder of parental responsibility over these children, and/or
failed to make reasonable efforts to verify in such cases that
consent was given or authorised by the holder of parental
responsibility, taking into consideration available technology, as
required by Article 8 UK GDPR.
c) MediaLab failed to carry out a DPIA in accordance with the
requirements of Article 35(1) UK GDPR, despite engaging in
processing which was likely to result in a high risk to the rights and
freedoms of natural persons, in this case children who were under
18 years old. 6
11. The Commissioner has concluded that the relevant period of
infringement (the “Relevant Period”) began on 27 September 2021
when MediaLab acquired Imgur, Inc. 7 and ended on 30 September
2025, when MediaLab implemented measures intended to prevent
users in the UK from accessing the Platform. 8
12. This Penalty Notice is issued in respect of the Infringements on the
basis that, in all the circumstances of the case, and having regard to
the matters listed in Article 83(1) and 83(2) UK GDPR, the
Commissioner considers that the imposition of a penalty in the sum of
£247,590 is an effective, proportionate and dissuasive response to the
Infringements.
5
Letter from MediaLab to the ICO, 30 October 2024
6
Article 35(4) UK GDPR requires the Commissioner to establish and publish a list of the
types of processing operation which are subject to the requirement for a DPIA pursuant to
Article 35(1) UK GDPR. The list the Commissioner has published in accordance with Article
35(4) UK GDPR includes the use of personal data of children where the controller intends to
offer online services directly to children.
7
Celebrating Imgur's Next Chapter - Imgur (accessed 24 July 2025) and letter from
MediaLab to the ICO dated 23 July 2025
8
Imgur access in the United Kingdom – imgur (accessed 20 October 2025)
6
13. The Commissioner notes MediaLab’s commitment in its Written
Representations, that, to the extent that it decides to relaunch the
Platform in the UK, and prior to doing so, it will implement a
remediation plan designed to achieve compliance with the UK GDPR,
and, where applicable, the Children’s Code. This commitment includes
carrying out a child-focused DPIA and implementing age-assurance
controls appropriate to the level of risk, including verifiable parental
consent for children under 13 years old or, where applicable, 18+ age-
gating (in the event that MediaLab decided to relaunch the Platform in
the UK as an adult-only service). 9
14. The penalty of £247,590 is comprised of:
a) £165,375 in respect of the Lawful Basis Infringements; and
b) £82,215 in respect of the DPIA Infringement.
II. RELEVANT LEGAL FRAMEWORK
15. Section 155(1) DPA 2018 provides that where the Commissioner is
satisfied that a person has failed, or is failing, in a manner described in
section 149(2) DPA 2018, the Commissioner may, by written notice (a
penalty notice), require the person to pay to the Commissioner an
amount in sterling specified in the notice.
16. Section 149(2) DPA 2018 materially provides that:
“The first type of failure is where a controller or processor has failed, or
is failing to comply with any of the following –
(a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3
or Chapter 2 of Part 4 of this Act (principles of processing);
(b) a provision of Articles 12 to 22 of the UK GDPR or Part 3 or 4 of
this Act conferring rights on a data subject;
9
MediaLab’s Written Representations, 29 October 2025, Executive Summary: paragraph
1.6
7
(c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or
65 of this Act (obligations of controllers and processors)…”
17. The relevant substantive provisions of the UK GDPR are set out below
in the sections dealing with the respective Infringements. The legal
framework on setting penalties is set out in Section V of this Notice.
III. BACKGROUND TO THE INFRINGEMENTS
18. This section summarises the relevant background to the
Commissioner’s findings of infringement.
(1) The Children’s Code and the background to the Investigation
19. The Commissioner is required by section 123(1) DPA 2018 to prepare
a code of practice which contains such guidance as the Commissioner
considers appropriate on standards of age-appropriate design of
relevant information society services (“ISS”) 10 which are likely to be
accessed by children. In compliance with this obligation, the
Commissioner laid the Children’s Code before Parliament on 11 June
2020. The Children’s Code was then issued on 12 August 2020 and
came into force on 2 September 2020. 11
20. In accordance with section 123(1) DPA 2018, the Children’s Code is
directed at providers of ISS that are “likely to be accessed by children”
and is expressly not “restricted to services specifically directed at
children.” 12
10
Article 4(25) UK GDPR states that “information society service” means a service as
defined in Article 1(b) of Directive (EU) 2015/1535 of the European Parliament and of the
Council (as it had effect immediately before IP completion day) which defines “service” as
“any service normally provided for remuneration, at a distance, by electronic means and at
the individual request of a recipient of services. For the purposes of this definition (i) ‘at a
distance’ means that the service is provided without the parties being simultaneously
present; (ii) ‘by electronic means’ means that the service is sent initially and received at its
destination by means of electronic equipment for the processing (including digital
compression) and storage of data, and entirely transmitted, conveyed and received by
wire, by radio, by optical means or by other electromagnetic means; (iii) ‘at the individual
request of a recipient of services’ means that the service is provided through the
transmission of data on individual request.”
11
About this code | ICO
12
See Children’s Code: Services Covered by this Code
8
21. The transitional arrangements set out upon issuance of the Children’s
Code provided that ISS within its scope were expected to bring their
processing into compliance with the standards of the Children’s Code
by 2 September 2021. 13
22. On 18 May 2021, the Commissioner conducted a risk assessment to
identify any ISS that could be considered to be higher risk because of
provisional indications of non-conformance with the Children’s Code.
This assessment identified social media and messaging services as a
sector of high risk for children. 14
23. MediaLab, and specifically the Platform, was identified as of interest in
the context of this work. The ICO identified that the Platform was
ranked by Statista as the eleventh most commonly used website or
mobile app to watch video content online by children in the UK as of
January 2021. 15 Following a review of the age assurance practices on
the Platform, the Commissioner wrote to MediaLab on 21 August 2024
informing the company that he had concerns regarding the absence of
any such measures and requesting further information about the
processing of personal data relating to users of the Platform aged under
18. 16
24. The Commissioner reviewed MediaLab’s responses in order to identify
whether there was a risk that MediaLab’s processing activities in
relation to the Platform were not conforming to the standards set out
in the Children’s Code, which would indicate a likelihood that MediaLab
would be unable to demonstrate its compliance with relevant provisions
of the UK GDPR. 17 Following this assessment and further internal
discussions, the Commissioner commenced the Investigation on 17
December 2024.
13
See Children’s Code: Transitional arrangements and section 123(6) DPA 2018
14
Intelligence Briefing – Age Appropriate Design Code – Risk Assessment (8 May 2021)
15
Platforms used by children in the UK to watch online videos 2021| Statista
16
Letter from the ICO to MediaLab, 21 August 2024
17
See Children's Code: Legal status of this code
9
(2) Corporate background
25. Imgur, Inc. was incorporated on 28 March 2014 in Delaware, USA and
is headquartered in San Francisco, California, USA. 18
26. On 27 September 2021, Imgur, Inc. was acquired by MediaLab. 19
MediaLab was founded in 2018 by and is
headquartered in Santa Monica, California, USA. MediaLab was
incorporated as MediaLab.AI, Inc. on 18 May 2018 in Delaware, USA. 20
MediaLab describes itself as “a media and technology company focused
on acquiring and expanding properties and global brands.” 21
27. Imgur, Inc. operates as a wholly owned subsidiary of MediaLab. In
response to enquiries from the Commissioner, MediaLab stated that
“Imgur is wholly owned and operated by MediaLab. Day-to-day
operations are overseen by Imgur’s Product Owner, a MediaLab
employee. Imgur also utilises shared resources that are available to
MediaLab-owned platforms, including legal, trust and safety, support,
HR, sales and business development, finance/accounting,
advertisement technology and data services.” 22 In addition, MediaLab
informed the Commissioner that “MediaLab’s executive team, which
includes the chief executive officer, chief accounting officer and chief
product officer, is responsible for making decisions about the purpose
and means of processing personal data” of users of the Platform. 23
28. MediaLab and its subsidiaries, including Imgur, Inc., are wholly-owned
subsidiaries of
was incorporated on and acquired
MediaLab on 24
18
Letter from MediaLab to the ICO, 23 July 2025
19
Celebrating Imgur's Next Chapter - Imgur (accessed 24 July 2025) and letter from
MediaLab to the ICO dated 23 July 2025
20
Letter from MediaLab to the ICO, 23 July 2025
21
MediaLab: About | LinkedIn (accessed 6 August 2025)
22
Letter from MediaLab to the ICO, 3 May 2025
23
Letter from MediaLab to the ICO, 3 May 2025
24
Letter from MediaLab to the ICO, 23 July 2025
10
29. , MediaLab and Imgur, Inc. are not
publicly traded companies. On 5 May 2025, MediaLab provided financial
information for MediaLab and Imgur, Inc. to the Commissioner which
showed that in the year ending 31 December 2024, MediaLab
generated a worldwide revenue of $ . In response to the NOI
and in support of its Written Representations, MediaLab provided
updated financial information which showed that MediaLab’s projected
turnover for the year ending 31 December 2025 was expected to
on an annualised basis to $ .25
30.
Consequently, no financial documents
relating to are available as of the
date of this Penalty Notice. 26
31. As of 28 April 2025, MediaLab employed approximately staff,
including both full time employees and contractors, of which staff
members were solely employed by Imgur, Inc. However, as Imgur, Inc.
utilises shared resources that are available to MediaLab-owned
platforms, the number of individuals who work on projects related to
the Platform at any given time fluctuates. 27
32. Neither MediaLab nor Imgur, Inc. have a UK-based office, nor any UK-
based employees. However, during the Relevant Period, MediaLab
engaged the services of DP Data Protection Services Ltd as its UK
representative for the purposes of Article 27(1) UK GDPR. 28
25
This figure was calculated by dividing MediaLab’s reported turnover in the nine months to
30 September 2025 by nine and multiplying by twelve.
26
Letter from MediaLab to the ICO, 23 July 2025
27
Letter from MediaLab to the ICO, 3 May 2025
28
The Commissioner notes that whilst DP Data Protection Limited is MediaLab’s
representative in the UK for the purposes of Article 27 UK GDPR, this does not affect
MediaLab’s own legal liability, pursuant to Article 27(5) UK GDPR.
11
(3) The Platform
33. The Platform is an online image sharing and hosting platform that
allows users to view, post and share media, for example, graphics
interchange formats (“GIFs”) and images. Users can communicate
with one another by posting public comments or sending private
messages, GIFs or emojis. Throughout the Relevant Period, the
Platform was available to download in app format in the UK via the
Apple App Store 29 and Google Play Store, 30 whilst its website 31 was
also accessible to users in the UK.
34. The Platform was generally free to access for users in the UK.
However, MediaLab did offer a service called “Imgur Emerald” where,
for a monthly payment of £1.99, users could browse the Platform free
of advertisements, receive a trophy for their profile and unlock
themed avatars. Imgur Emerald members could also award three free
“Accolades” to posts on the Platform each day. 32
35. Any person can browse the Platform as a guest, without creating an
account (“Guest Users”), or by creating and logging into an account
(“Logged-in Users”). Logged-in Users can post GIFs, videos and
images to the Platform, which can then be responded to by other
Logged-in users, including by up or down voting the content and
leaving comments. Guest Users can upload content but cannot access
uploads to the Platform without the direct URL, up or down vote
existing content, comment on posts or otherwise interact with users in
any way. If a Guest User attempts to take any of these actions, a
pop-up is generated prompting the user to sign-up or log in to an
account on the Platform.
36. All posts on the Platform are public and accessible by other users.
29
Imgur: Funny Memes & GIF Maker on the App Store (accessed 6 August 2025)
30
Imgur: Funny Memes & GIF Maker – Apps on Google Play (accessed 6 August 2025)
31
www.imgur.com (accessed 6 August 2025)
32
Imgur Emerald - Browse ad-free and get bonus exclusives (accessed 21 August 2025)
12
However, all users can create “hidden” posts which are not searchable
and do not appear in the Platform’s public gallery, whilst remaining
accessible via the direct URL. 33 Users are able to store their favourite
posts on the Platform in private folders outside of their public
profile. 34 Logged-in Users can send direct messages to other users.
However, according to the Platform’s privacy policy (the “Privacy
Policy”), 35 “To ensure that Imgur’s messaging platform is not used as
a platform for illegality, all messages are public. No messages are
ever completely hidden from public view. We may monitor user
messaging.” 36
37. The Platform contains a “mature content” toggle which allows Logged-
in Users to “enable mature content”. Logged-In Users do not have to
verify their age when changing their mature content settings.
Throughout the Relevant period, UK-based users of the Platform could
not turn on “mature content” on the iOS version of the Platform due
to Apple’s App Store requirements. If this was attempted, users of the
iOS version of the Platform received an error message when
attempting to open the settings through the Platform’s Help Centre.
38. In April and July 2025, the ICO undertook research on the content
available on the Platform, a summary of which can be found at Annex
3. 37 The research identified content containing explicit imagery which
has factored into the Commissioner’s consideration of seriousness in
Section V(2) of this Penalty Notice. An advisory content warning is
hereby given in respect of the contents of Annex 3. This research
found that potentially harmful content was accessible to both Logged-
33
Post Privacy Settings – imgur (accessed 21 August 2025)
34
Favorites and Favorite Folders – imgur (accessed 21 August 2025)
35
As part of the Investigation, the Commissioner has reviewed versions of the Privacy
Policy dated 6 May 2021, 3 May 2022, 11 January 2023 and 22 January 2024.
36
Privacy Policy — Imgur: The magic of the Internet (accessed 6 August 2025)
37
The research was conducted using an iOS device and separately using an Android device,
both in the Imgur app and via a web browser (Safari, in the case of the iOS device and
Google Chrome, in the case of the Android device).
13
in Users and Guest Users on the Platform. This was accessible both
when the mature content setting was toggled to on and to off.
39. On 11 August 2025, MediaLab informed the Commissioner that it
intended to withdraw the Platform from the UK market by no later
than February 2026 on the basis that “market conditions are such that
operations are no longer viable in this region.” 38
40. In a subsequent update to the Commissioner on 18 August 2025,
MediaLab stated that the withdrawal of the Platform from the UK was
a “high priority for MediaLab” and that “as such, the target for the
[P]latform’s exit is now on or before September 30, 2025.” 39 At this
time the Commissioner understood that MediaLab intended to deploy a
geo-block, 40 meaning that users identified as being located in the UK
would no longer be able to access the Platform, either via a web
browser or the mobile application. MediaLab informed the
Commissioner that users attempting to access the Platform from the
UK would be redirected to a help centre article regarding the
withdrawal of the Platform from the UK. MediaLab also stated that it
would provide users with advance notice of the geo-block in order to
enable them to backup their content, delete their account or request
copies of their personal data from MediaLab, with MediaLab indicating
that it would continue to provide support to UK users for a period of
time following the deployment of the geo-block to ensure that they
retain the ability to submit requests for their personal data. 41
41. On 30 September 2025, MediaLab issued a statement confirming that,
as of that date, “access to Imgur from the United Kingdom is no longer
available. UK users will not be able to log in, view content, or upload
images. Imgur content embedded on third-party sites will not display
38
Email from MediaLab to the ICO, 11 August 2025
39
Email from MediaLab to the ICO, 18 August 2025
40
A “geo-block” refers to the practice of restricting or denying access to online content or
services based on a user’s geographical location, as determined by their IP address.
41
Email from MediaLab to the ICO, 18 August 2025
14
for UK users.” 42
(4) MediaLab’s processing of personal data
42. The personal data processed by MediaLab via the Platform varies
according to whether the Platform is accessed by a Logged-in User or
a Guest User. In respect of both Logged-in Users and Guest Users,
MediaLab automatically collects:
a) IP address; 43
b) region; 44
c) device characteristics (including device ID for mobile devices);
d) operating systems;
e) browser type;
f) username from stored cookies, 45 if present;
g) page and image viewing statistics; and
h) metadata associated with any uploaded images.
43. The categories of information listed at points c) to h) above are
identified in the Privacy Policy as information that is automatically
collected. However, the Privacy Policy states that “None of this
information is “personal information” – that is, data we could use to
identify a specific person.” Despite this statement by MediaLab, the
Commissioner has concluded that this information constitutes
42
Imgur access in the United Kingdom – imgur (accessed 22 October 2025)
43
An Internet Protocol (“IP”) address is a unique string of numbers that identifies each
computer using the IP to communicate over a network.
44
Letter from MediaLab to the ICO, 3 May 2025. The Commissioner understands that the
user’s “region” refers to the geographical location from which the user is accessing the
Platform, as determined by their IP address.
45
A cookie is a small text file that is downloaded on to “terminal equipment” (e.g. a
computer or smartphone) when a visitor accesses a website. Essential cookies enable core
website functionality, such as account management and user login, while non-essential
cookies allow for further personalisation of a visitor’s experience on the relevant website –
including personalised advertising – and for website providers to measure analytics and
website performance.
