The FTC announced Monday that Microsoft (MSFT.O) will pay $20 million to settle U.S. Federal Trade Commission (FTC) claims that it illegally gathered children’s personal information without parental authorization.
The FTC stated that the company violated the U.S. Children’s Online Privacy Protection Act (COPPA) by collecting and retaining personal information from children who signed up for its Xbox gaming system without their parent’s consent.
Microsoft must improve Xbox privacy for children under the order. In addition, the FTC said it would apply COPPA to third-party gaming publishers with whom Microsoft exchanges children’s data.
Microsoft pledged to follow the order. The representative said the company’s data retention problem and account creation process will be fixed.
“Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information Microsoft can collect and retain about kids,” said FTC Bureau of Consumer Protection director Samuel Levine.
“This action should also make it abundantly clear that kids’ avatars, biometric data, and health information are not exempt from COPPA,” Levine added.
Online services and websites for children under 13 must tell parents about the personal information they collect and seek verifiable parental agreement before collecting and using any personal information.
According to the complaint, Microsoft kept children’s account creation data from 2015 until 2020, even if parents didn’t finish.