Microsoft to pay $20 million to settle FTC charges violating children’s privacy

Microsoft will pay a $20 million fine to settle Federal Trade Commission allegations that it illegally collected and stored personal information from children without their parents’ consent, the FTC said Monday.

The company’s actions violated the US Children’s Online Privacy Protection Act (COPPA) by collecting data from children – without notifying their parents or obtaining their permission – who signed up for the company’s Xbox gaming system, it said in a statement of the FTC.

The FTC order also requires Microsoft to take steps to strengthen the privacy protections of child users of the Xbox system. The order also extends to third-party game publishers. Microsoft shares the world of children’s data.

“Our proposed order makes it easier for parents to protect their children’s Xbox privacy and limits the information Microsoft can collect and store about children,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement. “This action should also clarify that children’s avatars, biometrics, and health information are not exempt from COPPA.”

Under COPPA, companies are prohibited from collecting data from children under 13 without their parents’ consent, and cannot use collected data about children for commercial purposes such as marketing or advertising. All stored data must be adequately protected against possible theft and companies are not allowed to retain children’s data for longer than necessary.

Microsoft retained data from 2015 to 2020 collected during the account creation process, even when a parent failed to complete the process, according to the complaint.

Microsoft said it is committed to complying with the FTC’s order.

“In addition to our existing multi-pronged safety strategy, we also plan to develop next-generation identity and age validation – a convenient, secure, one-time process for all players that will enable us to provide better personalized, secure, user-friendly age experience,” a Microsoft spokesperson said in a statement.

As companies guard more and more of your personal data, here are CNET’s tips on how to stop Facebook from tracking you, how to prevent yourself from being tracked using your Apple AirTags, and how to get Google to remove your personal data from search results.