Tech giant Microsoft has agreed to pay a multi-million dollar settlement to the U.S. Federal Trade Commission (FTC) for illegally collecting children’s personal information without parental consent.
The FTC charged Microsoft for collecting private info from children who signed up for its Xbox gaming system without following COPPA rules while also illegally retaining such data.
“Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information Microsoft can collect and retain about kids,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection.
“This action should also make it abundantly clear that kids’ avatars, biometric data, and health information are not exempt from COPPA.”
In addition to the $20 million monetary penalty, Microsoft is also required to take several steps to boost privacy protections for child users of its Xbox systems.
As part of this, Microsoft has to obtain parental consent for accounts created before May 2021 in case the account holder is still a child.
The company must also notify game publishers while disclosing personal information from children that the user is still a child so that the publishers can apply COPPA protections to such accounts.
Collecting Children’s Data
Microsoft’s Xbox gaming products allow users to play and chat with other users through the Xbox Live service. Users are first required to create an account to access and play games on an Xbox console. This includes providing personal details like first name, last name, email address, and date of birth.According to the FTC press release, even when users stated they were under 13, the service still asked to provide additional personal information like a phone number until late 2021. In addition, users were also required to agree to the company’s service agreement and advertising policy. Until 2019, this included allowing Microsoft to send promotional messages and share user data with advertisers.
Only after all this information was provided did Microsoft indicate users below the age of 13 to notify their parents. The parents then had to complete an account creation process so that the child could get an account.
Between 2015 and 2020, Microsoft is said to have retained data it collected from children during their account creation process, even when parents failed to create their accounts. COPPA rules prohibit the retention of children’s data once the purpose for which it was collected has been fulfilled.
Protecting Children Online
Microsoft has previously been criticized for not doing enough to protect children online. In December, Australia’s e-Safety Commissioner Julie Inman Grant revealed that the agency had sent legal demands to major tech firms, including Microsoft, requesting that they provide details about how they tackle the issue of child abuse content and grooming.Per the commissioner, responses from Microsoft showed that the company failed to proactively detect such material in their storage and streaming services—iCloud and OneDrive. This happened even though Microsoft’s PhotoDNA detection technology is widely available, Grant said.
