Microsoft To Pay $20 Million For Illegally Collecting And Retaining Children's Personal Data

Microsoft will be paying the Federal Trade Commission (FTC) a $20 million settlement for illegally collecting and retaining data on children, who signed up to use their Xbox gaming system.

FTC accused the tech giant of collecting the children's personal information without notifying their parents or obtaining their consent. Microsoft violated the Children's Online Privacy Protection Act (COPPA) as a result of these actions, an FTC statement said Monday.

As per COPPA rules, online services and websites are expected to notify parents about the personal information they collect from children under 13. They must also obtain verifiable parental consent before collecting and using the data, AP News reported.

In order to access and play games on Microsoft's Xbox gaming products, users are expected to create an account by providing information such as their first and last name, email address, and date of birth, the FTC statement said. Children under 13 were also asked for these personal details until late 2021.

The children were asked to provide a phone number, and it was only after this step that the user would be asked to involve a parent. Once the parent completed the account creation process, the child would get their own account.

However, as per a complaint filed by the Department of Justice, Microsoft retained the data collected from children during this process from 2015 to 2020. The data would be retained, sometimes for years, even when a parent failed to complete the process.

"COPPA prohibits retaining personal information about children for longer than is reasonably necessary to fulfill the purpose for which it was collected," the FTA said.

In addition to paying the $20 million fine, Microsoft is also expected to bolster its privacy protections for children using its Xbox system.

"Our proposed order makes it easier for parents to protect their children's privacy on Xbox, and limits what information Microsoft can collect and retain about kids," said Samuel Levine, Director of the FTC's Bureau of Consumer Protection. "This action should also make it abundantly clear that kids' avatars, biometric data, and health information are not exempt from COPPA."

In a blog post, Dave McCarthy, the Microsoft corporate vice president for Xbox, noted down the additional steps the company was taking to improve its age verification systems and to ensure they were not violating the COPPA guidelines of having parents involved in their child's account creation process.

"At Xbox, we have the fundamental commitment to provide all players with a safe and secure experience on our platform – and this is especially true for our youngest players ... We recently entered into a settlement with the U.S. Federal Trade Commission (FTC) to update our account creation process and resolve a data retention glitch found in our system."

McCarthy said the company has updated its account creation process, and added they now require players to first provide their date of birth. And if the user is under 13, they were required to involve their parent before any further information was provided.