Microsoft will pay $20 million to settle allegations by the U.S. Federal Trade Commission that it violated the Children’s Online Privacy Protection Act (COPPA) by improperly collecting and retaining personal information from children on Xbox accounts.
Allegations and scope
The FTC announced on Monday, September 5, that until 2021 users under 13 were required to provide personal information when creating a Microsoft account for Xbox, even before parental consent was obtained. The agency said Microsoft retained that information “for years,” including in cases where account registration was not completed—conduct the FTC says is prohibited under COPPA.
Required changes under the settlement
- Microsoft must notify parents that accounts for children include enhanced privacy protections.
- The company will need to implement systems to securely delete data associated with a child’s account.
- Microsoft must make its data-collection policies clearer when Xbox users are children.
Microsoft’s response
Dave McCarthy, Corporate Vice President of Xbox Player Services at Microsoft, said the company fell short of customer expectations and is committed to complying with the order and improving security measures. In a blog post on the Xbox site, McCarthy added that the company was not failing to delete data because of a persistent technical bug and that the data “were never used, shared, or monetized.”
Related enforcement context
The FTC’s action follows other major COPPA enforcement: in December 2022, Epic Games faced $275 million in penalties for COPPA violations connected to child accounts on Fortnite, Rocket League and Fall Guys.
