Hello! How lovely to see you again,

This week's top story is about Reddit's £14.5m ICO fine. The social media platform were found to be in breach of the Online Safety Act by not taking measures to adequately protect children. On the face of it, it seems pretty straightforward. But Reddit's appeal to the ICO speaks to a conflicting need to protect not just children's privacy, but everyone's.

We also take a look at how someone accidentally gained control of 6,700 robot vacuums, why you should be worried about some Discord news (even if you've no idea what Discord is), and how landlines might be joining vinyl in the "old tech that makes a comeback" pile (yes, landlines are "old tech" I'm as sad about it as you are).

Finally, in the new "blog of the week" feature, we take a look at what the Romans can teach us about how AI might be destined to fail.

Let's get stuck in...

Top story

💰 Reddit fined £14.5m in UK over use of under-13s’ data

A quick summary of the story

Reddit, the popular social media platform, has been fined £14.5 million for failing to protect child users of its site. From the ICO ruling:

“Reddit’s failings included not checking the age of users accessing its platform, putting children at risk.”

It means they don't have a lawful basis for processing the data of children under the age of 13, who the ICO claim must be present on the platform as there is no way to prove they are not. Part of Reddit’s appeal is that they remove the accounts of users who are under 13 years old, though it is difficult to understand how they can do this without knowing for certain which users are under 13.

Seems bad, but quite simple. Why are we talking about it?

If you aren't familiar with Reddit, there's something that might not be clear based on reading the news.

Reddit itself is comprised of a series of “subreddits” - think areas of interest where you can discuss specific topics. There are (broadly) three tranches of subreddit: those anyone can access (without an account), those that require an account to access, and those can can only be accessed by people who have verified that they are over 18 years old. If you want to join in the discussions of any subreddit (rather than just reading the comments) you will need an account.

The reason for the ICO fine is that in order to prove you are over 13 (and therefore legally able to have an account) you need to go through the gruelling and impossible-to-get-around verification step of [checks notes] doing nothing at all. When you create an account you are asked for your date of birth, but you don’t have to give it. It seems in the year 2026, Reddit is still operating on the model of “trusting that people have read the terms and conditions and aren’t lying”.

This is the ICO’s problem with Reddit. Because Reddit doesn’t ask for your age (other than for subreddits with explicit content - more on that in a sec), it follows that the site holds the data of those under 13 years old. It might just be their email address, or it might be their email address and details of medical procedures, their religion, or any other manner of identifying / special category data that they choose to share on the platform. In fact, it almost doesn't matter. Being under the age of 13 means they cannot legally give informed consent to their data being on the platform.

Cut and dried. Or is it?

It does seem pretty cut and dried. Reddit, as do all online services post Online Safety Act (OSA), have a responsibility to protect children. That it doesn’t know which of its users are of specific ages is not the ICO’s problem. Reddit have breached OSA, and they are thus fined.

But if you find yourself asking “how can they verify age without collecting more information, therefore potentially putting individuals more at risk?” then you find yourself asking the same question that Reddit puts in its appeal to the ICO.

How could Reddit verify age going forward?

Reddit are appealing the fine, and they may well succeed - either in whole or in part. But it seems unlikely either way that they'll be allowed to continue operating in the UK completely unchanged. So, what’s the answer? How should Reddit ensure that its users are over 13?

There is precedent to verifying a user’s age, of course. To access any of that third tranche of subreddits (including those with explicit content), you need to make use of a service called Persona to upload a form of government ID. Persona checks that the ID is legit, verifies that you are over 18, and then tells Reddit that you’re allowed to view that content. Take note of that name by the way, Persona, as they come up in a story later on. Spoiler alert: it’s not a fun one.

So, one option would be to extend this from 18 year olds down to 13 year olds. According to the 2021 Census, a little over 87% of 13-18 year olds have passports. For the 13% who don’t there are initiatives like the CitizenCard that aim to fill that gap.

Great! So all anyone has to do in order to access Reddit, functionally in its entirety, is to link their account to their government ID. It's certainly a simple solution to the problem. It would stop under-13s from having data stored on the site. That paves the way for stronger protection for children. Once you know your user is a child, you can stop adults from direct / private messaging them. If you know your user is an adult, you can stop them from accessing child-only spaces. In fact, you can actually have child-only spaces. You can ensure algorithms never push unsuitable content towards minors. It introduces a level of friction that can deter predators from acting, and it can make repeat offending harder.

All of these things are, of course, good things.

But children aren't the only ones who need protecting online. And Reddit argues that collecting that level of information about every one of its users itself constitutes an unacceptable privacy breach.

What's the problem?

Linking your government ID to an account that you might use to comment specific political views, or share detailed and identifable information, is no small ask. You don't have to watch porn to not want the government to know what you're doing.