15
“personal data,” within the meaning of Article 4(1) UK GDPR, 46 as it is
information which relates to an identified or identifiable natural person
and could, either directly or indirectly in combination with other
information collected by MediaLab, be used to identify that natural
person. In reaching this conclusion, the Commissioner has considered
the ICO’s guidance on what is personal data, 47 which states that
organisations “may process information that, by itself, does not
permit the direct identification of an individual. However, within your
organisation you may also process other information that, when
combined, allows a particular individual to be indirectly identified. If
the information relates to that identified individual, it constitutes
personal data.” 48
44. In addition to the categories of personal data listed at paragraph 42
above, where the Platform is accessed by a Logged-in User, MediaLab
processes the following categories of personal data:
a) email address; 49
b) username; 50 and
c) dates and times of each log in. 51
45. A mobile phone number is also required to open an account on the
Platform. According to the Privacy Policy, a verification code is sent to
the account holder to verify the number but, beyond that, the number
is not retained by MediaLab. Instead, the mobile number is one way
46
Article 4(1) UK GDPR defines “personal data” as “any information relating to an identified
or identifiable natural person (‘data subject’); an identifiable natural person is one who can
be identified, directly or indirectly, in particular by reference to an identifier such as a
name, an identification number, location data, an online identifier or to one or more factors
specific to the physical, physiological, genetic, mental, economic, cultural or social identity
or social identity of that natural person.”
47
What is personal data? | ICO
48
Can we identify an individual indirectly from the information we have (together with
other available information)? | ICO
49
Letter from MediaLab to the ICO, 3 May 2025
50
Privacy Policy — Imgur: The magic of the Internet (accessed 6 August 2025)
51
Privacy Policy — Imgur: The magic of the Internet (accessed 6 August 2025)
16
encrypted into a hash which, according to MediaLab, cannot be
decrypted.
46. MediaLab advises users in the European Economic Area who wish to
open an account on the Platform not to use their real name when
creating a username, instructing them to “choose a username and
email address that reveal nothing about your identity. If you give us
an email address, we’ll probably send you promotional messages once
in a while… We may work with outside companies to deliver targeted
advertising to you while ensuring that no personal information about
you is ever used; for example, we may generate a one-way hash from
the email address you provide and provide only the hash to the
outside companies, who track only the hash.” 52
47. MediaLab also informs users of the Platform that when they input an
email address, such as when logging in or signing up for a newsletter,
it “may share with LiveRamp 53 and its group companies information
that we collect from you, such as your email (in hashed,
pseudonymous form), IP address, or information about your browser
or operating system, with any of the following, acting as “joint
controllers” (as applicable and defined in the GDPR). LiveRamp uses
this information to create an online identification code that we may
store in our first-party cookie for our use in online, in-app and cross-
channel advertising. This may be shared with advertising companies
to enable interest-based and targeted advertising. LiveRamp uses this
information to create an online identification code for the purpose of
recognising you on your devices. This code does not contain any of
52
Privacy Policy — Imgur: The magic of the Internet (accessed 6 August 2025)
53
LiveRamp Holdings, Inc. is a US-based software-as-a-service company which enables
companies and their partners to connect, control and use data to tailor customer
experiences with the aim of increasing the profitability of their businesses. LiveRamp
provides an interoperable software infrastructure which, amongst other services, enables
data onboarding (transferring offline data to an online environment for marketing
purposes) and can be integrated into an organisation’s existing systems. - About Us |
LiveRamp (accessed 30 June 2025)
17
your directly identifiable personal data and will not be used by
LiveRamp to re-identify you.” 54
48. In respect of information posted by users of the Platform, the Privacy
Policy states as follows:
“Imgur does not “collect” the stuff you post: images, comments,
messages, etc., and – with respect to persons in the EEA – does not
“process” or determine any purposes for processing of any
information that you manifestly make public… No image uploaded to
Imgur is ever completely hidden from public view. This is mainly to
ensure that Imgur, which allows for anonymous postings, will not be
used as a platform for illegality.” 55
49. The Privacy Policy also states that “Imgur does not collect “personal
data” about, or monitor behavior of, “data subjects” as those terms
are defined in GDPR Art.4(1), nor do we “target” individuals in the
EEU [sic].” 56
50. Notwithstanding this statement, the Commissioner’s view is that,
throughout the Relevant Period, MediaLab processed, within the
meaning of Article 4(2) UK GDPR, the personal data of UK users of the
Platform listed in paragraphs 42 and 44 above, as the Privacy Policy
states that this information is automatically collected and “collection”
is listed as an example of an operation which constitutes “processing”
in Article 4(2) UK GDPR.
(5) Child users of the Platform
51. This sub-section sets out:
a) MediaLab’s stated position on access to the Platform by users
under 13 years old; and
b) the Commissioner’s estimates of the number of children who
54
Privacy Policy — Imgur: The magic of the Internet (accessed 6 August 2025)
55
Privacy Policy — Imgur: The magic of the Internet (accessed 6 August 2025)
56
Privacy Policy — Imgur: The magic of the Internet (accessed 6 August 2025)
18
used the Platform in the UK during the Relevant Period.
(a) The Platform’s Terms of Service and MediaLab’s approach
to children using the Platform
52. The Terms of Service are accessible at the foot of the Platform’s
website landing page, as well as by navigating to “Settings” in the
app. The Terms of Service purport to set out the terms users are
required to accept as a condition of accessing the Platform. However,
there is no requirement for users to positively affirm that they have
accepted these terms.
53. In respect of children under 13 years old, the Terms of Service state
that:
“Imgur is not meant for use by children under age 13; if your child is
younger than 13 please allow him or her to use it only under your
supervision. Parental control protections (such as computer hardware,
software, or filtering services) are commercially available that may
assist you in limiting access to material that is harmful to minors. See
e.g. www.toptenreviews.com/software/security/best-internet-filter-
software.” 57
54. In response to enquiries from the Commissioner, MediaLab confirmed
that “instances where a user under 13 would be permitted to use the
platform would be where they are doing so under parental
supervision, in accordance with the Terms of Service,” but that it
“does not currently perform any age assurance at account set-up, nor
does [MediaLab] capture birth dates.” 58 When asked how underage
accounts can be detected, in light of the fact that MediaLab does not
undertake any form of review of the ages of account holders,
MediaLab informed the Commissioner that “Potential underage
accounts that are detected would have been brought to the attention
57
Terms of Service — Imgur: The magic of the Internet (accessed 6 August 2025)
58
Letter from MediaLab to the ICO, 15 October 2024
19
of Imgur through user reporting. This includes accounts that may
have been identified through direct reports or during investigations
related to other reports. When a potentially underage account is made
known to Imgur, the Trust & Safety Team will review the user’s profile
to confirm whether the account holder is indeed underage, based on
evidence available on the user’s profile.” When asked to confirm how
many underage accounts had been removed in the last 12 months
and to provide a breakdown of how many of those accounts related to
UK users, MediaLab answered ”None”. 59 MediaLab also confirmed that
“There is no mechanism currently used to determine whether an
account identified as “underage” is being used with parental
supervision.” 60
55. MediaLab confirmed that “Any measures undertaken to safeguard
against inappropriate content are applied across the entire platform,
regardless of user age.” 61 MediaLab also confirmed that it had no plans
to introduce a child-specific version of the Platform. 62
56. On 3 May 2025, MediaLab informed the Commissioner that it was
“assessing the implementation of age assurance measures based on
known or potential risks associated with the [Platform], costs of
implementation and its potential economic impact, and user
experience. Additionally, due to the disparity in users who engage
with the [Platform] logged-out vs. those who engage with the
[Platform] logged-in, further investigation must be conducted to
determine the feasibility of an age assurance measure that is
proportionate to the processing activities. This assessment and
associated internal discussions, are ongoing.” 63
57. However, on 18 August 2025, MediaLab informed the Commissioner
59
Letter from MediaLab to the ICO, 10 January 2025
60
Letter from MediaLab to the ICO, 3 May 2025
61
Letter from MediaLab to the ICO, 10 January 2025
62
Letter from MediaLab to the ICO, 10 January 2025
63
Letter from MediaLab to the ICO, 3 May 2025
20
that it was “no longer investigating age assurance in relation to the
UK market due to the associated costs and the timing [of the
withdrawal of the Platform from the UK].” 64
58. The Commissioner notes MediaLab’s statement in its Written
Representations that, to the extent that it decides to relaunch the
Platform in the UK, and prior to doing so, it would implement a
remediation plan designed to achieve compliance with the UK GDPR,
the Privacy and Electronic Communications Regulations 2003 and,
where applicable, the Children’s Code. MediaLab informed the
Commissioner that such a remediation programme would include, but
not be limited to, carrying out a child-focused DPIA under Article 35
UK GDPR and age-assurance controls appropriate to the level of risk,
including verifiable parental consent for children under 13 years old
or, where applicable, 18+ age-gating (in the event that MediaLab
decided to relaunch the Platform in the UK as an adult-only service). 65
(b) The number of children using the Platform in the UK
59. As explained at paragraph 60 below, throughout the Relevant Period,
MediaLab did not require its UK users to declare their age before
accessing or using the Platform. 66
60. In response to the Commissioner’s enquiries, MediaLab stated that it
did not know how many children use the Platform and that it was
unable to break down user numbers by age because it “does not
collect user age information beyond acceptance of our terms that
users must be over 13 to use our service.” 67
61. MediaLab initially informed the Commissioner that there were
UK users (of any age) of the Platform during the period
64
Email from MediaLab to the ICO, 18 August 2025
65
MediaLab’s Written Representations, 29 October 2025, Executive Summary: paragraph
1.6
66
Letter from MediaLab to the ICO, 15 October 2024
67
Letter from MediaLab to the ICO, 15 October 2024
21
between 1 June 2023 and 1 June 2024. 68 However, MediaLab
subsequently informed the Commissioner that this figure had been
erroneously calculated and provided updated estimates of
UK users of the Platform for the period between 1 June 2023 and 1
June 2024 and UK users of the Platform for the period
between 1 September 2023 and 1 September 2024. 69 When asked to
clarify this figure, MediaLab confirmed that this referred to unique
users rather than total instances of visits to the Platform by UK users.
MediaLab added that UK users accessed the Platform on
occasions in the 1 September 2023 to 1 September 2024 period. 70
The Commissioner has not relied on the estimates provided by
MediaLab when reaching the findings set out in this Penalty Notice.
62. Using a range of publicly available sources, the Commissioner has
produced his own estimates of the likely number of users of the
Platform between the ages of 13-17 and under 13 years old. Whilst
the relevant data is yet to be published for 2024 and 2025, the
Commissioner’s estimates cover the majority of the Relevant Period
and, as such, provide an indication of the number of children who
used the Platform during the Relevant Period. The Commissioner’s
estimates of the number of children under 13 years old who used the
Platform during the Relevant Period ranges between approximately
46,000 and 96,000 in the years 2021 to 2023. The Commissioner’s
estimates of the number of users of the Platform aged between 13
and 17 ranges between approximately 24,000 and 101,000 during the
same period. Annex 2 contains further detail relating to the
Commissioner’s estimates of the number of children who used the
Platform during the Relevant Period. 71
68
Letter from MediaLab to the ICO, 15 October 2024
69
Letter from MediaLab to the ICO, 30 October 2024
70
Letter from MediaLab to the ICO, 3 May 2025
71
These figures were compiled using the results from the Ofcom Children’s Media Literacy
Tracker survey 2021, 2022 and 2023, which provided data on the use of the Platform by
22
IV. FINDINGS OF INFRINGEMENT
63. The Commissioner has concluded that during the Relevant Period, the
Relevant Processing infringed Article 5(1)(a), Article 6, Article 8 and
Article 35(1) UK GDPR for the reasons summarised below:
a) MediaLab processed the personal data of children under 13 years
old on the Platform unlawfully as, in breach of the requirement that
personal data shall be processed lawfully, fairly and in a
transparent manner in relation to the data subject (Article 5(1)(a)
UK GDPR), none of the lawful bases set out in Article 6(1)(a) to (f)
UK GDPR applied to the Relevant Processing;
b) whilst MediaLab sought to rely on consent as its lawful basis for
processing the personal data of children under 13 years old on the
Platform in accordance with Article 6(1)(a) UK GDPR, it failed to
ensure that consent was given or authorised by the holder of
parental responsibility over these children, and/or failed to make
reasonable efforts to verify in such cases that consent was given
or authorised by the holder of parental responsibility, taking into
consideration available technology, as required by Article 8 UK
GDPR; and
c) MediaLab failed to carry out a DPIA in accordance with the
requirements of Article 35(1) UK GDPR, despite engaging in
processing which was likely to result in a high risk to the rights and
freedoms of individuals (Article 35(1) UK GDPR), in this case,
children under 18 years old.
children under the age of 18. The Commissioner primarily relied upon figures compiled
from the responses to the question “Which, if any, of these apps or sites does your child
watch videos on?”, whilst the Ofcom reports also included a summary of the percentage of
children using different applications across all activities and uses, thereby providing a
central estimate of users between the ages of 3 and 17. The Commissioner combined the
results from the Ofcom Media Literacy and Ofcom Children’s Media Literacy survey reports
with statistics compiled by the Office for National Statistics setting out the total number of
children in the UK and in the age bracket of 3 – 17 for the relevant years.
23
64. In reaching his findings, the Commissioner has had regard to the
matters set out below.
(1) The Relevant Period
65. As set out at paragraph 11 above, the Commissioner has concluded
that the Relevant Period of infringement began on 27 September 2021,
when MediaLab acquired Imgur, Inc., 72 and ended on 30 September
2025, when MediaLab prevented UK-based users from accessing the
Platform. 73 The Commissioner considers that, throughout the Relevant
Period, MediaLab remained non-compliant with the requirements of
Article 5(1)(a), Article 6, Article 8 and Article 35(1) UK GDPR in respect
of the Relevant Processing.
(2) MediaLab’s status as a controller
66. MediaLab is the controller in respect of personal data of UK data
subjects who were either Logged-in Users or Guest Users (or both) of
the Platform during the Relevant Period because it determined the
purpose and means of the Relevant Processing within the meaning of
Article 4(7) UK GDPR. 74
67. The Privacy Policy does not identify the controller of personal data of
users of the Platform. However, MediaLab confirmed to the
Commissioner that “Medialab’s executive team, which includes the chief
executive, chief accounting officer and chief product officer, is
responsible for making decisions about the purpose and means of
processing personal data. The executive team may consult with subject
matter experts from MediaLab’s data, engineering, or product teams
who are familiar with the products and its users.” 75
72
Celebrating Imgur's Next Chapter - Imgur (accessed 24 July 2025) and letter from
MediaLab to the ICO, 23 July 2025
73
Imgur access in the United Kingdom – imgur (accessed 20 October 2025)
74
Article 4(7) UK GDPR defines “controller” as “the legal or natural person, public
authority, agency or other body which, alone or jointly with others, determines the
purposes and means of the processing of personal data.”
75
Letter from MediaLab to the ICO, 3 May 2025
24
(3) Scope of the UK GDPR and DPA 2018
68. The provisions of the UK GDPR and DPA 2018 apply to the processing
of personal data by MediaLab during the Relevant Period for the
following reasons.
(a) Material scope
69. Article 2 UK GDPR sets out the Regulation’s material scope:
a) Article 2(1) UK GDPR provides that the UK GDPR applies to “the
automated or structured processing of personal data”, subject to
the exceptions set out in Article 2(2) UK GDPR.
b) The Relevant Processing constitutes the automated processing of
personal data and none of the exceptions in Article 2(2) UK GDPR
apply.
c) Part 2 of the DPA 2018 applies to the Relevant Processing by virtue
of section 4(2)(a) DPA 2018, which provides that “[Part 2] applies
to the types of processing of personal data to which the UK GDPR
applies by virtue of Article 2 of the UK GDPR.”
(b) Territorial scope
70. Article 3(2) UK GDPR provides that “This Regulation applies to the
relevant processing 76 of personal data of data subjects who are in the
United Kingdom by a controller or processor not established in the
United Kingdom, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a
payment of the data subject is required, to such data subjects in
the United Kingdom…”
71. MediaLab has no UK offices, nor any employees within the UK and,
throughout the Relevant Period, engaged the services of DP Data
76
Article 3(2A) provides that: “In paragraph 2, “relevant processing of personal data”
means processing to which this Regulation applies, other than processing described in
Article 2(1)(a) or (b) or (1A).” For the avoidance of doubt, the Relevant Processing is not a
form of processing described in Article 2(1)(a) or (b) or (1A) UK GDPR.
25
Protection Services Ltd as its UK representative for the purposes of
Article 27 UK GDPR. 77
72. The Relevant Processing falls within the scope of Article 3(2)(a) UK
GDPR. In particular:
a) the Relevant Processing involved MediaLab processing the
personal data of data subjects who are in the UK;
b) MediaLab offered services to data subjects in the UK, in the form
of the provision of access to the website and app versions of the
Platform to such data subjects. This constituted the provision of
“services” for the purposes of Article 3(2)(a); 78 and
c) MediaLab processed the personal data of UK users of the Platform
for the purposes of providing its services, specifically the enabling
of access to the Platform. This processing, which included the
Relevant Processing, was therefore related to the services which
MediaLab provided to UK data subjects during the Relevant Period.
73. Moreover, where processing falls within the scope of Article 3 UK GDPR,
the DPA 2018 applies to such processing pursuant to section 207(1A)
DPA 2018.
