The FTC fined Xbox $20 million for illegally collecting data from children under 13 years old without parental consent, which the agency says is a violation of the Children’s Online Privacy Protection Act (COPPA). Xbox users are required to register an account before they can play games on their console, and until 2021, the process involves providing the user’s full name, a date of birth, and an email address. Xbox notifies users under 13 to get parental consent before continuing – but only after receiving and storing their personal information.
The registration process also asked users under 13 to provide phone numbers and consent to sharing their data. The FTC said the U.S. Department of Justice filed a complaint with similar allegations.
“Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information Microsoft can collect and retain about kids,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement. “This action should also make it abundantly clear that kids’ avatars, biometric data, and health information are not exempt from COPPA.”
The FTC also found that Microsoft retained children’s data for longer than necessary, even when a parent didn’t complete the registration process.
In addition to the $20 million fine, the FTC ordered Microsoft to change its privacy policies and extend COPPA protections to the data it shares with third-party publishers.
A federal court must approve the order before it goes into effect. However, Microsoft already issued a statement outlining some changes Xbox has already made in compliance with the FTC’s orders, which include asking a user’s age before they input their name and contact information. Microsoft also said it never shared or sold any of the data collected.
The FTC fined Fortnite maker Epic Games $550 million in December 2022 for violating COPPA and “tricking” children into making purchases in the in-game store.
The FTC’s lawsuit against Microsoft over its acquisition of Activision Blizzard remains ongoing, with evidentiary hearings expected to begin in August 2023.
Written by Josh Broadwell on behalf of GLHF
