Microsoft has agreed to pay $20 million in a settlement with US federal regulators after it was discovered that the company had illegally collected data on children who created Xbox accounts. The settlement, reached with the Federal Trade Commission (FTC) on Monday, includes enhanced protections for child gamers.
The FTC found that Microsoft had violated the Children’s Online Privacy Protection Act by failing to obtain proper parental consent and retaining personal data on children under the age of 13 for longer than necessary. The law requires online services directed towards children to obtain parental consent and inform parents about the collection of personal data on their child.
Microsoft’s Xbox platform requires users to create accounts to access certain services, resulting in the collection of information such as full names, email addresses, and dates of birth during the setup process. However, the company failed to promptly seek parental consent, waiting until after obtaining personal information such as a child’s phone number.
The FTC stated that Microsoft had retained data from the account setup, even when parents failed to complete the process, sometimes for years between 2015 and 2020. Furthermore, the company neglected to inform parents about the full extent of data being collected, including profile pictures and the distribution of data to third parties.
Company’s commitment to improving safety measures
In response to the settlement, Microsoft’s Dave McCarthy, CVP of Xbox Player Services, expressed regret for not meeting customer expectations and affirmed the company’s commitment to improving safety measures and complying with the order.
As part of the settlement, Microsoft is required to implement new safety protections for children. This includes the establishment of a system to delete all personal data after two weeks if parental consent is not obtained. The settlement is subject to approval by a federal judge before it can be enforced.
This development follows a similar action taken against Amazon last week regarding its Echo devices. The FTC found that Amazon had also retained sensitive data, including voice recordings of children, for an extended period, resulting in a $25 million settlement. Additionally, Amazon’s doorbell camera unit, Ring, agreed to pay $5.8 million for granting employees unrestricted access to customer data.