Microsoft fined $20 million for mishandling children's Xbox account data

Microsoft has reached a $20 million settlement with the Federal Trade Commission (FTC) following allegations that the company violated the Children's Online Privacy Protection Act (COPPA) by improperly storing data on attempted Xbox account signups.

According to the FTC, Microsoft retained personal information of children for longer than permitted under COPPA regulations.

As part of the settlement, Microsoft will be required to implement several changes outlined in a proposed order filed by the Department of Justice (DOJ) on behalf of the FTC. These changes include informing parents about additional privacy protections for child accounts, obtaining parental consent for child accounts created before 2021, developing systems to delete unnecessary data required for parental consent, and notifying other publishers when disclosing personal information from children.

This settlement is the latest in a series of FTC actions against video game companies for alleged violations of COPPA. In December 2022, Epic Games, the developer of Fortnite, agreed to a $520 million settlement with the FTC, with a significant portion allocated to COPPA violations. Following this, Epic introduced for-kids accounts for its games.