Microsoft will pay a fine of $20 million to settle Federal Trade Commission charges that it illegally collected and retained the data of children who signed up to use its Xbox video game console.
The agency charged that Microsoft gathered the data without notifying parents or obtaining their consent, and that it also illegally held onto the data. Those actions violated the Children's Online Privacy Protection Act, which limits data collection on kids under 13, the FTC stated.
Websites and online games and services geared toward children are legally required to obtain parental permission before collecting information for users under the age of 13, according to the FTC. The consumer protection agency says Microsoft's Xbox Live failed to do so.
As part of a settlement, Microsoft agreed to comply with the law to protect children's privacy on Xbox Live and to get parental consent for the personal information it collected from children's accounts created before May 2021. The company also will tell adult Xbox Live users about its privacy settings to protect children.
In a blog post, Microsoft corporate vice president for Xbox Dave McCarthy outlined additional steps the company is now taking to improve its age verification systems and to ensure that parents are involved in the creation of children's accounts for the service. These mostly concern efforts to improve age verification technology and to educate children and parents about privacy issues.
Parents with children who play games on their parents' Xbox Live account can create a separate child account, which provides additional privacy protections, such as limits on how Microsoft shares your child's data and only allowing your child to communicate with friends whom you approve in advance. Privacy settings for children can be reviewed and adjusted on Microsoft's privacy dashboard.
McCarthy also said the company had identified and fixed a technical glitch that failed to delete child accounts in cases where the account creation process never finished. Microsoft policy was to hold that data no longer than 14 days in order to allow players to pick up account creation where they left off if they were interrupted.
The settlement must be approved by a federal court before it can go into effect, the FTC said.
British regulators in April blocked Microsoft's $69 billion deal to buy video game maker Activision Blizzard over worries that the move would stifle competition in the cloud gaming market. The company is now "in search of solutions," Microsoft President Brad Smith said at a tech conference in London Tuesday.
