ICO’s Imgur Fine: A Wake-Up Call for SME AI Data

The ICO didn’t fine Imgur’s owner for having “bad content moderation”. It fined them £247,590 because children could use the platform for years without meaningful age checks, while their personal data was processed to shape what they saw.

If you run a UK small business, you might be thinking: That’s a big tech platform problem, not mine. I disagree. The same pattern shows up in SMEs every day—especially where AI marketing tools, chatbots, recommendation widgets, and ad platforms quietly collect data and make decisions based on it.

This post is part of our “Governance, Regulation & Public Trust” series, because nothing erodes trust faster than mishandling data—particularly children’s data. And the regulatory direction of travel in the UK is clear: if your service is likely to be accessed by under-18s, you need to design for that reality, not wish it away.

What the ICO fined Imgur for (and why it matters to SMEs)

Answer first: The ICO penalised MediaLab.AI, Inc (Imgur’s owner) because it processed children’s personal data without appropriate safeguards—specifically no effective age assurance, no parental consent for under-13s where relying on consent, and no data protection impact assessment (DPIA) to identify and reduce risks.

The ICO investigation covered September 2021 to September 2025. The regulator concluded that children were able to access the platform and were exposed to harmful content, while Imgur’s systems used personal data to influence recommendations—without protections appropriate for children.

For SMEs, the uncomfortable takeaway is this:

If your website, app, community, or marketing funnel can realistically attract children—even unintentionally—you need controls that match the risk.

You don’t have to run a social network to fall into this category. Think about:

• A local gym running TikTok-style content and using a chatbot to book trials
• An e-commerce brand selling trending products that appeal to teens
• A games-adjacent business collecting emails for giveaways
• A tuition provider using AI to personalise learning content

If your AI stack touches personal data, you’re in governance territory—whether you call it that or not.

Children’s data rules in the UK: the bits businesses get wrong

Answer first: Under UK GDPR, children’s personal data gets enhanced protection, and the Children’s Code (Age Appropriate Design Code) sets expectations for online services likely to be accessed by under-18s. If you rely on consent to process data for under-13s, that consent must come from a parent or carer.

The mistake I see most often in small businesses is assuming a line in the terms and conditions counts as a safeguard.

“We say under-13s need parental supervision” isn’t a control

Imgur’s terms reportedly said under-13s required parental supervision, but the ICO found no mechanism to enforce it.

For SMEs, “policy-only compliance” is a trap. If your systems still:

• collect identifiers (email, device ID, cookies, advertising IDs)
• profile users (segments, predicted interests)
• personalise content (recommendations, dynamic pricing, tailored offers)

…then you need operational controls, not just legal text.

Age assurance isn’t one thing

A lot of teams think age assurance equals “upload your passport”, which feels overkill. In practice, it’s a proportionate approach: you choose methods based on risk, audience, and the nature of the service.

Examples of proportionate measures (varies by context):

• Neutral age gates (with anti-bypass design and follow-up checks)
• Age estimation via trusted providers (where appropriate)
• Account design that defaults to high privacy when age is unknown
• Turning off profiling and targeted ads where you can’t confidently age-check

The ICO’s message here is blunt: either apply Children’s Code protections to everyone, or implement robust age assurance to tailor safeguards.

Where AI tools create hidden compliance risk for small businesses

Answer first: AI increases compliance risk because it encourages businesses to collect more data, keep it longer, and use it for inference and personalisation—often without a clear lawful basis, clear notices, or a DPIA.

The Imgur case focused on recommendations shaped by personal data. That’s not unique to big platforms. Many SME-friendly tools do similar things, such as:

• AI email platforms that optimise send time, subject lines, and segmentation
• Website personalisation tools that change banners/offers based on behaviour
• Chatbots that capture “free text” (often containing sensitive data)
• Ad platforms that build lookalike audiences and retargeting pools

The “free text problem” in chatbots and forms

Here’s what works in real life: assume customers will overshare.

A simple “How can we help?” chatbot can collect:

• health information (“I’m looking for anxiety support…”)
• children’s information (“My 12-year-old needs tutoring…”)
• financial details (“I can only pay after payday…”)

If that data is stored, forwarded to an AI vendor, or used to profile users, you need a tighter governance setup than most SMEs currently have.

Profiling is the quietest risk

Profiling doesn’t have to be sinister to be regulated. If your AI tool predicts what someone might buy, what content they should see, or how likely they are to convert, that’s behavioural analysis—and it becomes more sensitive when children might be involved.