(4) Special protections for children
74. Section 120B DPA 2018 materially provides that “In carrying out
functions under the data protection legislation, the Commissioner
must have regard to such of the following as appear to the
Commissioner to be relevant in the circumstances… (e) the fact that
children merit specific protection with regard to their personal data
because they may be less aware of the risks and consequences
associated with processing of personal data and of their rights in
77
Letter from MediaLab to the ICO, 10 January 2025
78
The Commissioner considers the Platform to be a form of ISS (as defined in paragraph
16 above) and notes the European Data Protection Board (EDPB) position that information
society services are services for the purposes of Article 3(2)(a) GDPR: Guidelines 3/2018
on the territorial scope of the GDPR (Article 3), Version 2.1, p.16
26
relation to such processing.”
75. The introduction of this duty into the DPA 2018 reflects Recital 38 of
the UK GDPR, which states that “Children merit specific protection
with regard to their personal data, as they may be less aware of the
risks, consequences and safeguards concerned and their rights in
relation to the processing of personal data.”
76. Section 123(4)(b) DPA 2018 required the Commissioner to have
regard to the United Nations Convention on the Rights of the Child
(“UNCRC”) when preparing the Children’s Code. The Children’s Code
explains that “The UNCRC recognises that children need special
safeguards and care in all aspects of their life and requires that these
should be guaranteed by appropriate legal protections. European level
data protection law reflects this and provides its own additional
safeguards for children.” 79
77. The concept of the “best interests of the child” is derived from Article
3 of the UNCRC, which provides that “In all actions concerning
children, whether undertaken by public or private social welfare
institutions, courts of law, administrative authorities or legislative
bodies, the best interests of the child shall be a primary
consideration.” The Commissioner’s Children’s Code: Best Interests
Framework explains that “to consider whether you are acting in the
bests interests of children, you must consider how your use of their
data impacts on the range of rights they hold under the UNCRC.” 80
78. Relevant examples of children’s rights that might be at stake when
children use online services are set out in the Commissioner’s
Children’s Code: Best Interests Framework, which refers to a range of
rights children hold under the UNCRC. These rights include provisions
aimed at supporting children’s needs for:
79
About this code | ICO
80
Children’s Code: Best Interests Framework | ICO
27
“● safety;
● health;
● wellbeing;
● family relationships;
● physical, psychological and emotional development;
● identity;
● freedom of expression;
● privacy; and
● agency to form their own views and have them heard.” 81
(5) The Lawful Basis Infringements
79. In summary, the Commissioner finds that, throughout the Relevant
Period, MediaLab infringed Article 5(1)(a), Article 6 and Article 8 UK
GDPR. This is based on the Commissioner’s finding that MediaLab’s
processing of personal data of children under 13 years old for purposes
other than those outlined in paragraph 8 above was carried out without
a valid lawful basis throughout the Relevant Period.
80. The Commissioner finds that none of the lawful bases set out in Articles
6(1)(a) to (f) UK GDPR were applicable to the Relevant Processing. In
particular, consent (Article 6(1)(a) UK GDPR) could only have served
as a valid lawful basis in respect of MediaLab’s processing of personal
data of data subjects under 13 years old insofar as Article 8 UK GDPR
was complied with. The Commissioner has concluded that throughout
the Relevant Period, MediaLab did not comply with the requirements of
Article 8 UK GDPR in relation to the Relevant Processing.
81
Children’s Code: Best Interests Framework | ICO
28
(a) Legal framework
81. Article 5 UK GDPR sets out the principles relating to personal data
processing. These include the following:
“(1) Personal data shall be: (a) processed lawfully, fairly and in a
transparent manner in relation to the data subject (‘lawfulness, fairness
and transparency’).”
82. The Commissioner notes that in order to be compliant with Article
5(1)(a) processing must comply with Article 6 UK GDPR. 82
83. Article 6(1) UK GDPR materially provides that processing “shall be
lawful only if and to the extent that” at least one of six lawful bases
applies. These lawful bases include the following:
(a) the data subject has given consent to the processing of his or her
personal data for one or more specific purposes.”
84. Article 8 UK GDPR materially provides that:
“(1) Where point (a) of Article 6(1) applies, in relation to the offer of
information society services directly to a child, the processing of the
personal data of a child shall be lawful where the child is at least 13
years old. Where the child is below the age of 13 years, such processing
shall be lawful only if and to the extent that consent is given or
authorised by the holder of parental responsibility over the child.”
(2) The controller shall make reasonable efforts to verify in such cases
that consent is given or authorised by the holder of parental
responsibility over the child, taking into consideration available
technology.
(3) Paragraph 1 shall not affect the general contract law as it operates
in domestic law such as the rules on the validity, formation or effect of
a contract in relation to a child.”
82
See the Commissioner’s guidance on Article 5(1)(a) UK GDPR.
29
(b) MediaLab’s stated position
85. The Privacy Policy does not identify the lawful basis for the processing
of personal data of users of the Platform, including child users.
86. MediaLab informed the Commissioner that users under 13 years old are
permitted to use the Platform under parental supervision, in accordance
with the Terms of Service, and confirmed that the lawful basis relied
upon for the processing of the personal data of child users of the
Platform, including those under 13 years old, throughout the Relevant
Period was consent. 83
87. MediaLab also provided the Commissioner with a screenshot of the pop-
up (as shown below) which appears when a user registers for an
account. The pop-up states that “Imgur asks for your consent to use
your personal data to: Personalised advertising and content, advertising
and content measurement, audience research and services
development [and] Store and/or access information on a device.”
83
Letter from MediaLab to the ICO, 15 October 2024
30
88. When asked to provide evidence of the methods MediaLab used to
obtain consent from the holder of parental responsibility over users of
the Platform under 13 years old, MediaLab referred to the pop-up above
and stated that “Imgur does not collect birth date or age from users,
as it does not undertake any review of the ages of account holders after
account set up.” 84
89. In light of the above, it is clear that MediaLab purported to process the
personal data of users of the Platform under 13 years old in reliance
upon the lawful basis of consent pursuant to Article 6(1)(a) UK GDPR.
(c) Findings on Article 5(1)(a), Article 6 and Article 8 UK
GDPR
90. As set out above, Article 6(1)(a) UK GDPR applies where the “data
subject has given consent to the processing of his or her personal data
for one or more specific purposes.” Article 4(11) UK GDPR requires that
84
Letter from MediaLab to the ICO, 15 October 2024
31
this consent must be a “freely given, specific, informed and
unambiguous indication of the data subject’s wishes by which he or she,
by a statement or by clear affirmative action, signifies agreement to
the processing of personal data relating to him or her.”
91. This is a high threshold for a controller relying on Article 6(1)(a) UK
GDPR to meet, as was emphasised in RTM v Bonne Terre Limited &
Hestview Limited [2025] EWHC 111 (KB), in which Mrs Justice Collins
Rice DBE confirmed that “consent must be free, specific and informed,
it must be separate from the activity to which it stands as a threshold
requirement, it must be active and unambiguous.” 85
92. Article 6(1)(a) UK GDPR only applies in respect of processing for the
offer of ISS directly to a child under 13 years old if and to the extent
that consent is given or authorised by the holder of parental
responsibility over the child, pursuant to Article 8(1) UK GDPR.
93. The Commissioner finds that throughout the Relevant Period, MediaLab
offered ISS within the meaning of Article 4(25) UK GDPR.
94. In reaching this finding, the Commissioner has had regard to the
Commissioner’s Guidance on the rules about ISS and consent, 86 which
states:
“Any ISS which explicitly states that it is for children, or has children of
any age as its target audience is clearly being offered directly to a child.
The ICO also considers an ISS is offered directly to a child when it is
made available to all users without any age restrictions or when any
age restrictions in place allow users under the age of 18.
If an ISS is only made available to users who are aged 18 and over
then it is not being offered directly to a child. However, if your ISS
states that it has such an age limit then, in the event of a complaint,
85
RTM v Bonne Terre Limited & Hestview Limited [2025] EWHC 111 (KB) at [147] – [153].
86
ICO: Children and the UK GDPR: What are the rules about ISS and consent?
32
we may look for evidence that the limit is applied in practice, and not
just in theory, when deciding whether Article 8 applies. We may
consider evidence such as site content, marketing plans, systems or
processes designed to limit access, and information provided to users,
in this respect.
This means that you need to carefully consider your target audience,
and be clear about what age group you intend to allow to access your
ISS. If you decide not to offer your ISS to children then you need to
consider how to mitigate the risk of them gaining access, using
measures that are proportionate to the data protection risks inherent
in the processing.
Because online processing of children’s personal data is likely to be high
risk processing, you must use a data protection impact assessment to
help you in this task and to evidence and explain your approach to
processing.”
95. The Platform was provided at a distance, by electronic means, and at
the individual request of its UK users. MediaLab shared personal data
collected from UK users of the Platform with LiveRamp for the purpose
of enabling interest-based and targeted advertising on the Platform 87
and also generated revenue through the payment of monthly fees by
account holders who subscribed to the “Imgur Emerald” service. 88
Furthermore, the Commissioner finds that MediaLab offered these
services directly to children in the UK, with the Commissioner’s
estimates of the annual number of users of the Platform under 13 years
old ranging between approximately 46,000 and 96,000 during the
Relevant Period. 89 Therefore, Article 8(1) UK GDPR applied to the
87
Privacy Policy | MediaLab (accessed 6 August 2025)
88
2024 financial statements for MediaLab and Imgur, Inc. provided to the ICO on 6 May
2025
89
See paragraph 62 above and Annex 2.
33
Relevant Processing due to MediaLab’s reliance on the lawful basis of
consent.
96. In light of the above, the Commissioner considers that Article 8(1) UK
GDPR applied to the Relevant Processing insofar as the lawful basis of
consent, under Article 6(1)(a) UK GDPR, was relied upon.
97. However, MediaLab did not obtain (nor sought to obtain) parental
consent for users under 13 years old. Therefore, the Commissioner
finds that throughout the Relevant Period MediaLab failed to comply
with Article 8 UK GDPR in relation to the Relevant Processing, and that,
as a result, Article 6(1)(a) UK GDPR could not provide a lawful basis for
the Relevant Processing.
98. Therefore, the Commissioner has concluded that the Relevant
Processing infringed Article 5(1)(a) UK GDPR as it was carried out
without a lawful basis.
99. The Commissioner notes that in its Written Representations, MediaLab
accepted the Commissioner’s provisional findings of infringement set
out in the NOI, stating that: “MediaLab accepts in principle the
Commissioner’s core finding that, within the meaning of the NOI, the
Relevant Processing of under-13s personal data… lacked a valid lawful
basis under Article 6 of the UK GDPR because parental authorisation
under Article 8 of the UK GDPR and age verification were not
implemented across the Relevant Period.” 90
(6) The DPIA Infringement
100. The Commissioner finds that MediaLab failed to comply with Article 35
UK GDPR throughout the Relevant Period as it failed to carry out a DPIA
in accordance with the requirements of Article 35(1) UK GDPR, despite
engaging in processing which was likely to result in a high risk to the
90
MediaLab’s Written Representations, 29 October 2025: Section 1: paragraph 1.1
34
rights and freedoms of individuals, in this case, users of the Platform
under the age of 18.
(a) Legal framework
101. Article 35(1) UK GDPR provides:
“Where a type of processing, in particular using new technologies and
taking into account the nature, scope, context and purposes of the
processing, is likely to result in a high risk to the rights and freedoms
of natural persons, the controller shall prior to the processing, carry out
an assessment of the impact of the envisaged processing operations on
the protection of personal data. A single assessment may address a set
of similar processing operations that present similar high risk.”
102. Article 35(4) UK GDPR requires the Commissioner to “establish and
make public a list of the kind of processing operations which are subject
to the requirement for a data protection impact assessment.” The
Commissioner has accordingly published a non-exhaustive list of
examples of processing which are likely to result in a high risk to the
rights and freedoms of natural persons. 91 These examples include the
“use of the personal data of children or other vulnerable individuals for
marketing purposes, profiling or other automated decision-making , or
if you intend to offer online services directly to children,” such as
through “social networks.”
103. The Commissioner’s Guidance on DPIAs 92 is based upon, and
complements, guidelines endorsed by the European Data Protection
Board (“EDPB”). 93 The EDPB guidelines state that a DPIA will be
required where two or more of nine criteria are met. Those criteria
include data processed on a large scale (for example, across a large
91
ICO: DPIAs: When do we need to do a DPIA?: What does the ICO consider likely to
result in high risk?
92
ICO: Data Protection Impact Assessments (DPIAs)
93
Available from the European Commission website, as initially promulgated by the Article
29 Working Party and endorsed by the EDPB.
35
number of data subjects or large geographic area) and the processing
of personal data concerning vulnerable data subjects, including children
“who can be considered as not able to knowingly and thoughtfully
oppose or consent to the processing of their data.” 94
104. The Commissioner’s guidance states that the intention to offer online
services directly to children and the large-scale processing of children’s
personal data are likely to result in a high risk to the rights and
freedoms of those children. 95 Therefore, a DPIA will generally be
required prior to such processing being carried out.
105. Standard 2 of the Children’s Code states that organisations within its
scope should “Undertake a DPIA to assess and mitigate risks to the
rights and freedoms of children who are likely to access your service,
which arise from your data processing. Take into account differing ages,
capacities and developmental needs and ensure that your DPIA builds
in compliance with this Code.” Standard 2 of the Code further notes
that, in practice, controllers offering online services likely to be
accessed by children are required to carry out a DPIA. This is supported
by the Commissioner’s guidance on rules about ISS and consent, which
explains that because “online processing of children’s personal data is
likely to be high risk processing, you must use a data protection impact
assessment” to “evidence and explain your approach to processing.” 96
106. Article 35(7) UK GDPR provides that:
“The assessment shall contain at least:
94
Article 29 Data Protection Working Party Guidelines on Data Protection Impact
Assessment (DPIA) and determining whether processing is “likely to result in a high risk”
for the purposes of Regulation 2016/79, pg. 10 (adopted 4 April 2017, revised and adopted
4 October 2017), as endorsed by the EDPB in Endorsement 1/2018 (25 May 2018)
95
ICO: DPIAs: When do we need to do a DPIA?: What does the ICO consider likely to
result in high risk?
96
ICO: Children and the UK GDPR: What are the rules about ISS and consent?
36
(a) a systematic description of the envisaged processing operations
and the purpose of the processing, including, where applicable, the
legitimate interest pursued by the controller;
(b) an assessment of the necessity and proportionality of the
processing operations in relation to the purposes;
(c) an assessment of the risks to the rights and freedoms of data
subjects referred to in [Article 35(1) UK GDPR]; and
(d) the measures envisaged to address the risks, including safeguards,
security measures and mechanisms to ensure the protection of
personal data and to demonstrate compliance with this Regulation,
taking into account the rights and legitimate interests of data
subjects and other persons concerned.”
107. Standard 2 of the Children’s Code provides further guidance on how to
carry out a DPIA in relation to online services which are directed at or
are likely to be accessed by children. The guidance is provided by
reference to seven steps:
a) identifying the need for a DPIA;
b) describing the processing;
c) considering consultation;
d) assessing necessity and proportionality;
e) identifying and assessing risks arising from the processing;
f) identifying measures to mitigate the risks; and
g) signing off, recording and integrating outcomes. 97
108. The Commissioner notes, in particular, the following points from that
guidance:
97
ICO: Children’s Code: Standard 2: Data Protection Impact Assessments
37
a) The fact that a service is not aimed specifically at children does not
mean that the obligation to carry out a DPIA does not apply. On
the contrary, a DPIA should be carried out where an online service
is “likely to be accessed by children.” 98
b) The description of the processing should include an explanation of,
among other things, whether the service is designed for children
and, “if not, whether children are nevertheless likely to access” the
service, as well as plans for establishing the age range of children
using the service.
(b) Findings on Article 35 UK GDPR
109. Throughout the Relevant Period, MediaLab offered access to the
Platform in the UK to children aged 13 and older and to children under
13 years old, albeit with a purported requirement for “parental
supervision”. 99 It follows, that during the Relevant Period, MediaLab
was offering ISS directly to children and the Platform was likely to have
been accessed by children, as indicated by the estimated number of
child users of the Platform set out at paragraph 62 above and in Annex
2.
110. Therefore, pursuant to Article 35(1) and (4) UK GDPR, read in
conjunction with the list of processing activities which the
Commissioner considers to be high-risk, 100 MediaLab was required to
carry out a DPIA in relation to its processing of children’s personal data.
MediaLab nonetheless did not complete a DPIA in relation to its
processing of children’s personal data during the Relevant Period.
98
The ICO’s guidance on services covered by the Children’s Code states that where the
nature, content or presentation of your services makes you think that children will want to
use it, then you should conform to the standards of the Code. In addition, where children
form a substantive and identifiable user group in respect of an existing service, the “likely
to be accessed by children” will apply.
99
Imgur Terms of Service (accessed 6 August 2025)
100
See paragraph 103 above.
