Microsoft’s $20M Fine for Violating Children’s Privacy Laws with Xbox Data Collection

Microsoft Violates COPPA and Settles with FTC

Microsoft has agreed to pay $20 million to settle Federal Trade Commission (FTC) allegations that it unlawfully collected personal information about children who used its Xbox gaming console. The tech giant has been found guilty of violating the Children’s Online Privacy Protection Act (COPPA) that requires parental consent before collecting any information regarding children under 13 years old.

COPPA and its Regulations

The COPPA is a law created to regulate how companies collect and use children’s information online. The act requires companies to get parental consent before collecting, using, or disclosing personal information from children under the age of 13.

The law also prohibits the use or storage of data collected from minors for a longer period than is “reasonably necessary” for the purpose intended. Also, websites directed to children must include a privacy policy detailing the collection, use, and distribution of children’s personal information, as well as a notice informing parents of their rights to review and delete the information.

FTC’s Investigation and Findings

The FTC found that Microsoft violated COPPA from 2013 to 2015 by collecting data on children under 13 without obtaining their parent’s approval. The company had allowed children to create and manage their accounts without parental consent, and these accounts carried personal information like names, email addresses, and dates of birth.

The agency further alleged that Microsoft exposed children to inappropriate materials through celebrity endorsements and in-app purchases. Some of the games directed children to share their personal information with other players without any parental consent or notice.

The Settlement and its Terms

Microsoft agreed to pay $20 million to settle the charges and extend the COPPA protections to third-party game publishers in the Xbox ecosystem, according to the proposed order. The company must also delete all data collected on children without parental consent and retain only the data needed for user accounts. The company must also put in place appropriate procedures for ensuring third parties’ COPPA compliance when they are using the platform’s services to create or target advertisements to children.

The settlement further identifies the information categories covered by COPPA rules, including children’s avatars, biometric data, and health information that are collected from Xbox consoles.

Advice For Parents and Kids

The FTC settlement highlights that companies that fail to comply with the COPPA’s provisions and knowingly expose kids to inappropriate materials through their digital platforms will face significant penalties.

For parents, it’s essential to understand the rules of COPPA and evaluate the privacy policy of any platform or website that your children use. Examine the type of data collected and the means of obtaining parental consent. Also, monitor your kids’ accounts and conversations for indicators of sharing personal information or inappropriate content. Encourage them to inform you of any suspicious materials or communication.

For kids, make sure to obtain parental consent and do not share or provide personal information on online platforms without their approval and presence. Always report inappropriate content or communication to parents or guardians.

Editorial

The Microsoft settlement with FTC highlights the importance of consistent monitoring and enforcement of privacy regulations, especially when kids are involved. Companies should prioritize user privacy and transparency in their operations to gain customer trust and avoid legal actions and damages.

The COPPA rules that have been violated should further underscore the importance of parents being proactive in monitoring the games and apps their children play. It is vital for parents to be aware of the games and apps their children are playing, ensure they are age-appropriate and with the consent of parents. The settlement also highlights the need for age verification tools to limit the possibilities of children accessing platforms’ content and features that aren’t appropriate for their age.