Microsoft has agreed to pay $20 million to settle allegations that it violated the federal children's privacy law by gathering data from Xbox users under the age of 13.
Microsoft "collected personal information from children before notifying parents and obtaining parental consent," the FTC and Department of Justice alleged in a complaint filed Monday in U.S. District Court for the Western District of Washington.
The company also allegedly “failed to tell parents about what information it collected from children, and why, and failed to notify parents that it discloses some of this information to third parties."
The government adds that Microsoft "retained personal information from children longer than necessary, putting children’s data at risk for uses outside parents’ reasonable expectations and for compromise by unauthorized third parties.”
The complaint claims the company violated the Children's Online Privacy Protection Act (COPPA) -- which prohibits online businesses from knowingly collecting personal data from children under 13 without their parents' approval, and requires companies to delete children's data after it is no longer needed.
The alleged violations occurred before 2021, according to the complaint.
Among other specifics, the FTC said Microsoft required Xbox users, including young children, to consent to a service agreement that until 2019 “included a pre-checked box allowing Microsoft to send them promotional messages and to share user data with advertisers.”
“Microsoft asked for all that information even from users who had just told the company they were under 13,” the FTC stated. “Only after gathering that raft of personal data from children did Microsoft get parents involved in the process.”
In addition to the $20 million fine, the proposed settlement requires Microsoft to obtain parental consent for accounts created before May of 2021 if the account holder is still under 13.
The agreement also requires Microsoft to inform video game publishers when it shares children's personal information. That move will require the publishers “to apply COPPA's protections to that child.”