Xbox will pay $20 million for improper storage of children’s data

The FTC noted that until the end of 2021, when a user under the age of 13 created a Microsoft account, the company requested certain personal information before asking the parent to accompany the creation process, however, Microsoft retained that data even “for years” even if the creation was not finished, which is prohibited by law.

“Unfortunately, we fell short of customer expectations and are committed to complying with the order by continuing to enhance our security measures,” said Dave McCarthy, Xbox CVP.

McCarthy stressed that the company had not removed that information from the creation of the accounts due to a “technical failure”, but now that error has been fixed, in addition to the fact that “they were never used, shared or monetized”.

“We believe that we can and must do more and we will remain steadfast in our commitment to the security, privacy and protection of our community,” the executive wrote in a statement.

This is not the first time the FTC has settled with a video game company over alleged violations of the Children’s Online Privacy Protection Act.

As recently as December 2022, Fortnite developer Epic Games reached a $275 million settlement for violations of the law through video games like Fortnite, Rocket League, and Fall Guys.

It is worth mentioning that in addition to this fine, the FTC continues to investigate Microsoft’s possible purchase of Activision Blizzard for $69 billion. A couple of weeks ago, the chair of the FTC, Lina Khan, denied having an agreement or influence on the Commission of Authority and Competition of the United Kingdom to block the purchase.

Although various regulatory bodies have approved the purchase, the UK CMA rejected it, which hampers the purchase process, while the FTC has not given a decisive position on the matter and they have the last word.