The Federal Trade Commission recently ordered Microsoft to pay a $20 million fine for illegally collecting personal information from children without parental consent.
Microsoft has agreed to pay to settle charges that it violated the Children's Online Privacy Protection Act, according to a June 5 news release. The charges say Microsoft collected personal information from children who signed up for its Xbox gaming system without parental consent and illegally retained their information.
“Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information Microsoft can collect and retain about kids,” FTC Bureau of Consumer Protection Director Samuel Levine said in the release.
The Department of Justice, on behalf of the FTC, has filed a proposed order requiring Microsoft to enhance privacy protections for child users of its Xbox system, the release reported. The order will extend COPPA protections to third-party gaming publishers and clarify that avatars, biometric data and health information are covered by the COPPA Rule.
According to the complaint, Microsoft violated COPPA by not notifying parents about the personal information it collected and by failing to obtain verifiable parental consent, the release said. Microsoft's account creation process required users, including those under 13, to provide personal information before involving their parents.
The company also retained data collected from children, sometimes for years, even when the account creation process was not completed by the parent, according to the release. Microsoft combined children's profile information, such as their gamertag and picture, with unique persistent identifiers and shared this information with third-party developers.
In addition to the monetary penalty, the proposed order requires Microsoft to inform parents about the privacy protections available when creating separate accounts for their children, the release said. It also mandates obtaining parental consent for accounts created before May 2021 if the account holder is still a child.
Microsoft must establish systems to delete collected personal information within two weeks if parental consent is not obtained and to notify video game publishers when disclosing personal information from children, the release said. This settlement comes as part of the FTC's efforts to enforce COPPA, with recent actions taken against other companies such as Edmodo and Amazon.
The FTC aims to protect consumers and promote competition, encouraging individuals to report fraud and stay informed about consumer topics on their website, according to the release.