If you can’t reliably distinguish adults from children, a safe stance is:

• minimise tracking by default
• limit personalisation
• keep retention short
• avoid using data for targeted advertising where not necessary

A practical “SME DPIA-lite” checklist (do this before switching on AI)

Answer first: A DPIA is how you prove you understood risk and designed controls. You don’t need a 40-page document, but you do need evidence you assessed impact, especially where children may access your service.

If your business doesn’t already do DPIAs, start here. This is the minimum I’d want on file before deploying an AI tool that touches customer data.

1) Map what data the AI tool actually uses

Write down:

• Inputs: what the user provides (forms, chat, uploads)
• Observed data: cookies, clicks, device info, location
• Derived data: segments, scores, inferred interests
• Outputs: recommendations, automated messages, decisions

If you can’t explain it in plain English, you don’t control it.

2) Decide your lawful basis (and don’t default to consent)

Common lawful bases for SMEs include legitimate interests or contract. If you rely on consent, you need it to be freely given, informed, and easy to withdraw—and for under-13s, parental consent rules bite.

A strong move for many SMEs: reduce reliance on consent by reducing data use.

3) Check “likely to be accessed by children” honestly

You don’t need to market to children to be accessed by them. Ask:

• Do your products/services appeal to teens?
• Do you use channels with younger audiences?
• Do families buy your product?
• Could a child reasonably sign up without friction?

If the answer is “yes” or “maybe”, design for it.

4) Set child-appropriate defaults where age is unknown

Practical defaults:

• turn off targeted ads/personalised recommendations by default
• disable data sharing to third parties unless necessary
• minimise analytics identifiers
• shorten retention (e.g., 30–90 days unless needed)

This aligns with the Children’s Code principle of high privacy by default.

5) Put your vendors on a tighter leash

Most AI tools are vendors processing data on your behalf. You need:

• a clear data processing agreement
• clarity on where data is stored
• whether data is used to train models
• retention and deletion commitments
• sub-processor list (who else gets the data)

If a vendor can’t answer these clearly, that’s your sign.

Governance and public trust: why this isn’t just a legal box-tick

Answer first: Strong data governance builds trust, reduces brand risk, and prevents expensive rework when regulators, customers, or partners ask hard questions.

In the “Governance, Regulation & Public Trust” series, the theme is consistent: institutions and businesses earn trust by showing their working. In data protection, “showing your working” means documentation, decisions, and controls that match how your systems really behave.

The Imgur fine is also a reminder that regulators will look at:

• how long the issue persisted (here, years)
• how many people could be affected
• the severity of harm (children + harmful content + profiling)
• whether you did a DPIA and acted on it

SMEs often assume enforcement is only for giants. That’s not the point. The point is: if you grow, raise funding, partner with bigger brands, or sell into regulated sectors, your governance will be scrutinised.

“People also ask” (quick answers for busy owners)

Do UK SMEs need to follow the Children’s Code?

Yes, if your online service is likely to be accessed by under-18s. You can apply those protections to everyone or use age assurance to tailor experiences.

What counts as age assurance?

Age assurance can include age gates, estimation, or other proportionate methods. The standard is appropriateness and robustness for the risk, not a one-size-fits-all method.

If we don’t target kids, are we safe?

Not automatically. The test is likely to be accessed, not intended audience.

Do we need a DPIA for AI tools?

If the processing is likely to result in a high risk to people’s rights and freedoms—common with profiling, large-scale tracking, or children’s data—you should do one.

What I’d do this week if you’re using AI in marketing or support

Answer first: Start with data minimisation and defaults, then document decisions. Most SME compliance wins come from reducing what you collect and switching off unnecessary profiling.

A realistic 5-step plan:

1. Inventory your AI tools (marketing, chat, CRM, analytics, ads).
2. Switch off anything you don’t need: sensitive intent capture, aggressive retargeting, long retention.
3. Add an age-risk check to every new campaign: “Could a teen reasonably join this funnel?”
4. Create a one-page DPIA-lite for each high-impact tool.
5. Update your privacy notice and cookie settings so they reflect reality, not intention.

The most useful mindset shift is simple: treat AI features like you’d treat payroll or payment processing. You don’t “try your best” with them—you set controls, test them, and keep evidence.

The ICO’s £247,590 Imgur penalty is about children’s data, but the lesson is bigger: if your systems can’t tell who they’re dealing with, you have to assume the highest-risk user could be in the room. What you do next determines whether customers trust you—or avoid you.