38
111. MediaLab initially informed the Commissioner that it did “not believe a
DPIA is in fact necessary for Imgur to complete given the type of
information collected by the application. Imgur has not undertaken any
new projects that are likely to involve a “high risk” to a user’s personal
information. We are open to any guidance from the ICO if they believe
this to be incorrect.” 101 However, in May 2025, MediaLab informed the
Commissioner that it was in the process of carrying out a DPIA and
expected to complete the process in the third quarter of 2025, stating
that this was intended to “better inform any necessary adjustments to
the [Platform’s] data processing practices.” 102
112. On 18 August 2025, MediaLab informed the Commissioner that it did
not anticipate that a DPIA would be completed prior to the withdrawal
of the Platform from the UK market 103 and the Commissioner was not
provided with a copy of a DPIA in respect of the processing of personal
data of users of the Platform under the age of 18 prior to MediaLab
restricting access to the Platform from the UK on 30 September 2025.
113. On 29 October 2025, MediaLab provided the Commissioner with a copy
of a DPIA alongside its Written Representations. 104 However, as stated
in MediaLab’s Written Representations, this DPIA related to the
“geoblock decision, related risks, mitigation and residual risks” 105 and
not to the Relevant Processing. Therefore, the Commissioner does not
consider that the completion of this DPIA is relevant to his findings
regarding MediaLab’s failure to complete a DPIA in respect of and prior
to commencing, the Relevant Processing.
101
Letter from MediaLab to the ICO, 15 October 2024
102
Letter from MediaLab to the ICO, 3 May 2025
103
Email from MediaLab to the ICO, 18 August 2025
104
Email from Kennedys LLP to the ICO, 29 October 2025: Exhibit C to MediaLab’s Written
Representations
105
MediaLab’s Written Representations, 29 October 2025: Section 1: paragraph 2.2(b)
39
114. Therefore, the Commissioner has concluded that throughout the
Relevant Period, MediaLab failed to comply with its obligations under
Article 35 UK GDPR.
115. The Commissioner notes that in its Written Representations, MediaLab
accepted the Commissioner’s provisional findings of infringement of
Article 35(1) UK GDPR in the NOI, stating that: “MediaLab accepts that,
viewed objectively and by reference to the Commissioner’s published
criteria, the combination of (i) an ISS likely to be accessed by children,
(ii) large-scale online processing/monitoring of a UGC platform, and (iii)
children-specific risks, together met the threshold in Article 35(1) of the
UK GDPR. A DPIA therefore should have been completed before
processing any children’s personal data.” 106
116. The Commissioner also notes that in its Written Representations,
MediaLab stated that, to the extent that it decides to relaunch the
Platform in the UK, it will complete a child-focused DPIA in accordance
with Article 35 UK GDPR and, in the event that any residual high risks
are identified which cannot be mitigated, it will consult the
Commissioner in accordance with Article 36 UK GDPR. MediaLab further
stated that in such circumstances, it will not recommence the
processing of UK data subjects’ personal data in relation to the Platform
until the consultation process has concluded. 107
V. DECISION TO IMPOSE A PENALTY
117. For the reasons set out below, the Commissioner has decided to impose
a penalty of £247,590 on MediaLab in respect of the Infringements in
accordance with section 155(1)(a) DPA 2018.
(1) Legal framework: penalty notices
118. Section 155(1)(a) DPA 2018 provides that if the Commissioner is
satisfied that a person has failed, or is failing, as described in section
106
MediaLab’s Written Representations, 29 October 2025: Section 1: paragraph 2.1(b)
107
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 2.1
40
149(2) DPA 2018, the Commissioner may, by written notice, require
the person to pay to the Commissioner an amount in sterling specified
in the notice.
119. When deciding whether to issue a penalty notice to a person, and
when determining the appropriate amount of the penalty, in respect
of matters to which the UK GDPR applies, section 155(2)(a) DPA
2018 requires the Commissioner to have regard to the matters
listed in Article 83(1) and (2) UK GDPR, in so far as they are relevant
in the circumstances of the case.
120. Article 83(1) UK GDPR requires any penalty imposed by the
Commissioner to be effective, proportionate and dissuasive in each
individual case.
121. Article 83(2) UK GDPR requires the Commissioner to have due
regard to the following factors when determining whether to issue
a penalty notice and the appropriate amount of any such penalty in
each individual case:
a) the nature, gravity and duration of the infringement, taking
into account the nature, scope, context and purpose of the
processing concerned, as well as the number of data subjects
affected and the level of damage suffered by them;
b) the intentional or negligent character of the infringement;
c) any action taken by the controller or processor to mitigate the
damage suffered by data subjects;
d) the degree of responsibility of the controller or processor,
taking into account technical and organisational measures
implemented by them pursuant to Articles 25 and 32;
e) any relevant previous infringements by the controller or
processor;
f) the degree of cooperation with the Commissioner in order to
41
remedy the infringement and mitigate the possible adverse
effects of the infringement;
g) the categories of personal data affected by the infringement;
h) the manner in which the infringement became known to the
Commissioner, in particular whether and, if so, to what extent
the controller or processor notified the infringement;
i) where measures referred to in Article 58(2) have previously
been ordered against the controller or processor concerned
with regard to the same subject-matter, compliance with those
measures;
j) adherence to approved codes of conduct pursuant to Article 40
or approved certification mechanisms pursuant to Article 42;
and
k) any other aggravating or mitigating factor applicable to the
circumstances of the case, such as financial benefits gained, or
losses avoided, directly or indirectly, from the infringement.
122. Section 157 DPA 2018 and Article 83 UK GDPR impose a statutory
maximum on the penalty that may be applied to a given
infringement. There are two levels of maximum penalty, depending
on the statutory provision(s) that has/have been infringed. These
are referred to as the “standard maximum amount” and the “higher
maximum amount.” The cases in which the standard and higher
maximum amounts apply are summarised at Annex 2 to the ICO’s
Data Protection Fining Guidance, dated March 2024 (the “Fining
Guidance”). 108
123. Paragraphs 124 – 191 below set out the Commissioner’s
assessment of whether it is appropriate to issue a penalty in relation
to the Infringements set out in Section IV above. This assessment
108
Data Protection Fining Guidance, Annex 2 | ICO
42
involves consideration of the factors in Article 83(1) and (2) UK
GDPR. The order in which these considerations are set out below
follows the Fining Guidance: 109
a) the seriousness of the infringement (Article 83(2)(a), (b) and
(g) UK GDPR);
b) relevant aggravating or mitigating factors (Article 83(2)(c)-(f)
(h)-(k) UK GDPR); and
c) effectiveness, proportionality and dissuasiveness (Article 83(1)
UK GDPR).
(2) Seriousness of the Infringements
124. The Commissioner’s assessment of the seriousness of any
infringement includes consideration of:
a) its nature, gravity and duration;
b) whether it was intentional or negligent; and
c) the categories of personal data affected.
The nature, gravity and duration of the Infringements (Article
83(2)(a) UK GDPR)
125. In assessing the seriousness of the Infringements, the
Commissioner has given due regard to their nature, gravity and
duration.
(a) Nature of the Infringements
126. The assessment of the nature of any infringement involves
consideration of the relevant circumstances of the case and the
specific provision(s) of the UK GDPR that has/have been infringed.
Relevant circumstances include:
a) whether the infringement prevented the provision concerned
109
Data Protection Fining Guidance | ICO
43
from being applied effectively or prevented the objective it
sought to protect from being fulfilled; and
b) whether the infringement is subject to the standard maximum
penalty or the higher maximum penalty (in relation to which,
see paragraphs 195 and 196 below).
127. Taking those matters into account, the Commissioner notes that as
set out at paragraphs 74 – 78 above, section 120B(e) DPA 2018,
the UNCRC, the Children’s Code and Recital 38 UK GDPR state that
children require specific protection with regard to the processing of
their personal data. Compliance with the provisions MediaLab has
been found to have infringed is necessary to ensure that:
a) processing of children’s personal data is fair (Article 5(1)(a) UK
GDPR);
b) personal data relating to children is processed lawfully (i.e.
only where an appropriate lawful basis applies), including by
restricting reliance on the lawful basis of consent for children
under 13 years old in relation to the offer of ISS directly to
children (Article 6 and Article 8 UK GDPR); and
c) children’s rights are afforded due consideration prior to high-
risk processing (Article 35 UK GDPR).
128. The Commissioner finds that by failing to effectively comply with
these provisions, MediaLab failed to ensure that children were
afforded the protections provided by the UK GDPR. In particular,
the Commissioner finds that as a result of the Infringements, and
notwithstanding the content moderation measures implemented by
MediaLab, children who used the Platform during the Relevant
Period were, as a result of MediaLab processing their personal data,
exposed to content which was potentially harmful to them and
caused them to suffer, or placed them at risk of suffering, damage.
44
Examples of such content are set out in Annex 3. 110
129. The Commissioner considers that the infringement of Article 8 UK
GDPR is substantive and serious. The requirement for parental
consent is not merely a technical requirement, but is fundamental
to the protection of children under 13 years old online. This is
because a child’s online activities warrant parental oversight of the
nature and quantity of personal data they share and the content
they see on websites and apps, such as the Platform. Achieving this
oversight requires effective compliance with Article 8 UK GDPR.
130. The Infringements include findings of infringement of Article 5(1)(a)
and Article 6 UK GDPR, which require personal data to be processed
lawfully. An infringement of either of these provisions is subject to
the higher maximum statutory penalty, 111 which is indicative of a
higher degree of seriousness.
(b) Gravity of the Infringements
131. When assessing the gravity of the Infringements, the Commissioner
has considered the nature, scope and purposes of MediaLab’s
processing, as well as the number of data subjects affected and the
level of any damage they have suffered. 112
132. As to the nature of the processing, the Commissioner has regard to
the fact that the Infringements involve high-risk 113 processing of
children’s personal data. 114
133. As to the scope of the processing and the number of data subjects
affected:
a) The Lawful Basis Infringements relate to MediaLab’s unlawful
110
As explained in the Fining Guidance (at footnote 57), in this context, the Commissioner
uses the terms “damage” and “harm” interchangeably.
111
Article 83(5)(a) UK GDPR and section 157(1)(a) DPA 2018
112
Fining Guidance, paragraph 58
113
See paragraphs 102 - 104 above.
114
These are identified as relevant factors at paragraph 59 of the Fining Guidance.
45
processing of the personal data of children under 13 years old
during the Relevant Period, with the Commissioner estimating
that this affected between 46,265 and 95,971 children in this
age range in the years 2021 – 2023.115
b) The DPIA Infringement relates to MediaLab’s failure to conduct
a DPIA in respect of its processing of children’s personal data
in connection with the operation of the Platform, with the
Commissioner estimating that this potentially affected between
70,538 and 181,166 children in the years 2021 – 2023.
134. As to the purpose of the processing, the Commissioner has had
regard to the fact that processing of the personal data of children
under 13 years old may not be part of MediaLab’s main business or
commercial activities. Throughout the Relevant Period MediaLab
permitted children under 13 years old in the UK to use the Platform,
purportedly subject to the requirement for parental supervision,
albeit that the Terms of Service state that the Platform “is not
meant for use by children under age 13.” 116 MediaLab nonetheless
failed to comply with the UK GDPR in circumstances where the
Commissioner considers that the Platform would have been likely
to have been accessed by children and the Commissioner’s research
indicates that the Platform was, in fact, accessed by children
throughout the Relevant Period. 117
135. The need for special protections in relation to children’s personal
data is explained at paragraphs 74 – 78 above. The Infringements
involved a failure to comply with provisions of the UK GDPR which,
when properly implemented, would serve to provide those
protections for children’s personal data. Consequently, in assessing
115
The Commissioner has not been able to produce estimates of the number of users of
the Platform under 13 years old in 2024 and 2025 due to a lack of available statistics.
116
Terms of Service — Imgur: The magic of the Internet (accessed 6 August 2025)
117
See the Commissioner’s estimates of the number of children who used the Platform
during the period between 2021 and 2023 in Annex 2.
46
the level of damage suffered, the Commissioner has had regard to
the extent to which the Infringements affected children’s rights and
freedoms or otherwise led to them suffering, or being likely to
suffer, damage.
136. The ICO’s Children’s Code Strategy Progress Update – August
2024 118 states that:
“If platforms are unclear about or do not know the age of their
users, they risk processing children’s information inappropriately
and unlawfully as if they were an older child or an adult. This could
lead to a range of data protection harms, including:
• loss of control of personal information resulting from under 13-
year-olds creating accounts on services designed for older
children with limited awareness of the risks as to how their
information may be used or of their information rights;
• psychological harms from children accessing content they are
too young to view, as a result of the platform processing
inaccurate personal information; and
• financial harms from engaging with in-app purchases or
subscriptions without adequate parental oversight.
137. In April and July 2025, the ICO undertook a review of the content
available on the Platform, a summary of which can be seen at
Annex 3. The research includes content of a sexual nature and
content depicting serious violence or injury, which has factored into
the Commissioner’s consideration of seriousness in Section V(2)
of this Notice. An advisory content warning is hereby given in
respect of the contents of Annex 3.
138. MediaLab informed the Commissioner that users of the Platform are
118
Children’s Code Strategy progress update - August 2024 | ICO
47
encouraged to adhere to its Community Rules. 119 The Community
Rules are accessible via a link which is presented to users during
the account registration process and via a link on the footer on the
website version of the Platform. Amongst other things, the
Community Rules prohibit “lascivious or sexualized posts,” “hate
speech, divisive content, and abusive content,” “content depicting,
condoning, making light of, or advocating illegal activity or
violence,” and “vivid and realistic acts of violence and brutality.” 120
139. MediaLab also informed the Commissioner that during the Relevant
Period it used: “a mix of proactive media classification and proactive
human review for content uploaded to our public gallery to mitigate
the risk of mature content being uploaded and discoverable to
users.” As part of this, all content that was uploaded to the Platform
was reviewed to identify content which was “not safe for work”
(“NSFW”), with any content exceeding acceptable thresholds being
blocked from upload. Content deemed safe by MediaLab’s proactive
classification measures was subject to review by human
moderators, with this review taking place before the content
appeared publicly, or within 30 minutes of its submission. Content
which was deemed to violate MediaLab’s policies was moderated,
including marking the content as mature where appropriate. 121
140. MediaLab stated that “content deemed inappropriate (including
content containing misinformation) may be reported by users,
which will be reviewed by a moderator and removed from public
view if deemed necessary.” Users of the Platform were also
requested to mark content which is mature as such to ensure that
such content “will only be viewable to those who have opted-in to
viewing mature content. Content that is mature in nature, but was
119
Rules — Imgur: The magic of the Internet (accessed 6 August 2025)
120
Rules — Imgur: The magic of the Internet (accessed 6 August 2025)
121
Letter from MediaLab to the ICO, 21 February 2025
48
not tagged as such on upload, may be flagged, reviewed by Trust
& Safety moderators, and marked accordingly.” 122 According to the
Community Rules, “Mature content may include, but is not limited
to, suggestive, inflammatory, unsettling, or provocative jokes,
stories, tags, audio and visual content. This may include, but is not
limited to, content containing: mild violence, medical work, injuries
or blood; scantily-clad women or men; content that antagonizes or
directly agitates a group of people; content that makes an average
person squeamish or disgusted; non-explicit content discussing
sexual experiences or fetishes; content posted to sexualize or ogle;
[and] any content intended for a mature audience.” 123 In addition
the Community Rules state that “no sexually explicit or abusive
content, as defined by our community rules, is allowed on Imgur,
even if it’s marked as mature.” 124
141. MediaLab informed the Commissioner that, on average,
approximately posts on the Platform were marked as mature
each month following proactive or reactive (i.e. following user
reporting) moderation, accounting for approximately % of all
public posts on the Platform. 125
142. During the Relevant Period, MediaLab also reviewed uploads to the
Platform against child sexual abuse material (“CSAM”) specific hash
lists and classification tools, with any suspected CSAM blocked from
upload and automatically reported to the National Centre for Missing
and Exploited Children. 126 In addition, if the user seeking to post
the CSAM had an account on the Platform, their account was
suspended and listed for human review. According to MediaLab, the
122
Letter from MediaLab to the ICO, 10 January 2025
123
Rules — Imgur: The magic of the Internet (accessed 6 August 2025)
124
Rules — Imgur: The magic of the Internet (accessed 6 August 2025)
125
Letter from MediaLab to the ICO, 21 February 2025
126
The National Centre for Missing and Exploited Children is a US-based private, non-profit
corporation which works to help find missing children, reduce child sexual exploitation, and
prevent child victimisation - NCMEC: About Us.
49
monthly average number of posts removed from the Platform on
the basis that they were deemed to violate its policies was ,
accounting for approximately % of monthly posts. Content
removed from the Platform following moderation was no longer
accessible via the public feed and did not appear on a user’s profile.
However, it remained accessible via the direct URL. 127
143. As set out at paragraph 37 above, the Platform contains a “mature
content” toggle which allows Logged-in Users to “enable mature
content”. Logged-In Users do not have to verify their age to turn on
the mature content toggle. Users cannot turn on “mature content”
on the iOS version of the Platform due to Apple’s App Store
requirements.
144. However, the analysis carried out by the ICO found that potentially
harmful content was displayed on the Platform to both Logged-in
Users and Guest Users, and when the mature content setting was
toggled to both on and off.
