Microsoft Corporation (NASDAQ:MSFT) will pay $20 million to settle charges that it violated the Children’s Online Privacy Protection Act (COPPA), the Federal Trade Commission said in a statement on its website.
The tech giant was charged with collecting personal information from children who signed up to its Xbox gaming system without notifying their parents or obtaining their parent’s consent, and by illegally retaining children’s personal information.
COPPA requires online services and websites directed to children under 13 to notify parents about the personal information they collect and to obtain verifiable parental consent before collecting and using any personal information collected from children, the FTC said.
Microsoft violated the COPPA Rule’s notice, consent and data retention requirements, the Commission said, citing a complaint also filed by the Department of Justice.
According to the complaint, from 2015 to 2020, Microsoft retained the data that it collected from children during the account creation process, even when a parent failed to complete the process.
As well as the $20 million settlement, the FTC said Microsoft will also be required to take several steps to strengthen the privacy protections for child users of Xbox, with the order extending COPPA protections to third-party gaming publishers with whom Microsoft shares children’s data. Avatars generated by a child’s image, biometric data and health information are also covered by the COPPA regulations, it added.
The order must be approved by a federal court before it can go into effect, the Commission added.
"Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information Microsoft can collect and retain about kids,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection said.
“This action should also make it abundantly clear that kids’ avatars, biometric data, and health information are not exempt from COPPA.”
Following the FTC settlement, Xbox said in a statement that it has updated its account creation process, which now requires players to first identify date-of-birth and, if under 13 years old, obtain verified parental consent before providing it with any information such as phone number or email address.
"This updated process ensures that we can identify potential child accounts immediately and make clear to parents and caregivers the next steps to protect their children’s data and play safely on our network," commented Dave McCarthy, vice president for Xbox player services.
Microsoft's shares were trading around 0.5% lower at $334 by midday Tuesday.
Contact the author at stephen.gunnion@proactiveinvestors.com