Fortnite maker to pay $520M over kids’ privacy and trickery charges

When Epic Games released Fortnite five years ago, the video game quickly became a cultural sensation among millions of teenagers and children. It was easy to sign up and start playing and talking or text chatting with strangers through the game.

Some children also racked up hundreds of dollars on their parents’ credit cards as they bought digital items like colorful outfits for their game characters. Those purchases, along with branded merchandise like action figures, helped make Fortnite a billion-dollar blockbuster for Epic Games, with more than 400 million users.

On Monday morning, the Federal Trade Commission accused the company of illegally collecting children’s personal information and, separately, of using manipulative techniques, called “dark patterns,” to trick millions of players into making unintentional purchases. In a historic deal that puts the entire video game industry on notice, Epic agreed to pay a record $520 million in fines and refunds to settle the FTC’s accusations.

The FTC action comes at a moment of heightened public concern over the mental health, safety and privacy risks that some popular social media networks and multiplayer video games may pose to children and teenagers.

The crackdown is also the latest indication that the agency is following through on pledges by Lina M. Khan, chair of the FTC, to take a more assertive stance toward regulating the tech industry. Earlier this month, the agency made an aggressive move to stop consolidation among video game makers when it filed a lawsuit to try to block Microsoft’s $69 billion acquisition of Activision Blizzard, the company behind the popular Call of Duty franchise.

“Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the commission,” Khan said in a statement Monday about the Fortnite case. “These enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”

Epic Games said in a statement that the company had instituted multiple children’s privacy and purchasing safeguards over the years and that “the practices referenced in the FTC’s complaints are not how Fortnite operates.”

The company’s proposed settlement agreements with the FTC involve record amounts in two separate cases.

Epic agreed to pay $275 million to settle regulators’ accusations that it violated a federal law, the Children’s Online Privacy Protection Act, by collecting personal information from children younger than 13 who played Fortnite without obtaining verifiable consent from a parent.

In addition, the company made parents “jump through hoops” to have their children’s data deleted and sometimes failed to honor parents’ deletion requests, the agency said in a legal complaint filed on Monday in U.S. District Court for the Eastern District of North Carolina, where Epic is based.

The amount dwarfs the $170 million penalty — the previous record for child privacy violations — that Google agreed to pay in 2019 over accusations that it illegally harvested data from children on YouTube and used it to target them with ads.

Regulators and lawmakers around the world are intensifying their scrutiny of the ways popular social networks and video game companies deal with young people. California enacted a sweeping online children’s safety law in September that will require companies to turn on the highest privacy settings for children by default and turn off certain features, like precise location tracking, that might expose them to risk.

That law is scheduled to take effect in 2024. Last week, a tech industry trade group sued the state of California in an effort to block it.

In the privacy complaint filed Monday, the FTC said Epic had caused “substantial” injury to children by enabling live voice and text chats by default, and by matching children and teens with adult strangers to play Fortnite.

Children and teenagers had been “bullied, threatened and harassed within Fortnite, including sexually,” the complaint said, adding that some had also been exposed to traumatizing issues like suicide and self-harm through the game. Although Fortnite introduced some relevant privacy and parental controls over the years, regulators said the changes “have not meaningfully alleviated these harms or empowered players to avoid them.”

As part of the proposed settlement, Epic Games is required to adopt high-privacy default settings for children and teens, including turning off live text and voice chats by default for younger users. The company said it had already done so.

This month, Epic Games said it was introducing a new type of account for young users, called “cabined accounts,” in which features like live chat and in-app purchases are disabled by default. The company said it would default players who indicate they are younger than 13, or the digital age of consent in their countries, to cabined accounts and ask them to provide a parent’s email address before they could gain access to features like live voice chats.

Epic also agreed to pay $245 million to refund consumers over accusations that it used manipulative online practices to trick players of all ages into making unintended purchases. Among other issues, Fortnite’s user interface had a counterintuitive, inconsistent and confusing layout that led users to incur charges with the press of a single button, regulators said in a separate complaint.

Players could be charged while trying to activate the game from sleep mode or while the game was loading a screen, the complaint said. Children ended up racking up charges without their parents’ knowledge. These so-called dark-pattern techniques resulted in hundreds of millions of dollars in unwanted charges for users, the agency said.

In a statement, Epic said that, in a fast-moving video game industry, long-standing industry standards were no longer enough to protect players.

“No developer creates a game with the intention of ending up here,” the company said in a statement. “We accepted this agreement because we want Epic to be at the forefront of consumer protection and provide the best experience for our players.”