145. In its Written Representations, MediaLab submitted that the
measures in place on the Platform to prevent users from being
exposed to potentially harmful content should be taken into account
by the Commissioner as actions taken to mitigate the damage
suffered by data subjects. In particular, MediaLab referred to the
mature content toggle, the reporting and enforcement tools in place
and moderation activities, as further described at paragraphs 138
– 143 above. 128
146. The Commissioner considered the content moderation measures in
place on the Platform during the Relevant Period when reaching his
provisional conclusions, as set out in the NOI and, after considering
MediaLab’s Written Representations, has concluded that it is not
127
Letter from MediaLab to the ICO, 21 February 2025
128
MediaLab’s Written Representations, 29 October 2025: Section 1: paragraph 1.2(c)
50
necessary to adjust his assessment of the gravity of the
Infringements.
147. As evidenced by the findings of the ICO’s research set out in Annex
3, the Commissioner considers that the content moderation
measures in place on the Platform throughout the Relevant Period
did not prevent children using the Platform from seeing, or being
likely to have seen, content that was potentially harmful to them,
and having suffered, or being likely to have suffered damage as a
result. The Commissioner also notes that such measures were not
implemented for the specific purpose of limiting the content
accessible to users of the Platform under 13 years old.
(c) Duration of the Infringements
148. As stated at paragraph 60 of the Fining Guidance, the longer the
duration of an infringement the more weight the Commissioner is
likely to attribute to this factor. This is because of the greater
potential for harm to have occurred.
149. As stated at paragraph 11 and 65 above, the Commissioner finds
that the Infringements commenced on 27 September 2021 (the
date upon which MediaLab acquired Imgur, Inc.) 129 and ended on
30 September 2025, when MediaLab implemented a geo-block to
prevent UK-based users from accessing the Platform. 130
The intentional or negligent character of the Infringements (Article
83(2)(b) UK GDPR)
150. Where there is evidence of intent on the part of a controller, the
Commissioner may regard the infringement as particularly serious.
An infringement is committed intentionally where the evidence
shows the controller knew its conduct was likely to constitute an
129
Celebrating Imgur's Next Chapter - Imgur (accessed 24 July 2025) and letter from
MediaLab to the ICO dated 23 July 2025
130
Imgur access in the United Kingdom – imgur (accessed 20 October 2025)
51
infringement of the UK GDPR or DPA 2018, but it either deliberately
continued with the conduct or was indifferent as to whether it
infringed the UK GDPR or DPA 2018.
151. An infringement is committed negligently where the controller or
processor breached the duty of care required by law. 131 When
assessing negligence, the Commissioner will take into account all
the relevant evidence about whether the controller or processor
breached the duty of care required by law. This requires taking into
account the individual circumstances of each case in order to
establish the controller or processor’s liability. 132
152. Negligent infringements may still be serious, and the Fining
Guidance is clear that the Commissioner may decide to issue a
penalty notice in cases where a controller or processor is found to
have acted negligently. 133
153. The Commissioner finds that the Infringements were committed
negligently. In reaching his finding regarding MediaLab’s
negligence, the Commissioner has considered the following
matters:
a) Pursuant to Article 24(1) and (2) UK GDPR, controllers are
responsible for implementing appropriate technical and
organisational measures to enable and allow them to
demonstrate that processing is performed in accordance with
the UK GDPR, including through the implementation of
appropriate data protection policies. It follows that MediaLab
was responsible for ensuring that Platform users’ personal data
was processed in a lawful manner (Article 5(1)(a) UK GDPR)
and for implementing appropriate technical and organisational
(age assurance) measures (Article 25(1) UK GDPR) to meet
131
Fining Guidance, paragraph 66
132
Fining Guidance, paragraph 67
133
Fining Guidance, paragraph 63
52
the requirements of the UK GDPR, specifically Article 8.
b) Throughout the Relevant Period, MediaLab permitted children
in the UK between the ages of 13 and 17 to use the Platform.
Whilst the Terms of Service state that the Platform “is not
meant for use by children under age 13,” MediaLab did not
place any practical restrictions on children under 13 years old
accessing the Platform, stating only that parents of children
under 13 years old should only allow their child to use the
Platform under their supervision. 134 However, MediaLab did not
have any measures in place to enforce this purported
requirement for parental supervision of children’s use of the
Platform. Therefore, MediaLab should have considered what
measures were required to prevent children under 13 years old
accessing the Platform without parental supervision and ensure
that MediaLab was not processing their personal data
unlawfully by failing to take reasonable steps to obtain and
verify that consent to such processing was provided or
authorised by the holders of parental responsibility of users of
the Platform under 13 years old.
c) The Commissioner first informed MediaLab of his concerns
regarding its compliance with Article 5(1), Article 6 and Article
8 UK GDPR, as well as Standards 1 and 3 of the Children’s
Code, due to the absence of assurance measures on the
Platform in August 2024. 135 The Commissioner also requested
a copy of MediaLab’s DPIA in relation to age assurance and
account creation on the Platform in the Information Notice
issued to MediaLab on 15 October 2024.
d) Despite that, MediaLab decided not to implement specific
measures to safeguard children’s rights and did not carry out
134
Terms of Service — Imgur: The magic of the Internet (accessed 6 August 2025)
135
Letter from the ICO to MediaLab, 21 August 2024
53
a DPIA to assess potential risks to the interests, rights and
freedoms of children using the Platform as a result of the
Relevant Processing and to identify mitigations. Whilst
MediaLab provided the Commissioner with a DPIA alongside its
Written Representations, 136 this related solely to “the decision
to withdraw from the UK market, the specific risks arising from
the geoblock (including transparency and data subject rights
frictions) and the mitigations adopted” 137 and not to the
Relevant Processing of personal data relating to children in the
UK who used the Platform throughout the Relevant Period.
154. In light of the above, the Commissioner finds that the Infringements
are of a negligent character.
Categories of personal data affected by the Infringements (Article
83(2)(g) UK GDPR)
155. The categories of personal data affected by the infringement are
relevant to the assessment of its seriousness. In particular, special
category data (Article 9 UK GDPR), personal data relating to
criminal convictions and offences (Article 10 UK GDPR) and personal
data falling within the definitions of “sensitive processing” in Part 3
and Part 4 DPA 2018 deserve special protection, and the
Commissioner is likely to consider infringements involving the
processing of such data as being particularly serious. 138 Other
categories of personal data in relation to which infringements are
likely to be more serious include location data, private
communications, passport or driving licence details, and financial
data. 139
156. The categories of personal data affected by the Infringements are
136
MediaLab’s Written Representations, 29 October 2025: Exhibit C1
137
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 1.3
138
Fining Guidance, paragraphs 70-71
139
Fining Guidance, paragraph 72
54
set out at paragraphs 42 and 44 above and vary according to
whether or not the Platform was accessed by a Logged-in User or a
Guest User. The Commissioner notes that the analysis carried out
by the ICO, as set out in Annex 2, indicates that the majority of
children in the UK who accessed the Platform during the Relevant
Period were Guest Users, meaning that, in respect of the majority
of child users, MediaLab would not have processed the additional
categories of personal date set out in paragraph 44.
157. The Commissioner has not seen any evidence to conclusively
indicate that MediaLab processed special category data relating to
users of the Platform and notes that in its Written Representations,
MediaLab averred that “it did not collect, create, infer, classify,
profile or use special-category data within the meaning of Article 9
of the UK GDPR. While user-generated content may, in principle,
contain material that could reveal such attributes, any such material
was posted at the user’s own initiative and hosted on a content-
agnostic basis, and was not processed for the purpose of revealing
or using those attributes.” 140
Conclusion on the seriousness of the Infringements
158. Having considered the nature, gravity and duration of the Lawful
Basis Infringements, as well as their negligent nature and the
categories of personal data affected, the Commissioner has
categorised the Lawful Basis Infringements as having a medium
degree of seriousness. In reaching this finding, the Commissioner
has taken into account the following factors:
a) the importance of providing a high level of protection to
children’s personal data, as set out in Recital 38 of the UK
GDPR and Standard 1 of the Children’s Code;
b) the absence of any age assurance measures on the Platform at
140
MediaLab’s Written Representations, 29 October 2025: Section 1: paragraph 1.2(h)
55
the point of account creation or in order to access the Platform;
c) the number of UK children under 13 years old who accessed
the Platform during the Relevant Period, estimated to be
95,971 in 2023;
d) the fact that MediaLab was negligent in failing to implement
appropriate age assurance measures, despite MediaLab
allowing children under 13 years old to access the Platform with
parental supervision;
e) the risk of children under 13 years old being exposed to content
that was potentially harmful to them (for example, content of
a sexual nature) and for this content to have caused them to
suffer damage, as a consequence of the Relevant Processing;
f) MediaLab’s failure to implement appropriate age assurance
measures to prevent children under 13 years old accessing the
Platform without obtaining and verifying consent to the
processing of their personal data by the holders of parental
responsibility for such users; and
g) the processing of the personal data of children under 13 years
old without a lawful basis, infringes one of the fundamental
data protection principles (Article 5(1)(a) UK GDPR). The
Commissioner’s Guide to the data protection principles141
states that “The principles lie at the heart of the UK GDPR…
compliance with the spirit of these principles is therefore a
fundamental building block for good data protection
practice.” 142 Furthermore, the Commissioner’s guidance on
Children and the UK GDPR states that “fairness and compliance
with the data protection principles should lie at the heart of all
your processing of children’s personal data. The purpose of
141
A guide to the data protection principles | ICO
142
A guide to the data protection principles | ICO
56
these principles is to protect the interests of the individuals and
this is particularly important where children are concerned.”143
159. In addition, the Commissioner has categorised the DPIA
Infringement as having a medium degree of seriousness. In
reaching this finding, the Commissioner has taken into account the
following factors:
a) a DPIA is a highly important assessment designed to assist
controllers to systematically analyse, identify and minimise
data protection risks. As such, DPIAs are an essential part of a
controller’s accountability obligations. DPIAs must be carried
out prior to the commencement of processing where a type of
processing is likely to result in a high risk to the rights and
freedoms of individuals. However, MediaLab engaged in high-
risk processing throughout the Relevant Period without
undertaking a DPIA in relation to the Relevant Processing;
b) the failure to carry out a DPIA is rendered more serious by the
number of children under 13 years old who accessed the
Platform throughout the Relevant Period (estimated to be
95,971 in 2023), as well as the fact that children between the
ages of 13 and 17 are likely to have accessed the Platform and
seen content that was potentially harmful to children as a
consequence of MediaLab processing their personal data; and
c) the Terms of Service permit children to access the Platform
(subject to a stated requirement for parental supervision for
children under 13 years old). Therefore, MediaLab knew, or
ought to have known, that it was engaging in high-risk
processing activities, as it intended to offer online services
directly to children, and was consequently required to carry out
a DPIA before the processing commenced, pursuant to Article
143
What should our general approach to processing children’s personal data be? | ICO
57
35(1) UK GDPR.
(3) Relevant aggravating or mitigating factors
Action taken to mitigate the damage suffered by the data subjects
(Article 83(2)(c) UK GDPR)
160. When deciding whether to impose a penalty notice, the
Commissioner will have regard to any action taken by the controller
or processor to mitigate the damage suffered by data subjects
following the infringement. The Commissioner is more likely to take
into account measures implemented prior to the controller or
processor becoming aware of the Commissioner’s investigation as
a mitigating factor. Measures that are only implemented after the
start of the Commissioner’s investigation are less likely to be
regarded as a mitigating factor. 144
161. The Commissioner finds that MediaLab did not implement
appropriate measures to mitigate the damage suffered by data
subjects as a result of the Infringements prior to the
commencement of the Investigation.
162. On 3 May 2025, MediaLab informed the Commissioner that it was
“assessing the implementation of age assurance measures based
on known or potential risks associated with the [Platform], costs of
implementation and its potential economic impact and user
experience. Additionally, due to the disparity in users who engage
with the [Platform] logged-out vs. those who engage with the
[Platform] logged-in, further investigation must be conducted to
determine the feasibility of an age assurance measure that is
proportionate to the processing activities. This assessment and
associated internal discussions, are ongoing.” 145
163. On the same date, MediaLab also informed the Commissioner that
144
Fining Guidance, paragraph 77
145
Letter from MediaLab to the ICO, 3 May 2025
58
it was in the process of carrying out a DPIA, with a proposed
completion date in the third quarter of 2025. MediaLab stated that
whilst it previously “did not believe that our data processing reached
the level of “high risk” processing… we are planning to complete a
DPIA in order to better inform any necessary adjustments to the
[Platform’s] data processing practices.” 146
164. However, on 18 August 2025, MediaLab informed the Commissioner
that it was “no longer investigating age assurance in relation to the
UK market due to the associated costs and the timing of our exit”
and that “given the expedited timeline for the withdrawing [the
Platform] from the UK market, we do not anticipate the DPIA being
completed prior to our exit.” 147
165. In its Written Representations, MediaLab set out details of the
measures it submitted should be considered to mitigate the
Infringements, including:
a) implementing a UK geo-block to prevent UK-located users from
accessing the Platform, which MediaLab claims materially
reduced the ongoing risk to UK users and limits any continuing
UK processing to narrow, lawful purposes; 148
b) notwithstanding the implementation of the UK geo-block,
publishing and maintaining access to a UK-specific privacy
notice and maintaining a non-login route for UK data subjects
to exercise their personal data rights; 149 and
c) the deletion of personal data relating to UK users in accordance
with MediaLab’s retention policy, or, where continued retention
is necessary, holding such personal data on a beyond use basis
for strictly limited purposes, such as compliance with legal
146
Letter from MediaLab to the ICO, 3 May 2025
147
Email from MediaLab to the ICO, 18 August 2025
148
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 1.1
149
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 1.2
59
obligations, or the establishment, exercise or defence of legal
claims. 150
166. However, the Commissioner does not consider that these measures
effectively mitigated the damage which children in the UK who used
the Platform during the Relevant Period suffered, or were at risk of
suffering, as a result of the Infringements committed by MediaLab.
167. The implementation of the UK geo-block means that the Relevant
Processing is no longer ongoing, but does not have any impact on
the damage which this caused, or may have caused, to children
using the Platform prior to the geo-block’s implementation. The
Commissioner also considers that MediaLab’s publication of a UK-
specific privacy policy which remains accessible despite the wider
UK geo-block, the creation of mechanisms by which UK data
subjects may exercise their personal data rights, and the deletion
of UK data subjects’ personal data, unless otherwise necessary,
does not mitigate the damage, or potential damage, caused as a
result of the Infringements. Such measures are no more than is
necessary in order for MediaLab to comply with its obligations under
the UK GDPR 151 in its continuing capacity as a controller of the
personal data it collected from UK data subjects who used the
Platform during the Relevant Period. Therefore, the Commissioner
finds that the measures set out at paragraph 165 above do not
constitute actions taken by MediaLab to mitigate the damage
suffered by children in the UK who used the Platform during the
Relevant Period.
168. In its Written Representations, MediaLab also set out details of the
remedial measures that it proposes to implement should a decision
be taken to restore access to the Platform in the UK, with a
150
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 1.3
151
including but not limited to the obligations imposed on controllers under Article 5(1) and
(e), Article 12, Article 13, Article 15, and Article 17 UK GDPR.
60
commitment that this process would be completed prior to any
resumption of the processing of personal data of users in the UK.
169. The remedial measures outlined in MediaLab’s Written
Representations included:
a) completing a child-focused, Children’s Code-informed DPIA
which would include an assessment of the risks to children
under 13 years old, those aged 13-15 and those aged 16-17,
with a commitment to engage with the Commissioner in
accordance with Article 36 UK GDPR in the event any identified
high risks could not be mitigated; 152
b) relaunching either an 18+ version of the Platform accompanied
by third-party age assurance checks, or a mixed-age UK
version of the Platform with measures in place to obtain
verifiable parental consent for users under 13 years old; 153
c) a UK-specific privacy policy, with teen-layered notices, just-in-
time prompts, an easy reset of privacy choices and concise,
intelligible, child-appropriate transparency information; 154
d) updated records of processing activities, data processing
agreements, ongoing monitoring to verify that its remediation
measures and controls operate effectively and the
maintenance of a change log to evidence compliance; 155 and
e) the appointment of a senior executive as the accountable
individual responsible for children’s risk compliance. 156
170. MediaLab submitted that its commitment to implement the
measures set out above should be treated as a mitigating factor.
However, whilst the Commissioner welcomes the fact that MediaLab
152
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 2.1
153
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 2.2
154
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 2.5
155
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 2.6
156
MediaLab’s Written Representations, 29 October 2025: Section 2: paragraph 2.6
61
plans to take these measures should it decide to restore access to
the Platform in the UK, he notes that these measures were not
implemented during the Relevant Period and considers that they are
intended to prevent the re-occurrence of the Infringements in the
event that access to the Platform is restored for UK users and
therefore would not have the effect of retrospectively mitigating the
damage suffered by children in the UK who used the Platform during
the Relevant Period.
