Microsoft has agreed to pay USD20m as part of a settlement with the U.S. Federal Trade Commission (FTC) after being accused of unlawfully gathering personal information from children without parental consent, as reported by Reuters on June 5. The company was found to have violated the Children’s Online Privacy Protection Act (COPPA) by collecting data from children who registered for its Xbox gaming system without informing or obtaining consent from their parents, as well as retaining the children’s personal information. In response to the settlement, Microsoft will implement measures to enhance privacy protections for child users of the Xbox system and extend COPPA safeguards to third-party gaming publishers with whom it shares children’s data.

A Microsoft spokesperson expressed the company’s commitment to complying with the settlement and outlined plans to update the account creation process and resolve a data retention issue. The FTC’s Bureau of Consumer Protection Director, Samuel Levine, emphasized the aim of the order to provide parents with better tools for safeguarding their children’s privacy on Xbox and to make it clear that COPPA applies to children’s avatars, biometric data, and health information. COPPA mandates that online services and websites targeting children under 13 must inform parents about the collection of personal information and obtain verifiable parental consent before collecting and using such data. According to the complaint, Microsoft retained data collected from children between 2015 and 2020, even when the account creation process was incomplete due to a parent’s non-compliance.

Sources:

https://www.reuters.com/technology/microsoft-pay-20-mln-settle-charges-it-collected-childrens-information-2023-06-05/

https://www.ftc.gov/news-events/news/press-releases/2023/06/ftc-will-require-microsoft-pay-20-million-over-charges-it-illegally-collected-personal-information