Microsoft agrees to pay $20 million to FTC for illegal data

In a settlement with the U.S. Federal Trade Commission (FTC), Microsoft has agreed to pay a $20 million fine for unlawfully collecting personal information from children without parental consent. The FTC accused the tech company of violating the Children's Online Privacy Protection Act (COPPA) by gathering data from children who signed up for its Xbox gaming system without notifying or obtaining consent from their parents. The FTC's statement also noted that Microsoft retained children's personal information in violation of COPPA.

Microsoft has yet to respond to the charges as of Monday evening. As part of the settlement, the company is required to implement measures to enhance privacy protections for child users of its Xbox system. The FTC emphasized that COPPA safeguards will now extend to third-party gaming publishers with whom Microsoft shares children's data.

Samuel Levine, Director of the FTC's Bureau of Consumer Protection, stated that the proposed order aims to facilitate parental control over children's privacy on Xbox and limits the information Microsoft can collect and retain about kids. Levine emphasized that avatars, biometric data, and health information pertaining to children are not exempt from COPPA.

Under the law, online platforms and websites targeted at children under 13 must inform parents about the personal information they collect and obtain verifiable parental consent before collecting and using any such data. According to the FTC's complaint, Microsoft retained data collected from children during the account creation process from 2015 to 2020, even when parental completion of the process was not obtained.