The degree of responsibility of the controller or processor (Article
83(2)(d) UK GDPR)
171. When deciding whether to impose a penalty notice, the
Commissioner will also have regard to the degree of responsibility
of the controller or processor, taking into account technical and
organisational measures implemented by them pursuant to, among
other things, Article 25 UK GDPR. 157 Controllers and processors are
required and expected to take responsibility for complying with their
obligations under the UK GDPR. 158 In assessing this factor, the
Commissioner will consider how far the controller or processor did
what it could be expected to do in terms of implementing technical
and organisational measures, taking into account:
a) its size and resources; and
b) the nature and purpose of the processing. 159
172. The Commissioner has concluded that, throughout the Relevant
Period, MediaLab was wholly responsible for implementing and,
when taking into account its size and resources (as to which see
paragraphs 201 and 202 below), could reasonably have been
expected to have implemented, sufficient measures to ensure that
157
Fining Guidance, paragraph 78
158
Fining Guidance, paragraph 79
159
Fining Guidance, paragraph 79
62
it processed the personal data of children who used the Platform in
a lawful manner.
173. The Commissioner has had regard to these matters and considers
that they do not change his overall decision on whether it is
appropriate to impose a penalty notice and in what amount.
Any relevant previous infringements by the controller or processor
(Article 83(2)(e) UK GDPR)
174. The Commissioner is not aware of any relevant previous
infringement of the UK GDPR or DPA 2018 having been committed
by MediaLab. Therefore, this factor is not relevant to the
Commissioner’s decision.
Degree of cooperation with the Commissioner (Article 83(2)(f) UK
GDPR)
175. Pursuant to Article 31 UK GDPR, controllers and processors are
required to cooperate with the Commissioner in the performance of
his tasks. The Commissioner’s tasks include the monitoring and
enforcement of the UK GDPR 160 and the conduct of investigations
into the application of the UK GDPR. 161 Paragraph 87 of the Fining
Guidance explains that such cooperation may include, for example,
responding to requests for information and attending meetings.
176. The Commissioner considers that a controller or processor’s
compliance with its ordinary duty of cooperation under Article 31
UK GDPR should not be treated as a mitigating factor. 162 However,
the Commissioner may nonetheless consider it appropriate to have
regard to cooperation by a controller or processor as a mitigating
factor where that controller or processor has exceeded its ordinary
duty of cooperation by responding to requests during an
160
Article 57(1)(a) UK GDPR and section 115(2)(a) DPA 2018
161
Article 57(1)(h) UK GDPR and section 115(2)(a) DPA 2018
162
Fining Guidance, paragraph 87
63
investigation in a way that:
a) enables the enforcement process to be concluded significantly
more quickly or effectively; or
b) significantly limits the harmful consequences for people’s rights
and freedoms that might otherwise have occurred. 163
177. MediaLab responded to informal requests for information during the
Investigation and attended a virtual meeting with representatives
of the Commissioner (at MediaLab’s request) on 16 April 2025. In
doing so, the Commissioner’s view is that MediaLab has cooperated
with the Investigation.
178. Whilst in its Written Representations, MediaLab averred that its
cooperation with the Investigation should be treated as a mitigating
factor, 164 the Commissioner considers that MediaLab’s level of
cooperation did not go beyond that which is reasonably expected of
any controller or processor in such circumstances. Therefore, the
Commissioner finds that this should be treated as a neutral, rather
than a mitigating, factor.
The manner in which the Infringements became known to the
Commissioner (Article 82(2)(h) UK GDPR)
179. When deciding whether a penalty is appropriate, the Commissioner
will have regard to the manner in which the infringement became
known to him, in particular, whether the controller or processor
notified the Commissioner of the infringement. 165 The
Commissioner may view a controller or processor bringing an
infringement to the Commissioner’s attention of its own volition as
a mitigating factor in circumstances where the Commissioner was
163
Fining Guidance, paragraph 88
164
MediaLab’s Written Representations, 29 October 2025: Section 1: paragraph 1.2(j) and
Section 2: paragraph 1.5
165
Fining Guidance, paragraph 90
64
not already aware of the infringement. 166 Unless the infringement
was self-reported, the way in which the Commissioner finds out
about it, for example, following a complaint, media coverage, or
through the Commissioner’s own intelligence, will generally be
considered to be a neutral factor. 167
180. The Infringements became known to the Commissioner due to an
investigation into MediaLab (and other organisations) as part of the
Commissioner’s work to assess compliance with the Children’s
Code. Therefore, the Commissioner finds that the manner in which
the Infringements became known to the Commissioner should be
treated as a neutral factor.
Measures previously ordered against the controller or processor
(Article 83(2)(i) UK GDPR)
181. The Commissioner has not previously imposed measures referred
to in Article 58(2) UK GDPR on MediaLab. Therefore, this factor is
not relevant to the Commissioner’s findings.
Adherence to approved codes of conduct or certification
mechanisms (Article 83(2)(j) UK GDPR)
182. There are no relevant codes of conduct or approved certification
mechanisms in this case. Therefore, this factor is not relevant to
the Commissioner’s findings.
Any other applicable aggravating or mitigating factors (Article
83(2)(k) UK GDPR)
183. Pursuant to Article 83(2)(k) UK GDPR, when considering whether to
impose a penalty and when determining the level of any penalty,
the Commissioner is required to consider any other aggravating or
mitigating factors applicable in the circumstances of the case, such
166
Fining Guidance, paragraph 91
167
Fining Guidance, paragraph 93
65
as financial benefits gained or losses avoided, directly or indirectly,
from the infringement.
184. The Commissioner has considered whether MediaLab benefitted
financially from its failure to implement appropriate technical and
organisational measures to ensure that it did not process the
personal data of users of the Platform under 13 years old unlawfully.
It is likely that MediaLab has seen some financial gain as a result of
increased traffic on the Platform generated by users under 13 years
old. However, the Commissioner does not consider that any such
benefits, if present, are likely to have been sufficiently significant to
treat this as a relevant aggravating factor in this case.
185. The Commissioner does not consider that there are any other
relevant aggravating or mitigating factors.
(4) Effectiveness, proportionality and dissuasiveness
186. When considering whether to issue a penalty notice and, if so, for
what amount, the Commissioner will consider whether it would be:
a) effective, in the sense of achieving the objective of ensuring
compliance with data protection legislation or providing an
appropriate sanction for the infringement, or both;
b) proportionate, in the sense that the penalty should not exceed
what is appropriate and necessary in the circumstances to
meet those objectives; and
c) dissuasive, meaning that imposing a fine should be a genuine
deterrent to future non-compliance. 168
187. In making the decision, the Commissioner will first consider whether
issuing a penalty notice is effective and dissuasive, before then
considering whether it is proportionate to do so. 169
168
Fining Guidance, paragraph 103
169
Fining Guidance, paragraph 104
66
188. The Commissioner finds that the imposition of a penalty would, in
the circumstances of this case, be an effective means of ensuring
compliance with the UK GDPR, sanctioning the Infringements and
would also be dissuasive against future non-compliance. The
Commissioner has considered both the need to deter MediaLab from
infringing the same, or other provisions, of the UK GDPR in the
event that it restores access to the Platform in the UK, and the need
to deter other organisations which operate ISS which are likely to
be accessed by children, as well as controllers and processors in
general, from committing similar infringements of the UK GDPR.
189. The Commissioner also finds that a penalty would be a
proportionate regulatory response and would not exceed what may
be considered appropriate and necessary in all the circumstances of
the case, including in particular:
a) the seriousness of the Infringements;
b) the number of data subjects affected;
c) the degree of negligence demonstrated by MediaLab;
d) the nature of the processing performed by MediaLab,
specifically the processing of children’s personal data; and
e) the potential consequences of the unlawful processing of the
personal data of users of the Platform under 13 years old.
190. In reaching his conclusion, the Commissioner has also had regard to
the desirability of promoting economic growth, as required under
section 108 of the Deregulation Act 2015 and the desirability of
promoting innovation and competition, as required by section
120B(a) and (b) DPA 2018 respectively. However, the Commissioner
is mindful that the desirability of promoting economic growth,
innovation and competition does not legitimise non-compliance with
data protection law. Furthermore, non-compliant activity or
67
behaviour harms the interests of legitimate businesses that are
working to comply with data protection law, which disrupts
competition and acts as a disincentive to invest in compliance. 170
(5) The Commissioner’s conclusion on whether to impose a
penalty
191. For the reasons set out above, the Commissioner has decided to
impose a penalty on MediaLab in respect of the Infringements.
VI. CALCULATION OF THE PENALTY
192. The process the Commissioner follows in deciding the appropriate
amount of any penalty which may be imposed in an individual case is
described in the Fining Guidance, which sets out a five-step penalty
setting mechanism: 171
a) Step 1: An assessment of the seriousness of the infringement to
determine an appropriate starting point for the penalty.
b) Step 2: Accounting for the turnover of the undertaking when
assessing the starting point for the penalty based on the outcomes
of Steps 1 and 2.
c) Step 3: Calculating the starting point for the penalty based on the
outcomes of Steps 1 and 2.
d) Step 4: Adjusting the starting point for the penalty based on any
relevant aggravating or mitigating factors.
e) Step 5: Adjusting the penalty to ensure that it is effective,
proportionate and dissuasive, whilst not exceeding the relevant
statutory maximum.
193. In carrying out the assessment, the Commissioner is mindful that the
aim of Steps 1 to 4 is to identify a penalty amount that is effective,
proportionate and dissuasive, and the purpose of Step 5 is to provide
170
Fining Guidance, paragraph 105
171
Fining Guidance, paragraph 106
68
the opportunity to ensure that the overall result achieves this aim. The
assessment of the appropriate level of the penalty is not a mechanistic
exercise. It involves evaluation and judgement, taking into account all
the relevant circumstances of the case. 172
(1) Statutory Maximum Penalty
194. The Commissioner finds that MediaLab infringed Article 5(1)(a), Article
6, Article 8 and Article 35(1) UK GDPR.
195. An infringement of Article 5(1)(a) or Article 6 UK GDPR is subject to a
maximum statutory penalty of £17.5 million or, in the case of an
undertaking, 4% of the worldwide turnover in the preceding financial
year (whichever is higher). 173
196. An infringement of Article 8 or Article 35(1) UK GDPR is subject to the
standard statutory maximum penalty of £8.7 million, or, in the case of
an undertaking, 2% of the worldwide turnover in the preceding financial
year (whichever is higher). 174
197. Pursuant to Article 83(3) UK GDPR, if a controller or processor infringes
several provisions of the UK GDPR in the course of the same or linked
processing operations, the total amount of any penalty imposed cannot
exceed the maximum statutory penalty specified for the gravest
infringement. 175
198. The Commissioner has determined that MediaLab infringed Article
5(1)(a), Article 6, and Article 8 UK GDPR (the Lawful Basis
Infringements) and Article 35 UK GDPR (the DPIA Infringement).
Despite the findings of infringement of several Articles of the UK GDPR,
the Commissioner considers that the Infringements arise from the same
or linked processing operations. 176 Therefore, pursuant to Article 83(3)
172
Fining Guidance, paragraph 107
173
Article 83(5)(a) UK GDPR and section 157(1)(a) DPA 2018
174
Article 83(4)(a) UK GDPR and section 157(1)(a) DPA 2018
175
Fining Guidance, paragraph 33
176
Fining Guidance, paragraph 40
69
UK GDPR, the overall fine that can be imposed by the Commissioner
cannot exceed the maximum statutory amount that applies to the
gravest of the individual infringements identified (as set out in Articles
83(4) and 83(5) UK GDPR). In this case, the higher maximum amount
applies to infringements of Article 5(1)(a) and Article 6 UK GDPR,
meaning that the maximum statutory amount of the fine that may be
imposed on MediaLab is £17.5 million or 4% of worldwide turnover
(whichever is higher). 177
199. As explained in the Fining Guidance, in such cases, the Commissioner
may decide to impose a fine for each infringement arising from the
same or linked processing operations, provided that the sum of those
penalties does not exceed the applicable statutory maximum. 178 In the
present case, the Commissioner has made a decision to impose
separate fines for (i) the Lawful Basis Infringements and (ii) the DPIA
Infringement. This is because certain aspects of the DPIA Infringement
and the Lawful Basis Infringements are different, such as the ages of
children whose personal data was impacted by each of the
Infringements. The sum of the two fines cannot exceed the higher
maximum amount.
200. As stated above, in the case of an undertaking, the higher statutory
maximum penalty is either £17.5 million, or 4% of the undertaking’s
total worldwide annual turnover in the preceding financial year,
whichever is greater. The Fining Guidance explains the concept of an
undertaking for the purpose of imposing a penalty at paragraphs 23-
31. In particular, paragraphs 28 – 30 of the Fining Guidance state:
“In this context, an undertaking does not correspond to the commonly
understood notion of a legal entity or company under, for example,
English commercial or tax law. Instead, an undertaking may comprise
177
Fining Guidance, paragraph 41
178
Fining Guidance, paragraph 42.
70
one or more legal or natural persons forming a ‘single economic unit,’
rather than a single entity characterised as having legal personality.
Whether or not an individual controller or processor forms part of a
wider undertaking depends on whether it can act autonomously or
whether another legal or natural person, for example, a parent
company, exercises decisive influence over it.
Where a parent company owns all, or nearly all, the voting shares in a
subsidiary, there is a presumption that the parent company exercises
decisive influence over the subsidiary’s conduct. This presumption may
be rebutted. However, the burden is on the parent company to provide
sufficient evidence to demonstrate that the subsidiary acts
independently.” 179
201. The relevant controller responsible for the Infringements in respect of
UK data subjects is MediaLab (as defined in paragraph in 1).
.180
100% share ownership of MediaLab
invokes the rebuttable presumption that it exercises decisive influence
and control over the operations of MediaLab and should therefore be
treated as the relevant undertaking in the case, with its global annual
turnover for the preceding financial year used for the purposes of
calculating the starting point for the penalty. 181 However, as
179
The approach set out in the Fining Guidance is consistent with the decision of the CJEU
in Case C-383/23, ILVA A/S (ECLI:EU:C:2025:84) (13 February 2025), in which the Court
held that when assessing the amount of the administrative fine to be issued to a subsidiary
within the Lars Larsen Group, the group in its entirety was the relevant undertaking and
the maximum statutory fine had to be calculated on the basis of the group’s total
worldwide annual turnover in the preceding financial year. Whilst decisions of the CJEU are
no longer binding as a matter of UK law following the UK’s departure from the European
Union, pursuant to section 6(2) of the European Union (Withdrawal) Act 2018, UK courts
and tribunals may have regard to decisions of the CJEU issued after 31 December 2020
insofar as they are relevant to any matter before them.
180
Letter from MediaLab to the ICO, 23 July 2025
181
Fining Guidance, paragraph 30
71
, 182 no
financial statements relating to are
available as of the date of this Notice. Furthermore, the Commissioner
understands that revenue is
generated exclusively through the operations of MediaLab and its
subsidiaries. Therefore, the Commissioner has calculated the maximum
penalty based on the global annual turnover of MediaLab.
202. MediaLab is a private company and does not publish consolidated
financial statements or an annual report. On 5 May 2025, MediaLab
provided the Commissioner with a summary of the company’s turnover
and balance sheet for the year ending 31 December 2024. On 29
October 2025, MediaLab provided the Commissioner with updated
financial information alongside its Written Representations. The
updated financial information indicates that
203. Paragraph 123 of the Fining Guidance states that “[t]he Commissioner
may adjust the turnover figure used to ensure that it accurately reflects
the true scale of the undertaking (for example, by using more recent
management accounts or forecast figures where available.)” The
Commissioner considers that it is appropriate to exercise this discretion
in this case and has used the updated financial information provided
alongside MediaLab’s Written Representations to calculate the starting
182
Letter from MediaLab to the ICO, 23 July 2025
183
MediaLab’s Written Representations, 29 October 2025: Section 3: paragraph 2.2
72
point for the penalty on the basis of MediaLab’s projected annual
turnover for the year ending 31 December 2025 of $ 184
(approximately £ ). 185
204. 4% of £ , MediaLab’s projected total worldwide turnover for
the year ending 31 December 2025, is £ . As this is lower than
the higher statutory maximum penalty set out in Article 83(5)(a) UK
GDPR, the relevant statutory maximum for the Lawful Basis
Infringements is £17.5 million.
205. 2% of £ is £ . As this is lower than the standard
statutory maximum penalty set out in Article 83(4)(a) UK GDPR, the
relevant statutory maximum for the DPIA Infringement is £8.7 million.
206. The Commissioner notes that when calculating the total penalty for the
Infringements, the total figure cannot exceed the higher maximum
statutory penalty of £17.5 million. 186
(2) Step 1: Assessment of the seriousness of the Infringements
207. As set out in paragraphs 109 to 115 of the Fining Guidance, the
Commissioner determines a starting point for a penalty by first
assessing the seriousness of the infringement. The Commissioner’s
assessment of the seriousness of the Infringements is set out at
Section V(2) above.
208. As stated at paragraph 158 above, the Commissioner has concluded
that the Lawful Basis Infringements have a medium degree of
seriousness. For infringements that are categorised as being of a
medium degree of seriousness, the Commissioner uses 10% to 20% of
184
This has been calculated by dividing MediaLab’s reported revenue for the nine months
to 30 September 2025 by nine and multiplying by 12.
