Microsoft has become the latest major technology company to agree to pay multi-million dollar civil penalties to settle allegations of violations of the Children’s Online Privacy Protection Act (COPPA).
The Federal Trade Commission (FTC) and Department of Justice complaints allege that Microsoft collected personal information from Xbox Live users who they knew were children. It said the tech giant did so before notifying parents of its data collection practices and obtaining parental consent.
For more information on the COPPA lawsuit, see Amazon to pay $31 million following FTC security and privacy complaints.
The complaint also alleges that:
- The notice Microsoft provided to parents was incomplete and did not comply with COPPA regulations
- Microsoft retained personal information about children for longer than allowed by COPPA, even if they initiated but did not complete sign-up for an Xbox Live account.
- Microsoft failed to disclose all collected information to parents, including the child’s profile picture
“This settlement requires Microsoft to communicate clearly with parents about children’s data and to establish procedures to monitor Microsoft’s compliance with federal laws regarding children’s online privacy. It’s safer in the US,” said Nick Brown, a US attorney for the Western District of Washington.
“We commend Microsoft for quickly acknowledging that it illegally collected and held personal data of children under the age of 13 and taking steps to resolve the matter.”
In addition to paying a $20 million penalty, Microsoft will have to take some steps to better protect the privacy of Xbox Live users under the age of 13.
This includes obtaining parental consent for accounts created before May 2021 if the account holder is still a child, and not allowing parents to create separate accounts for their children. , including communicating that doing so will result in additional privacy protections.
Also, when video game publishers disclose personal information from children, they must communicate that the user is a child. That means publishers need to apply COPPA protections to their users.
Editorial image credit: Framalicious / Shutterstock.com
