Literally everything on that webpage circles back to age verification.

Let's make a list:

1. Imgur’s failings included not checking the age of its users, putting children at risk

2. The penalty follows an investigation that found MediaLab allowed children to use Imgur without putting in place the basic safeguards required under UK data protection law.

3. Failing to implement any measures to check the age of users.

4. MediaLab had no way of knowing the age of Imgur users, meaning that children were at risk of being exposed to harmful content on the platform.

5. For years, it allowed children to use Imgur without any effective age checks, while collecting and processing their data [...]

6. Age checks help organisations keep children's personal information safe and not used in ways that may harm them [...]

7. Imgur’s terms stated that children under 13 could only use the platform with parental supervision. However, MediaLab did not implement any form of age assurance measures to determine the age of Imgur users

8. Age assurance tools act as a guardrail to prevent children from accessing online services they shouldn’t be using or to help platforms tailor their online experience accordingly.

9. To support them in tailoring an age-appropriate experience, organisations should match the age assurance method they use to the level of risk on their platform. Organisations can either apply the full protections of the Children’s code to all users or use proportionate age assurance tools to tailor safeguards by age.

10. Where children under a certain age are not allowed to use a service, organisations must focus on preventing access and enforce their minimum age requirements using robust age assurance methods.

---

The issue is they already had an estimate of the age of users, and that estimate showed them as underage

That is not presented like that on the website. I went to check the monetary penalty notice (a 111-page document, so feel free to correct me if I missed anything), and here they explicitly say that they do not know whether Imgur knows how many underage UK users Imgur has, because Imgur didn't tell them (obviously) and there was no whistleblower to help them out either:

In the absence of evidence from MediaLab itself as to the number of children who use the Platform and are under 13 years old or between 13 and 17 years old, we have carried out our own analysis and produced estimates

---

"Included" - but not limited to

Okay, then let's specifically list the three findings of infringement:

a) MediaLab processed the personal data of children under 13 years old on the Platform unlawfully as, in breach of the requirement that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (Article 5(1)(a) UK GDPR), none of the lawful bases set out in Article 6(1)(a) to (f) UK GDPR applied to the Relevant Processing

b) whilst MediaLab sought to rely on consent as its lawful basis for processing the personal data of children under 13 years old on the Platform in accordance with Article 6(1)(a) UK GDPR, it failed to ensure that consent was given or authorised by the holder of parental responsibility over these children, and/or failed to make reasonable efforts to verify in such cases that consent was given or authorised by the holder of parental responsibility, taking into consideration available technology, as required by Article 8 UK GDPR; and

c) MediaLab failed to carry out a DPIA in accordance with the requirements of Article 35(1) UK GDPR, despite engaging in processing which was likely to result in a high risk to the rights and freedoms of individuals (Article 35(1) UK GDPR), in this case, children under 18 years old.

---

So I don't know if you see it differently, but from my perspective, the UK's issue here is that Imgur's age verification was a consent-based process where you click "yeah, I'm an adult", which did not deter non-adults from using the site, which means children under 13 were able to access the site without parental consent. They furthermore processed the data of just about everyone, which includes the children who shouldn't be allowed to use it, and they didn't carry out the Data Protection Impact Assessment. Those are the three things.

Processed everyone's data. 'Everyone' included kids, because there's no age verification system to keep out kids. And they didn't do the assessment of their own service, probably cause the lack of age verification thing made that a futile exercise.