Microsoft must pay $20 million to end a lawsuit brought by the US Consumer Protection Agency for the company’s collection of minors’ personal data without parental consent.
The FTC said in a statement published Monday that it accuses Microsoft of collecting, between 2015 and 2020, the personal data of children and adolescents under the age of 13 registered on the online gaming platform of the Xbox console, without informing parents, and keeping it.
In order to create an account, the user is required to provide a name, surname, email address, and date of birth.
The FTC noted that Microsoft “violated the law” on the Protection of Children’s Online Privacy (COPA).
“The decision we propose allows parents to protect the privacy of their children’s data on Xbox and limits the information Microsoft can collect and retain about minors,” the statement quoted committee chair Samuel Levine as saying.
“This action would also make it clear that avatars, biometric data and information about children’s health are not exempt” from the Minors Privacy Act, he added.
A federal court must approve the decision for it to take effect.
“Microsoft will need to take several actions to further protect the privacy of children who use its Xbox platform,” the FTC said in its statement.
Under the Children’s Online Privacy Protection Act, online services and websites intended for children under the age of 13 are required to inform parents of personal information they collect and obtain parental consent.
A Microsoft spokesperson told AFP that Xbox will “comply with the agency’s order” and develop a new identity and age verification process to deliver age-appropriate experiences.
