FTC fines Epic Games $520M for violating child privacy laws

The Federal Trade Commission (FTC) announced today it has entered into an agreement with Epic Games for the latter to pay fines amounting to $520 million. According to the FTC, Epic incurred this penalty by violating the Children’s Online Privacy Protection Act (COPPA) within Fortnite. More specifically, it alleged that Epic used invasive default settings to trick young players into making unintentional purchases.

Of the fines, $275 million is a monetary penalty Epic must pay for breaking COPPA. It’s the largest penalty of its type that anybody has paid the FTC. Epic must also pay $245 million in refunds to consumers for “its dark patterns and billing practices” (the FTC’s words). This also sets a record, as it’s the largest refund ordered by the FTC.

In the FTC’s decision, it says that Epic failed to obtain verifiable parental consent, even though it was aware that children played Fortnite. It also made it difficult for parents to ask Epic to delete their children’s data. Epic Game’s default settings when the complaint was filed also had text and voice chat functions on unless users specifically turned them off. This left children who played the game vulnerable, especially when they were matched with strangers who bullied, harassed and threatened them.

The FTC also says that Epic used “dark patterns” and confusing user interfaces to trick players into making unintended purchases. It also charged account holders without authorization (meaning parents whose children racked up credit card charges without their consent) and blocked the accounts of users who disputed the charges.

In addition to the fines, the FTC proposed an order that would prohibit Epic from enabling voice and text chat for children and teens without parental consent. Another order prohibits the publisher from using the aforementioned “dark patterns” to enable unauthorized purchases.

FTC’s and Epic’s responses

Epic Games responded to the ruling in a blog post, stating, “The laws have not changed, but their application has evolved and long-standing industry practices are no longer enough. We accepted this agreement because we want Epic to be at the forefront of consumer protection and provide the best experience for our players. Over the past few years, we’ve been making changes to ensure our ecosystem meets the expectations of our players and regulators, which we hope will be a helpful guide for others in our industry.”

Epic listed all the changes it’s made to Fortnite since the game went live which will prevent the issues for which it’s paying the fines. It points to its recent implementation of Cabined Accounts, essentially protected accounts for young players, as well as less invasive default settings. It adds that it no longer partakes in “dark practices” such as saving payment info by default.

Epic Games is also currently locked in a legal battle with Apple over how the latter splits costs in its App Store. Apple also paid FTC fines in 2014 for allowing children to make purchases without obtaining parental consent.

FTC Chair Lina M. Khan said in a statement, “Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”

Epic is not the only tech entity on the FTC’s radar. The Commission is currently investigating Microsoft’s acquisition of Activision Blizzard. It’s expressed doubt over whether the acquisition would have negative effects on Microsoft’s competition, a doubt also expressed by the UK’s Competition and Markets Authority. The FTC sued to block the acquisition, and the case is still developing.