185
This has been calculated using the average of the GBP/USD exchange rates on the first
and last trading days of the 2025 period covered by MediaLab’s updated financial
information (2 January 2025 and 30 September 2025) to convert MediaLab’s USD-
denominated turnover into a GBP figure. The exchange rates used are available at GBP
Exchange Rates: Bank of England: Database
186
Article 83(3) UK GDPR and Article 83(5)(a) UK GDPR
73
the relevant legal maximum as the starting point. 187 As set out at
paragraph 195 above, the relevant legal maximum is £17.5 million. The
Commissioner has, after taking into account all the circumstances and
the reasons given in Section V(2) relating to seriousness, concluded
that the Lawful Basis Infringements warrant a starting point of 15%.
209. As stated at paragraph 159 above, the Commissioner has concluded
that the DPIA Infringement is of a medium degree of seriousness. For
infringements that have a medium degree of seriousness, the
Commissioner uses 10% to 20% of the relevant legal maximum as the
staring point. As set out at paragraph 196 above, the relevant legal
maximum is £8.7 million. The Commissioner has, after taking into
account all of the circumstances and the reasons given above in
Section V(2), concluded that the DPIA Infringement warrants a
starting point of 15%.
(3) Step 2: Accounting for turnover
210. Having assessed the seriousness of the Infringements, the
Commissioner has then considered whether any adjustments are
required to account for turnover, as set out in paragraphs 116 to 129
of the Fining Guidance. This step permits the Commissioner to adjust
the starting point to reflect the size of the undertaking. This approach
aids the Commissioner in ensuring that the penalty figure is effective,
proportionate and dissuasive. 188
211. As set out in paragraph 128 of the Fining Guidance, “the Commissioner
is likely to choose a higher amount for undertakings with higher
turnover within the applicable range. However, these ranges are only
indicative. The Commissioner will reach a decision on a case-by-case
basis as to whether it is appropriate to adjust the starting point of the
fine in this way, having regard to the need for the fine to be effective,
187
Fining Guidance, paragraph 110
188
As required by Article 83(1) UK GDPR.
74
proportionate and dissuasive. Therefore, the Commissioner retains the
discretion to impose a fine up to the applicable statutory maximum.”
212. In this case, because MediaLab’s projected annual turnover for the year
ending 31 December 2025 was between £ million and £ million, a
starting point of between % and % of the statutory maximum is
appropriate. 189 MediaLab’s projected turnover in the year ending 31
December 2025
213. Therefore, after also taking into account the factors that led to the
assessment of medium seriousness, the Commissioner has concluded
that:
a) in respect of the Lawful Basis Infringements, a starting point of 7%
of the applicable maximum statutory penalty is appropriate; and
b) in respect of the DPIA Infringement, a starting point of 7% of the
applicable statutory maximum penalty is appropriate.
214. The Commissioner has concluded that there are no extraneous factors
which require a higher starting point to be applied in respect of either
the Lawful Basis Infringements or the DPIA Infringement when taking
into account the turnover adjustment at Step 2 in order to ensure that
the penalty is effective, proportionate and dissuasive.
(4) Step 3: Calculation of the starting point
215. The starting point for the penalty in this case has been calculated as
follows:
Lawful Basis Infringements
Statutory maximum amount (£17.5 million) x Adjustment for
seriousness (15%) x Turnover adjustment (7%) = £183,750
Fining Guidance: Table B: Ranges for adjustment based on the turnover of the
189
undertaking
75
DPIA Infringement
Statutory maximum amount (£8.7 million) x Adjustment for
seriousness (15%) x Turnover adjustment (7%) = £91,350
Total Starting Point
Therefore, the total starting point for the Infringements is £275,100.
(5) Step 4: Adjustment to take into account any aggravating of
mitigating factors
216. The Commissioner has considered whether there are any aggravating
or mitigating factors which may warrant an increase or decrease in the
penalty calculated at the end of Step 3.
217. The examination of whether there are any aggravating or mitigating
factors present in this case is set out at paragraphs 160 – 185 above.
In summary:
a) MediaLab failed to implement measures to mitigate the damage
suffered, or which may be suffered, by children using the Platform
prior to the issuance of this Notice. Therefore, the Commissioner
has concluded that the matters set out at i) – iv) below should not
be treated as aggravating or mitigating factors:
i) Throughout the Relevant Period MediaLab maintained: the
Community Rules, which purported to set out the content and
activity which was acceptable on the Platform; proactive and
reactive moderation systems for content uploaded to the
Platform which blocked content deemed to violate MediaLab’s
policies from appearing on public feeds on the Platform; and a
mature content toggle which enabled some users (depending
on the operating system of their device where the Platform was
accessed via an app) to choose whether or not to view content
marked as mature. However, the Commissioner considers that
these measures were not effective in preventing children using
76
the Platform from being exposed to content which was
potentially harmful and as a result of which they were likely to
have suffered, or have been at risk of suffering, damage (see
paragraphs 138 – 147).
ii) During the course of the investigation, MediaLab informed the
Commissioner that it was in the processing of carrying out a
DPIA, 190 but later stated that it did not anticipate that the DPIA
would be completed prior to the withdrawal of the Platform
from the UK. 191 Furthermore, the DPIA provided to the
Commissioner alongside its Written Representations related to
the withdrawal of the Platform from the UK and not the
Relevant Processing (see paragraphs 111 – 113).
iii) MediaLab’s implementation of the UK geo-block merely brought
the Relevant Processing to an end and did not mitigate the
damage it caused, or may potentially have caused, to children
who used the Platform during the Relevant Period. Meanwhile,
MediaLab’s maintenance of a privacy notice that remains
accessible in the UK despite the implementation of the geo-
block, the availability of mechanisms to allow UK data subjects
to exercise their personal data rights and the deletion of UK
users’ personal data in accordance with MediaLab’s retention
schedules (with the exception of where retention is necessary
and lawful) are merely steps which are necessary in order for
MediaLab to comply with its ongoing obligations under the UK
GDPR (see paragraphs 165 – 167).
iv) MediaLab’s commitment in its Written Representations to
implementing measures intended to address the Infringements
prior to and in the event of a decision to restore access to the
Platform in the UK, did not mitigate the seriousness nor the
190
Letter from MediaLab to the ICO, 3 May 2025
191
Email from MediaLab to the ICO, 18 August 2025
77
actual or potential harmful consequences of the Infringements
which occurred prior to 30 September 2025 (see paragraphs
168 – 170).
b) MediaLab is wholly responsible for the Infringements. However,
although the Commissioner considers that the Infringements
occurred despite (i) MediaLab’s knowledge that children were likely
to be using the Platform; and (ii) the fact that MediaLab can
reasonably have been expected to implement measures to ensure
that it did not process the personal data of children under 13 years
old unlawfully, the Commissioner has concluded that these matters
have been adequately reflected in the assessment of seriousness.
Therefore, the Commissioner has concluded that this potentially
aggravating factor does not warrant an increase in the amount of
the penalty (see paragraphs 171 – 173 above).
c) The Commissioner is not aware of any previous infringements of
the UK GDPR by MediaLab; nor has he previously imposed any
measures referred to in Article 58(2) UK GDPR on MediaLab.
Therefore, these factors are not relevant to the Commissioner’s
findings (see paragraphs 174 and 181 above).
d) MediaLab has cooperated with the Commissioner to the extent
required by Article 31 UK GDPR, which, in accordance with
paragraph 87 of the Fining Guidance, has been treated as a neutral
factor (see paragraphs 175 – 178 above).
e) The Infringements became known to the Commissioner through
the ICO’s proactive engagement with organisations following the
introduction of the Children’s Code. The Commissioner considers
this is a neutral factor in the assessment (see paragraphs 179 –
180 above).
78
f) There are no relevant codes of conduct or approved certification
mechanisms in this case. Therefore, this factor is not relevant to
the Commissioner’s findings (see paragraph 182 above).
g) There are no other relevant aggravating or mitigating factors in
the case (see paragraphs 183 – 185 above).
218. In light of the above, the Commissioner finds that no adjustment should
be made to take account of aggravating or mitigating factors.
(6) Step 5: Adjustment to ensure the penalty is effective,
proportionate and dissuasive
219. As set out in paragraph 142 of the Fining Guidance, “The aim of Steps
1 to 4 of the calculation is to identify a fine that is effective,
proportionate and dissuasive. The purpose of Step 5 is to provide the
opportunity to check that is the case. It allows the Commissioner to
increase or decrease the penalty as necessary, having regard to all the
relevant circumstances of each individual case.”
220. When reaching a decision as to whether a fine is effective, proportionate
and dissuasive, the Commissioner will have regard to all the relevant
circumstances of each individual case. This includes:
a) the seriousness of the infringement;
b) any aggravating or mitigating factors;
c) the controller or processor’s size and financial position; and
d) the need for effective deterrence. 192
221. The Commissioner considers that a penalty of £183,750 for the Lawful
Basis Infringement and £91,350 for the DPIA Infringement would
exceed what is necessary in order to constitute effective, proportionate
and dissuasive responses to the Infringements when taking into
account:
192
Fining Guidance, paragraph 147
79
a) the fact that the Relevant Processing is no longer ongoing following
the implementation of the UK geo-block on 30 September 2025;
b) MediaLab’s acceptance of the Commissioner’s provisional findings
in the NOI in respect of its liability for the Infringements; and
c) MediaLab’s commitment in its Written Representations that it
would only lift the UK geo-block and resume the processing of UK
users’ personal data after taking remedial steps to address the
Infringements.
222. The Commissioner considers that the factors set out at paragraph 221
above are significant. These factors mean that the Infringements are no
longer ongoing, and are indicative of MediaLab’s recognition that it
infringed the UK GDPR and its commitment to avoid a repetition of such
infringements in the event that it restores access to the Platform in the
UK. The Commissioner considers that these factors are relevant both to
the level of specific deterrence required in this case and the
proportionality of the penalty.
223. Therefore, the Commissioner considers that it is appropriate to apply a
10% reduction to the penalties calculated at the end of Step 4 of the
Fining Guidance, producing a total aggregate penalty of £247,590,
comprised of:
a) £165,375 in relation to the Lawful Basis Infringements; and
b) £82,215 in relation to the DPIA Infringements.
224. The Commissioner finds that these penalties represent an appropriate,
but not excessive, response to the Infringements and would achieve
the objective of promoting MediaLab’s future compliance with the UK
GDPR and DPA 2018.
225. The Commissioner also considers that the penalties would have a
genuine deterrent effect, as they would be sufficient to deter MediaLab
80
against committing infringements of the UK GDPR and / or the DPA
2018 in the future.
226. The Commissioner also considers that the penalties would reinforce the
importance of controllers’ and processors’ obligations regarding the
protection of children’s rights and freedoms in relation to the processing
of their personal data, including by ensuring that risks to those rights
and freedoms are identified, assessed and mitigated by carrying out a
DPIA, where necessary, before processing begins. The penalties would
also provide general deterrence by demonstrating that there are serious
consequences for controllers and processors which fail to comply with
their obligations in respect of the processing of children’s personal data.
227. Furthermore, the Commissioner considers that the penalties are
proportionate when taking into account:
a) the specific protection which must be given to children in respect
of the processing of their personal data; 193
b) the negligent nature of MediaLab’s failure to comply with its
obligations under Article 5(1)(a), Article 6, Article 8 and Article
35(1) UK GDPR; and
c) the number of children who used the Platform and the potential for
those children, particularly those under 13 years old, to have
suffered damage as a result of being exposed to potentially
harmful content and MediaLab’s failure to identify, assess and
mitigate such risks prior to commencing the Relevant Processing.
228. The Commissioner also considers that the calculation of the penalties
by reference to MediaLab’s projected annual turnover for the year
ending 31 December 2025 ensures that they are proportionate when
assessed against the company’s current financial position. In particular,
the use of the projected annual turnover for the year ending 31
193
Recital 38 UK GDPR
81
December 2025 reflects the
referred to in its Written Representations. The aggregated
penalty represents approximately % of MediaLab’s projected
turnover for the year ending 31 December 2025 and does not exceed
what the Commissioner considers to be appropriate and necessary in
the circumstances of the case in order to reflect the seriousness of the
Infringements, nor does it exceed the applicable statutory maximum
amounts.
229. Finally, when exercising his discretion to decide the appropriate amount
of a penalty 194, the Commissioner is mindful of the fact that the setting
of a penalty is not a mechanistic assessment, but one of evaluation and
judgement. 195 In all the circumstances of this case, the Commissioner
is satisfied that the penalties are effective, proportionate and
dissuasive, do not exceed the applicable statutory maximum amounts,
and that no further adjustments are necessary.
(7) Conclusion - Penalty
230. For the reasons set out above, the Commissioner has decided to impose
a penalty on MediaLab in the amount of £247,590, comprised of:
a) £165,375 in respect of the Lawful Basis Infringements; and
b) £82,215 in respect of the DPIA Infringement.
VII. FINANCIAL HARDSHIP
231. The Fining Guidance outlines that, in exceptional circumstances, the
Commissioner may reduce a penalty where an organisation is unable to
pay due to its financial position.
232. Despite MediaLab’s Written Representations referring to
“ ,” 196 no further detail was provided in
194
See Doorstep Dispensaree Limited v The Information Commissioner [2024] EWCA Civ
1515 at [57]
195
Fining Guidance, paragraph 143.
196
MediaLab’s Written Representations, 29 October 2025: Executive Summary: paragraph
1.7
82
support of this submission and the financial information provided in
support of the Written Representations lacked narrative or notes
233. Therefore, the Commissioner does not consider that MediaLab’s Written
Representations nor the updated financial information accompanying
them demonstrate that the imposition of a penalty of the amount set
out at paragraph 230 above would irretrievably jeopardise the
economic viability of the company. The Commissioner finds that the
has been adequately and
appropriately reflected through the use of its projected annual turnover
for the year ending 31 December 2025 for the purposes of accounting
for turnover at Step 2 of the penalty calculation (see paragraphs 210 –
214 above).
234. In addition, and in accordance with paragraph 153 of the Fining
Guidance, the Commissioner will consider any representations
MediaLab may wish to make regarding an agreement which would
provide additional time to pay the penalty and/ or allow for payment in
instalments.
VIII.PAYMENT OF THE PENALTY
235. The penalty must be paid to the ICO by BACS transfer or cheque by 5
March 2026 or in accordance with the terms of any agreed payment
plan.
236. Pursuant to paragraph 9(1) of Schedule 16 to the DPA 2018, the
Commissioner cannot take action to recover a penalty unless:
a) the period specified in this Penalty Notice (i.e. by 5 March 2026)
has ended;
b) any appeals against this Penalty Notice have been decided or
otherwise ended;
83
c) if this Penalty Notice has been varied, any appeals against the
penalty variation notice have been decided or otherwise ended;
and
d) the period for MediaLab to appeal this Penalty Notice, and any
variation of it, has ended.
237. Under paragraph 9(2) of Schedule 16 to the DPA 2018, in England and
Wales, the Commissioner is able to enforce the payment of the penalty.
The penalty is recoverable:
a) if the County Court so orders, as if it were payable under an order
of that court; or
b) if the High Court so orders, as if it were payable under an order of
that court.
IX. RIGHTS OF APPEAL
238. By virtue of section 162 DPA 2018, MediaLab may appeal to the First-
tier Tribunal (General Regulatory Chamber) (Information Rights)
against this Penalty Notice. MediaLab may appeal to the Tribunal
against the amount of the penalty regardless of whether or not it
appeals against this Penalty Notice.
239. Information about the appeals process is set out in Annex 1 to this
Penalty notice. Any notice of appeal should be sent or delivered to the
Tribunal so that it is received within 28 days of the date of this Penalty
Notice.
Dated 4 February 2026
Tim Capel
Interim Executive Director (Regulatory Supervision)
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
84
ANNEX 1
DATA PROTECTION ACT 2018 (PART 6, SECTION 162)
RIGHTS OF APPEAL
1. By virtue of section 162(1) DPA 2018, MediaLab may appeal to the
Tribunal against this Penalty Notice. By virtue of section 162(3) DPA
2018, MediaLab may appeal to the Tribunal against the amount of the
penalty specified in this Penalty Notice, regardless of whether or not
MediaLab appeal against this Penalty Notice.
2. If MediaLab appeals and if the Tribunal considers:
a) that the notice or decision against which the appeal is brought is
not in accordance with the law; or
b) to the extent that the notice or decision involved an exercise of
discretion by the Commissioner, that the Commissioner ought to
have exercised the discretion differently,
the Tribunal must allow the appeal or substitute another notice or
decision which the Commissioner could have given or made.
3. MediaLab may bring an appeal by sending notice of appeal to the
Tribunal at:
or
General Regulatory Chamber
HM Courts and Tribunals Service
PO Box 11230
Leicester
LE1 8FQ
UK
Telephone: 0300 123 4504
4. The notice of appeal should be received by the Tribunal within 28 days
of the date of this Penalty Notice (which is the date that this Penalty
Notice was sent).
85
5. If MediaLab’s notice of appeal is late, the Tribunal will not accept it
unless the Tribunal has extended the time for complying with this rule.
6. The notice of appeal must include at least:
a) MediaLab’s name and address;
b) the name and address of MediaLab’s representative (if any);
c) an address where documents may be sent or delivered to
MediaLab;
d) the name and address of the respondent (the Information
Commissioner);
e) details of the decision to which the proceedings relate;
f) the result MediaLab is seeking;
g) the grounds on which MediaLab relies;
h) a full copy of this Penalty Notice; and
i) (if the notice of appeal is late) a request for an extension of time,
giving the reason(s) why the notice of appeal is late and why the
Tribunal should accept it.