And if you're thinking "well the ID check is done by a third party, so the ID isn't actually linked to what I'm doing on Reddit", then you may have missed this story back in October, where hackers got to Discord (another social platform) users' data through their third party age verification service.

Even so, maybe you think that's an acceptable risk to freedom in order to protect children. You certainly wouldn't be the only one, and there's enough going on in the world right now to support that position. But there are plenty of people out there - from activists to legal professionals, and others besides - who rely on anonymity and protection from government to do their thing. Whatever side of this particular fence you fall on, there is complexity and nuance that - so far - the UK Government doesn't seem willing or able to engage with.

What would the alternative be?

If taking government IDs is not a good option, what's is? How do you protect children, and retain anonymity?

The truth is that there isn't a perfect solution. When it comes to stopping predators, some suggest looking at behaviour over identity. Grooming often follows a predictable pattern, so looking for that behaviour and stopping it is one option. But the word "often" is doing far too much heavy lifting in that sentence.

Putting the focus back on what kids can access, another option is to look at "client-side" protections. In other words, if a parent can identify their child's phone as a child's phone, then the Reddit app or the website knows not to allow things like private messaging, or access to certain areas. But, this solution also comes with its own obvious flaws.

The current reality is, the solution most platforms have gone for is, on paper at least, probably the best middle ground. You use an independent third party to verify your age, and then get them tell the platform yes or no. Your government data doesn't sit with the platform, and once you're verified that data can be deleted anyway.

It is an awful lot of trust to put in a third party. Not to mention that, when the government gets to decide what counts as good verification, the independence of that third party can come under question. Speaking of which...

What else is going on

⚠️ Discord cuts ties with Peter Theil after identity verification breach

While researching Discord's use of Persona to comply with the Online Safety Act, researchers (/hackers, depending on your outlook on life) found some of Persona's code base on a US government site. In that code, they found that Persona does far more than just check your age against your government ID.

The system is capable of matching your facial recognition data to (US) government watch lists, as well as running checks against what it calls "adverse media". Persona collects (and can apparently retain for up to three years) IP addresses, browser and device identifiers, government ID numbers, phone numbers, names, and of course faces.

You should care for two reasons:

1. Governments get to decide on a whim what "adverse media" means, and
2. If you've ever verified your identity on LinkedIn (or Reddit, or one of a dozen other online spaces), your data has been handled by Persona.

🤖 User accidentally gains control of over 6,700 robot vacuums

Let's take a break from online identity, and look at a story that is equal parts hilarious and terrifying.

Wanting to control his own robot vacuum with a Playstation controller, AI strategist Sammy Adoufal used Claude Code to reverse engineer the protocol controlling how his vacuum contacted its servers. However, he ended up accidentally gaining access to seemingly every DJI Romo on the planet.

Hilarious. Except those particular vacuums carry video and voice capture capabilities. The servers Adoufal gained access to contained floor plans, and the ability to remote control devices - including the option to listen in to live audio and video feeds.

He promises he didn't, but the fact that he could have is a good reminder of the freedoms we give up when we lean into smart devices.

☎️ Landlines are ringing in homes again, and parents are happy about it

Let's end the news on something a little lighter, shall we?

There's a rise in parents who are reconnecting landline phones back into their homes. In part, this is because they need a way for kids to be able to make emergency calls without access to a mobile. But its also proving to be a way for those same kids to have a much healthier relationship with the idea of being contactable. Annecdotally, I’ve heard from parents that kids’ WhatsApp groups are active past midnight with calls, but even zooming out there’s plenty of research to show that smartphones + kids = very many things to consider. Putting a "real" phone back in the house, at least according to the interviewees of this article, is doing a world of good.

There seems to be an increasing shift towards "retro tech" (I hate that stuff that was normal when I grew up is now "retro", but that's a different issue...). From film-based cameras, to a Gen-Z backed revival of DVDs/Blu-rays, people seem to want out - at least in part - from the control of big-tech.

NEW: Blog of the week

⚔️ The empire always falls - JA Westenberg

I doubt very much this will be the last time I link to one of JA Westenberg's posts. A prolific writer on all things tech/culture/philosophy, her essay on how empires fall highlights the ways in which the current AI landscape isn't all that different from big movements that have come before it. Whether that's the ubiquity of the Nokia handset, or the seemingly indomitable Roman Empire.

I've no idea if she'll turn out to be right about AI. But it's a compelling argument, and you can already see the cracks if you want to look for them.

A good history lesson, and a reminder of why history is important, wrapped up in just the right amount of nerdy analogies. If you've got 5 more minutes, give this a read.

That's it for the first revamped LT3!

I'd love to know what you think. Do you like the new format? Did any of the articles resonate for you? What would you like to see more of? Hit that reply button and let's have a chat!

In the meantime, have a great rest of your week, and I'll stop by your inbox next Thursday!

-- Will