FTC Fines Microsoft $20 Million for Collecting Children’s Personal Data

The Federal Trade Commission (FTC) has imposed a $20 million fine on Microsoft for violating the Children’s Online Privacy Protection Act (COPPA). The regulatory action stems from findings that the company illegally collected and retained personal data from children under the age of 13 who used the Xbox platform. Between 2015 and 2020, Microsoft failed to obtain necessary parental consent during the account creation process and retained data even when parents did not complete the registration.

The investigation revealed that until late 2021, Microsoft required children to provide phone numbers and agree to service and advertising policies. Furthermore, until 2019, the company utilized pre-checked boxes that enabled the sharing of user data with advertisers and the distribution of promotional content. Microsoft attributed these practices to a technical glitch, asserting that the data was never monetized or shared, and has since implemented fixes to prevent recurrence.

Beyond the financial penalty, the settlement mandates significant operational changes for Microsoft. The company must now improve its age-validation systems, delete personal data collected from children within two weeks if parental consent is not obtained, and ensure that any data retained is only kept for as long as necessary. Additionally, Microsoft is required to notify third-party game publishers when it shares children’s data, ensuring those partners also adhere to COPPA compliance standards. This enforcement action highlights ongoing regulatory scrutiny regarding data privacy in the gaming industry, following similar high-profile actions against other major publishers.