7. Before deciding whether or not to appeal, MediaLab may wish to consult
its solicitor or another adviser. At the hearing of an appeal a party may
conduct their case themselves, or may be represented by any person
whom they may appoint for that purpose.
8. The statutory provisions concerning appeals to the First-tier Tribunal
(General Regulatory Chamber) are contained in sections 162 and 163
of, and Schedule 16 to, the DPA 2018 and The Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules (Statutory
Instrument 2009 No. 1976 (L.20)).
86
ANNEX 2
ESTIMATED IMGUR USERS AND ACCOUNT HOLDERS IN THE UK
AGED UNDER 13 AND 13 TO 17 YEARS OLD
(1) Introduction
1. This Annex provides analysis and estimates of the number of UK users
of the Platform, including those who are registered (i.e. account
holders), under 13 years old and between 13 and 17 years old.
2. The analysis has been produced by the ICO’s Directorate of Economic
Analysis within the context of the Commissioner’s investigation into
MediaLab and in order to inform our assessment of the potential scale
of the processing of personal data of users of the Platform and account
holders under 13 years old and between the ages of 13 to 17 years old
by MediaLab. References to “we” and “our” in this Annex should be
interpreted to mean the ICO’s Directorate of Economic Analysis.
3. The relevant period of interest for this analysis is from September 2021,
when MediaLab acquired Imgur, Inc., 197 to 10 September 2025, the
date upon which the Commissioner issued the NOI to MediaLab.
4. MediaLab, in its responses to enquiries from the Commissioner, stated
that it “does not collect user age information beyond acceptance of our
terms that users must be over the age of 13 to use our service.” 198 As
a result, MediaLab could not provide a breakdown of its UK users by
age.
5. In the absence of evidence from MediaLab itself as to the number of
children who use the Platform and are under 13 years old or between
13 and 17 years old, we have carried out our own analysis and produced
estimates. In doing so, we have considered reports produced by Ofcom
and figures compiled by the Office for National Statistics (“ONS”) and
197
Celebrating Imgur's Next Chapter - Imgur (accessed 24 July 2025) and letter from
MediaLab to the ICO dated 23 July 2025.
198
Letter from MediaLab to the ICO, 15 October 2024.
87
have applied a clear methodology in order to ensure the robustness of
the results.
6. Although there is an inevitable degree of uncertainty around the
numbers, the analysis shows that in the Relevant Period there were a
considerable number of children in the UK under 13 years old and
between the ages of 13 and 17 who used the Platform.
7. We estimate that the number of children under 13 years old who used
the Platform during the period 2021 to 2023 ranged from approximately
46,000 to 96,000, whilst the estimated number of users of the Platform
aged between 13 and 17 ranged from approximately 24,000 to 101,000
during the same period. We also estimate that the number of children
under 13 years old who held an account on the Platform ranged from
approximately 14,000 to 31,000 during the Relevant Period, whilst
there were approximately 3,000 to 27,000 account holders aged
between 13 and 17 during the Relevant Period.
8. These figures demonstrate that the number of estimated users of the
Platform is higher than the estimated number of account holders, which
is consistent with the fact that users can access the Platform without
creating an account, a process which requires users to provide more of
their personal data and complete the account set-up process.
(2) Methodology
(a) Data Sources
9. To ensure the robustness of our estimates, we have considered only
data from publicly available sources, such as other regulators or
research conducted by independent organisations that have either
been peer reviewed or which provide the research methodology and
explain any assumptions or limitations.
10. The Ofcom Children’s Media Literacy Tracker provides data from the
Parents’ and Children’s Online Behaviours and Attitudes surveys. The
88
Ofcom Children’s Media Literacy Trackers for 2021, 199 2022 200 and
2023 201 provide data on the overall use of the Platform by children
under the age of 18. Specifically, Table 30 of the report provides a
summary of the percentage of children using different applications
across all activities and uses, thereby providing a basis for estimates
of the number of users of the Platform aged between 3 and 17.
11. The Ofcom reports also provide data about the Platform’s account
holders by asking parents to list the applications and sites where they
have set up a profile for their children or by asking the children if they
have set up a profile using the following question: “Below is a list of
some of the apps/sites that you said earlier that your child uses.
Some can be used by anyone, but others need a profile to be set up
first. This may involve choosing a user name, password and a picture
for the profile. Please click on those where you have set up a profile
for your child/where you have your own profile.”
12. The 2021, 2022 and 2023 Ofcom Children’s Media Literacy Tracker
surveys used an online-only approach. We did not adjust our
calculations for this because the study technical report notes that “an
online approach is appropriate as virtually all parents of 3 to 17 year
olds are online.” 202 We also note that our methodology excludes
children who use applications on devices that are not their own (e.g.
devices belonging to the friends) and in this sense, our estimates are
conservative.
199
See Children's Media Literacy Survey 2021 Online Behaviours and Attitudes Wave 2
Data Tables for 2021 accounts and user data.
200
See Children's Media Literacy Tracker 2022 - Children's Online Behaviour and Attitudes
Wave 2 Data Tables for 2022 accounts and user data.
201
See Children’s Media Literacy Tracker 2023 – Children’s Online behaviour and Attitudes
Data Tables for 2023 accounts and user data.
202
See Children's Media Literacy Tracker 2022 - Technical Report (all surveys).
89
(b) Estimation approach
13. In order to use the survey results to estimate the total number of
users of the Platform and Platform account holders under 13 years old
and between the ages of 13 and 17, information on the number of
children in the UK, in total and for the age bands in question, during
the Relevant Period was required. This data is available from the ONS
and is shown in Table 1 below.
90
Table 1: ONS data on the number of children in the UK aged 3 to 17 in the period between 2021 and 2023
Age 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
Number of
children at
734, 749, 758, 776, 799, 793, 798, 817, 839, 840, 829, 823, 831, 800, 788,
this age in
023 283 470 432 371 617 031 504 089 153 602 939 564 948 039
the UK,
2023
Number of
children at
733, 743, 762, 786, 780, 785, 805, 828, 830, 820, 814, 822, 790, 772, 770,
this age in
702 637 152 039 620 811 862 047 155 386 796 157 339 612 906
the UK,
2022
Number of
children at
732, 751, 774, 769, 775, 795, 818, 822, 810, 806, 813, 781, 765, 764, 759,
this age in
469 206 709 990 405 554 289 479 230 827 580 717 536 087 416
the UK,
2021
Source: ONS, Series MYE2, available at: Estimates of the population for the UK, England, Wales, Scotland, and
Northern Ireland - Office for National Statistics.
91
14. As explained in paragraphs 10 and 11 above, the Ofcom reports
provide the percentages of children that use or have accounts on the
Platform. To produce our estimates we therefore multiplied the
percentages reported in the Ofcom reports for each of the age groups
by the ONS UK population numbers for those age groups.
15. Where the percentage of respondents in the Ofcom reports was below
0.5%, Ofcom reported that this data point was “close to zero” using
an asterisk (*). This means that some data was omitted in the reports
and could lead to an underestimation of the number of users or
account holders for certain age groups, particularly where all of the
data points were marked with an asterisk. To account for this we have
used the raw survey data reported by Ofcom 203 to estimate what the
percentages marked as an asterisk would have been. This was
achieved by dividing the number of respondents reporting use of the
Platform by the total number of respondents for the question. The
estimated percentage (less than 0.5%) was then applied to the ONS
UK population numbers in the same manner as the percentages
provided in the Ofcom reports. We have indicated below where
estimates have been produced using this methodology.
(3) User number estimates
(a) Children aged 3 - 12
16. Figure 1 and Table 2 below demonstrate the estimated number of
users of the Platform between the ages of 3 and 12 during the period
from 2021 to 2023.
203
The raw data tables are available on Ofcom’s website, see links in footnotes 176 to 178
above.
92
Table 2: Estimated number of users of the Platform between the ages of
3 and 12 during the period between 2021 and 2023
Age 3 to 3 4 5 6 7 8 9 10 11 12
12
Number of
children at
this age in
the UK, 7,905, 734,0 749,2 758,4 776,4 799,3 793,6 798,0 817,5 839,0 840,1
2023 973 23 83 70 32 71 17 31 04 89 53
Percentage
who use
Imgur,
2023 1% * * 2% 2% 2% 1% 1% 1% 1% 2%
Number
who use
Imgur, 95,97 15,16 15,52 15,98 16,80
2023 1 * * 9 9 7 7,936 7,980 8,175 8,391 3
Number of
children at
this age in
the UK, 7,876, 733,7 743,6 762,1 786,0 780,6 785,8 805,8 828,0 830,1 820,3
2022 411 02 37 52 39 20 11 62 47 55 86
Percentage
who use
Imgur,
2022 1% 1% 1% 1% 1% 1% * * * * 1%
Number
who use
Imgur, 46,26
2022 5 7,337 7,436 7,622 7,860 7,806 * * * * 8,204
Number of
children at
this age in
the UK, 7,857, 732,4 751,2 774,7 769,9 775,4 795,5 818,2 822,4 810,2 806,8
2021 158 69 06 09 90 05 54 89 79 30 27
Percentage
who use
Imgur,
2021 1% * * 1% 1% 1% 1% 1% 1% 1% 3%
Number
who use
Imgur, 79,87 24,20
2021 1 * * 7,747 7,700 7,754 7,956 8,183 8,225 8,102 5
Sources: ICO calculations based on Ofcom and ONS data, as described in text
above.
93
Figure 1: Estimated number of users of the Platform between the ages of 3
and 12 during the period between 2021 and 2023
120,000
100,000
80,000
60,000
40,000
20,000
0
2021 2022 2023
Estimate for 3 - 12 age group Adjustment for percentages close to zero for 3 - 12 age group
Sources: ICO calculations based on Ofcom and ONS data, as described in
text above.
17. As Table 2 and Figure 1 show, our estimates of user numbers
fluctuated in the period between 2021 and 2023, ranging between
approximately 46,000 in 2022 to 96,000 in 2023. Figure 1 also shows
what the estimates would be if we included our estimates of the data
missing from Table 2.
(b) Children aged 13 - 17
18. Table 3 and Figure 2 below show the corresponding estimates of
number of users of the Platform between the ages of 13 and 17
during the period between 2021 and 2023.
Table 3: Estimated number of users of the Platform aged 13 – 17
during the period between 2021 and 2023
Age 13 to 17 13 14 15 16 17
94
Number of children
at this age in the
UK, 2023 4,074,092 829,602 823,939 831,564 800,948 788,039
Percentage who use
Imgur, 2023 2% 2% 2% 2% 1% 1%
Number who use
Imgur, 2023 65,592 16,592 16,479 16,631 8,009 7,880
Number of children
at this age in the
UK, 2022 3,970,810 814,796 822,157 790,339 772,612 770,906
Percentage who use
Imgur, 2022 1% 1% 1% 1% * *
Number who use
Imgur, 2022 24,273 8,148 8,222 7,903 * *
Number of children
at this age in the
UK, 2021 3,884,336 813,580 781,717 765,536 764,087 759,416
Percentage who use
Imgur, 2021 3% 3% 3% 3% 2% 2%
Number who use
Imgur, 2021 101,295 24,407 23,452 22,966 15,282 15,188
Source: ICO calculations based on Ofcom and ONS data, as described in text
above.
19. These estimates are also shown in Figure 2 below, which again also
shows what the estimates would be if we included our estimates of
the data missing from Table 3.
Figure 2: Estimated number of users of the Platform aged 13 – 17
during the period between 2021 and 2023
95
120,000
100,000 -
80,000
60,000
40,000
20,000
0
2021 2022 2023
Estimate for 13 - 17 age group Adjustment for percentages close to zero for 13 - 17 age group
Source: ICO calculations based on Ofcom and ONS data.
20. Accordingly, our estimates of numbers of users between the ages of
13 and 17 fluctuated in the period between 2021 and 2023, ranging
from approximately 24,000 in 2022 to 101,000 in 2021.
(4) Account number estimates
(a) Children aged 3 - 12
21. For our estimates of the numbers of account holders, more of the data
are noted in Ofcom’s reports as being “close to zero” than is the case
for the user numbers explained above. In particular, all age groups
between 3 to 12 years old are omitted in the reports. As a result of
this, we have used the approach described in paragraph 15 above for
all of these estimates, and these adjusted figures are used as our
estimates of the numbers of account holders between 3 to 12 years
old, as shown in Figure 3 below.
Figure 3: Adjusted estimated number of account holders on the
Platform aged 3 to 12 during the period between 2021 and 2023
96
35,000
30,000
25,000
20,000
15,000
10,000
5,000
0
2021 2022 2023
Estimate for 3 - 12 age group Adjustment for percentages close to zero for 3 - 12 age group
Source: ICO calculations based on Ofcom and ONS data.
22. Figure 3 shows that the estimated number of account holders aged
between 3 and 12 during the period between 2021 and 2023 ranged
from approximately 14,000 in 2022 to 31,000 in 2021.
(b) Children aged 13 - 17
23. For account holders aged between 13 and 17 only some of the figures
are omitted from its reports, so we are able to follow the same
approach as that for the user numbers in Section 3 above. Figure 4
below shows the estimated number of children between the ages of
13 and 17 who held an account on the Platform in the period between
2021 and 2023.
Figure 4: Estimated number of account holders on the Platform between
97
the ages of 13 and 17 during the period between 2021 to 2023
30,000
25,000
20,000
15,000
10,000
5,000
0
2021 2022 2023
Estimate for 13 - 17 age group Adjustment for percentages close to zero for 13 - 17 age group
Source: ICO calculations based on Ofcom and ONS data.
24. We estimate that the number of children aged between 13 and 17 who
held an account on the Platform between 2021 and 2023 ranged from
approximately 3,000 in 2022 to 27,000 in 2023. We note that for 2022
all age groups between 13 and 17 years old in 2022 were reported as
“close to zero” (marked with an asterisk) in the Ofcom report.
98
ANNEX 3
HARM ASSESSMENTS
Content Warning
Please note that this document contains content of a sexual nature and
content related to eating disorders. This content is considered to be
potentially harmful to children and some adults might also find it upsetting.
(1) Introduction
1. The examples of content accessible on the Platform which are included
below are taken from reviews completed by the Commissioner’s
Intelligence Department on 3 April 2025, 25 July 2025 and 28 July
2025.
2. The Intelligence Department’s work was conducted on an iOS device
and separately on an Android device, both on the app version of the
Platform and via a web browser (Safari, in the case of the iOS device
and Google Chrome, in the case of the Android device). Some content
was viewed whilst logged-out of an account on the Platform and some
content was viewed whilst logged-in to an account on the Platform.
3. The results set out in section 3 below indicate whether content was
viewed whilst the user was logged into or out of an account on the
Platform.
4. The Platform contains a “mature content” toggle which allows Logged-
in Users to “enable mature content”. Logged-In Users do not have to
verify their age when changing their mature content settings. Users
cannot turn on “mature content” on the iOS version of the Platform due
to Apple’s App Store requirements. If this is attempted, users of the
iOS version of the Platform receive an error message when attempting
to open the settings through the Platform’s Help Centre.
99
(2) Overview of key findings
5. The Intelligence Department’s research found that potentially harmful
content was available on the Platform to both Logged-in Users and
Guest Users and when the mature content setting was toggled on or
off.
6. The potentially harmful content observed whilst accessing the Platform
as Logged-in User included explicit language, depictions of serious
violence or injury, antisemitic and discriminatory language and the
expression of homophobic views.
7. Potentially harmful content displayed when accessing the Platform as a
Guest User included content of a sexual nature, the depiction of serious
violence or injury and content relating to eating disorders.
100
(3) Harm assessments: Examples of potentially harmful content
Figure 1 – Potentially harmful content relating to eating disorders
Operating System: iOS
App/Browser: App
Account Status: Logged-out
101
Figure 2.1 – Potentially harmful content of a sexual nature
Operating System: iOS
App/Browser: App
Account Status: Logged-in
102
Figure 2.2 – Potentially harmful content of a sexual nature
Operating System: iOS
App/Browser: Browser (Safari)
Account Status: Logged-out
103
Figure 3 – Potentially harmful content due to explicit language
Operating System: Android
App/Browser: Browser (Google Chrome)
Account Status: Logged-in
204
The post in the above image on the left reads:
104
105
Figure 4.1 – Potentially harmful content due to content depicting
serious violence or injury
Operating System: Android
App/Browser: App
Account Status: Logged-out
106
Figure 4.2 – Potentially harmful content due to content depicting
serious violence or injury
Operating System: Android
App/Browser: Browser (Google Chrome)
Account Status: Logged-in
107
Figure 5 – Potentially harmful content due to antisemitism and religious
discrimination
Operating System: iOS
App/Browser: App
Account Status: Logged-in
108
Figure 6.1 – Potentially harmful content due to expression of
homophobic views
Operating System: iOS
App/Browser: App
Account Status: Logged-in
109
Figure 6.2 – Potentially harmful content due to expression of
homophobic views
Operating System: iOS
App/Browser: App
Account Status: Logged-in
110