Microsoft Charged $20 Million by FTC Over ‘Illegally Collected’ Children’s Information on Xbox

Microsoft will pay $20 million in fines after settling a legal dispute with the Federal Trade Commission (FTC) in which it was found to have breached data protection laws by collecting and holding information on children using Xbox without proper parental consent.

The complaint said Microsoft had breached the provisions laid out in the Children’s Online Privacy Protection Act (COPPA). The law stipulates that online service providers must notify parents of their intentions and seek consent before they can collect and use the personal data of children under the age of 13.

According to an FTC press release, children were able to create an account to use Xbox services by entering details including their first and last names, email addresses, dates of birth, and even their mobile numbers (up until late 2021) into the online form.

FTC will require Microsoft to pay $20 million over charges it illegally collected personal information from children who signed up for its Xbox gaming system without their parents’ consent: https://t.co/kgm0wFp2zG /1 #privacy

— FTC (@FTC) June 5, 2023

Only once all of the information had been entered were the minors asked to involve their parents, who would then go on to complete the form, and create the account.

However, between 2015 and 2020 Microsoft was found to have retained information on children in instances where the parent did not complete the creation process, and therefore did not consent to data collection. In certain instances, this information was held for years, despite the COPPA maintaining a provision that such data must be retained for no longer “than is reasonably necessary to fulfil the purpose for which it was collected”.

The complaint also said Microsoft combined the Gamertags and avatars of children under 13 with the unique persistent identifier created for all such accounts, and could share this information with third party app or game developers.

In an Xbox Wire post, Microsoft attributed the lengthy data retention to a “technical glitch” while noting that it was company policy to save such information for a period of 14 days. The issue has since been “fixed” and Microsoft assured players that the data in question “was never used, shared, or monetized”. 

“Regrettably, we did not meet customer expectations and are committed to complying with the order to continue improving upon our safety measures.”

Alongside the $20 million fine, the proposed settlement will require Microsoft to implement numerous changes as to how it handles user information and creates player accounts.

“Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information Microsoft can collect and retain about kids,” commented director of the FTC’s Bureau of Consumer Protection Samuel Levine. “This action should also make it abundantly clear that kids’ avatars, biometric data, and health information are not exempt from COPPA.”

Microsoft account creation now requires the user to input their date of birth first, and, if they are under 13, obtain “verified parental consent” before further information is entered. Furthermore, all account holders under the age of 13 who made an account before May 2021 will need to get a parent to re-verify parental consent.

“We recently entered into a settlement with the U.S. Federal Trade Commission to update our account creation process and resolve a data retention glitch found in our system,” read the Xbox Wire post. “Regrettably, we did not meet customer expectations and are committed to complying with the order to continue improving upon our safety measures.”

The data complaint isn’t the only story involving Microsoft and the FTC. The multi-trillion dollar company is currently gearing up for yet another legal tussle with the regulator after it revealed in December 2022 that it would challenge Microsoft’s proposed $69 billion merger with Activision-Blizzard. Preliminary hearings for that case are set to begin in August later this year. 

Anthony is a freelance contributor covering science and video gaming news for IGN. He has over eight years experience of covering breaking developments in multiple scientific fields and absolutely no time for your shenanigans. Follow him on Twitter @BeardConGamer