Microsoft, the US software company, has agreed to pay a $20 million (CZK 439 million) fine in the United States after being found guilty of collecting personal information about children without parental consent. The Federal Trade Commission (FTC) announced the settlement on Monday, as it has jurisdiction over such cases.
The charges against Microsoft revolved around its violation of the US Children’s Online Privacy Protection Act (COPPA). The company collected personal information from children who signed up for its Xbox gaming system without informing their parents or obtaining their consent. Additionally, Microsoft stored the collected personal data, which further raised concerns for the authorities.
As part of the settlement, the FTC is requiring Microsoft to take steps to enhance the privacy of child users on its Xbox gaming system. This includes extending COPPA protections to third-party game publishers with whom Microsoft shares children’s data. A Microsoft spokesperson confirmed their commitment to complying with the order, stating that they will update the account creation process and address any data retention errors identified in the system.
Samuel Levine, the director of the FTC’s Bureau of Consumer Protection, explained that the proposed order aims to facilitate parental protection of their children’s privacy on Xbox while limiting the information Microsoft can collect and retain about children. He emphasized that children’s avatars, biometric data, and medical information should not be exempt from COPPA regulations.
Under the law, online services and websites directed at children under 13 must inform parents about the personal information they collect. Verifiable parental consent is required before collecting and utilizing any personal information from children. The complaint revealed that between 2015 and 2020, Microsoft retained data collected from children during the account creation process, even if the parent did not complete the process.
