Since June 24, 2026, millions of European Reddit users have been forced to submit a government ID or a biometric face scan to access certain communities. Behind the argument of protecting minors, a major regulatory precedent is quietly being established, without any parliamentary debate worthy of the name.
The Concrete Mechanism: A Private Third Party at the Heart of European Identity
The system implemented by Reddit does not go through public institutions. It relies on Persona, a private identity verification company to which Reddit outsources the entire authentication process. It is therefore a commercial company, whose headquarters and legal data retention regime do not fall directly under European public law, that finds itself in possession of the identity documents or facial biometric data of users residing in the European Union and Norway.
The system operates in several stages:
- Reddit deploys a behavioral surveillance software upstream that analyzes browsing habits, posting history, and the vocabulary used by each user to estimate their age.
- If the algorithm judges that a user might be a minor, access to communities classified as “mature” is blocked until verification.
- Verification then requires either presenting an official ID or taking a live biometric selfie.
- In case of refusal, the user keeps their account but is permanently barred from the relevant sections.
What is striking about this system is that the control decision occurs before any document request: behavioral profiling precedes and conditions formal verification. The user is first categorized by a machine, then invited to prove the machine wrong.
“Reddit had not required users to share information about their age.” — Reddit, in response to UK regulators, quoted by Reclaim The Net
This statement sums up the irony of the turnaround: the platform that once prided itself on preserving its users’ anonymity is now the one collecting their biometric data on behalf of a private third party.
The British Trigger: A Fine That Changed Everything
The shift toward mandatory verification is not due to a spontaneous decision by Reddit. It is directly linked to a regulatory sanction. The UK’s Information Commissioner’s Office fined Reddit £14.47 million - or about $19 million, after establishing that the platform had unlawfully processed the personal data of British children between May 2018 and July 2025.
The regulator had found that Reddit allowed users to self-declare their age upon registration, a mechanism the ICO deemed effortlessly bypassable. The UK Information Commissioner, John Edwards, stated:
“It is concerning that a company of Reddit’s size failed to meet its legal obligation to protect the personal information of UK children.” — Information Commissioner John Edwards, ICO
It was under this pressure that Reddit first deployed verification in the United Kingdom, before extending the system to the European Union and Norway starting June 24, 2026 - presenting the whole move as compliance with European digital law.
When Child Protection Becomes a Universal Net
One of the most revealing effects of the system lies in its actual scope of application. Identity verification is not limited to pornographic content or spaces explicitly reserved for adults. Mental health support communities have been classified as NSFW, automatically placing them behind the same identification wall.
A user in psychological distress, seeking to join a mutual aid space, can thus find themselves confronted with a passport request before accessing any conversation. This scenario illustrates the logic of a system designed for regulatory compliance rather than the effective protection of vulnerable people.
The rules differ depending on the declared age groups:
- Accounts for 13 to 15-year-olds are locked to the most restrictive privacy settings - chat, followers, search engine visibility - with no option to modify them.
- 16 and 17-year-olds start with the same default settings but can adjust them.
However, this age gradation presupposes that the initial verification is reliable - which brings us precisely back to the fundamental question: is the collection of biometric data by a private operator an acceptable price to pay to ensure a teenager is not reading a discussion forum?
The Regulatory Trajectory: From the DSA to Mandatory Digital Identity
The Reddit case does not emerge in a legal vacuum. It is part of a coherent European regulatory trajectory, of which the Digital Services Act (DSA) constitutes the backbone. This text, which has entered into force progressively since 2023, imposes reinforced moderation and protection obligations on large platforms for vulnerable users - including minors.
The interpretation of these obligations by national and European regulators is pushing platforms to adopt increasingly robust age verification mechanisms. The logic is one of delegated constraint: Brussels sets the obligation of result, platforms choose the means, and private companies like Persona harvest the data.
This model raises a question that European institutions have not publicly resolved: who retains this data, for how long, and under what access regime? Reddit has not published the exhaustive list of behavioral signals used for prior profiling. Persona, as a private third party, operates under its own terms and conditions. The European user thus finds themselves in a situation where compliance with EU regulatory requirements requires handing over their biometric data to a company whose governance escapes direct democratic control.
Worrying Convergences: London, Brussels, and the Chinese Model
The simultaneity of the British and European approaches invites a broader comparison. The United Kingdom was a pioneer in this area, forcing Reddit to deploy an age verification system even before the European expansion. The £14.47 million fine acted as a regulatory accelerator.
This convergence between the post-Brexit British model and the continental EU model is notable: two distinct legal spaces lead to the same practical requirements - the end of anonymous access to certain parts of the public internet.
The comparison with other digital control regimes is obvious. China has long established a mandatory digital identity system to access online platforms, backed by a social credit system. Western liberal democracies have long presented this model as an authoritarian anomaly. What is being set up in Europe is not identical - the stated purposes are different, legal safeguards exist - but the structural direction is the same: the end of the internet as a space for expression without prior identity conditions.
The difference in political regime must not mask the convergence of technical architectures. A biometric verification system delegated to private operators, without transparency on data retention, constitutes a potential surveillance infrastructure, regardless of the initial intentions of its designers.
The Absence of Democratic Debate: A Decision Driven by Agencies
Perhaps the most significant point of the issue is the one mainstream media mentions the least: no European national parliament has voted to impose biometric identity verification as a condition for internet access. The decision results from a regulatory chain involving:
- The European Commission and its directorates-general, in drafting the DSA;
- National regulatory authorities (including the UK’s ICO), in interpreting and applying the texts;
- The private platforms themselves, in choosing the technical means of compliance;
- Third-party identity verification companies, in operational execution.
At no point in this chain did a direct democratic vote settle the question of principle: is it legitimate to require a European citizen to prove their identity to a private American company to access an online discussion forum?
Parliaments delegated to agencies, agencies delegated to platforms, platforms delegated to third parties. The result is a major transformation of the conditions of access to the digital public space, carried out through regulatory capillary action, without the question ever being put directly to voters.
Conclusion: Tomorrow’s Infrastructure Is Being Built Today
The Reddit case is probably just the beginning. Other platforms operating in Europe face the same regulatory pressures. The logic of the DSA, applied consistently, will mechanically lead to the extension of age - and therefore identity - verification requirements to a growing scope of the internet accessible from the European Union.
The question is not whether protecting minors online is a legitimate concern: it is. The question is whether the chosen remedy - the systematic collection of biometric data by private operators, without democratic debate, without transparency on data retention, without a serious technical alternative - is proportionate to the stated objective, and whether the infrastructures thus established will remain confined to their declared use.
The history of surveillance systems teaches us that databases built for one purpose have rarely resisted the demands of other purposes for long. It is this very question - that of the irreversibility of digital architectures - that deserves a real public debate, before the infrastructure is in place and the debate becomes theoretical.
