Fortnite maker Epic Games has to pay $520 million for spying on kids in FTC settlement

While your kids were playing Fortnite, Fortnite was playing with consumer protection laws.

Epic Games, the maker of the very popular Fortnite series, is paying two of the largest settlements in Federal Trade Commission (FTC) history over children’s privacy violations and “dark patterns” that intentionally tricked users into making purchases through manipulative design.

The settlements, announced on Monday, require Epic to pay a total of $520 million for the two consumer protection issues: $275 million for the privacy violations and $245 million for making it easy for consumers to purchase items accidentally and very difficult for them to cancel or refund those purchases. That money will be refunded to consumers; it’s the largest refund amount in a gaming case as well as the largest administrative order in FTC history. The $275 million penalty is the largest ever for violations of the Children’s Online Privacy Protection Act, or COPPA (the previous FTC record of $136 million was held by Google over YouTube videos aimed at children).

“Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices,” FTC chair Lina Khan said in a statement.

While the FTC is better known these days for its aggressive attitude toward antitrust regulations under chair Khan, it also enforces consumer protection laws. These settlements show it’s not letting that mandate lapse, nor is it afraid to go after industry leaders.

The FTC has been looking into dark patterns since before Khan got there, with then-acting chair Rebecca Kelly Slaughter holding a dark patterns workshop in April 2021. Alvaro Bedoya, who was finally confirmed as an agency commissioner in May after months of delays, was a privacy advocate who has been especially vocal about children’s privacy before and since coming to the FTC.

COPPA requires companies to get the consent of the guardians of children under 13 before their data can be collected online and to delete those children’s data upon request. Though Epic knew children were playing Fortnite, the FTC says, it did nothing to get their parents’ consent, nor did it properly honor data deletion requests.

Epic is also accused of harming children by having text and voice chats on by default in Fortnite, which subjected them to bullying, harassment, and threats. Epic eventually added a way to turn voice chat off, but it made that button difficult to find.

Sen. Ed Markey (D-MA), who was one of the authors of COPPA, was pleased with the FTC’s action, saying in a statement: “An entire generation of young people is being targeted, tracked, and traumatized, as popular platforms rake in profits every day. The FTC made clear today that the gauntlet of predatory practices that threaten young people extends well beyond social media.”

Markey has called for COPPA, which is more than 20 years old, to be updated to reflect today’s internet economy and cover older children as well as those under 13. COPPA remains the only national online consumer privacy law we have due to Congress’s inability to pass anything else.

The second settlement concerns manipulative tactics Epic knowingly, according to the FTC, used to trick its mostly young users into hundreds of millions of dollars of accidental or unauthorized purchases, and then to make it difficult for them to cancel or refund those purchases. Buttons were placed in locations that made it easy for people to tap them without meaning to, while cancel or refund buttons were intentionally made difficult to find. Epic also didn’t get underage users’ parental permission before allowing them to make purchases of Fortnite’s in-game V-Bucks currency.

Finally, the FTC alleges that Epic locked customer accounts completely if they disputed charges, which meant they lost access to all of their purchases, not just the ones they were disagreeing with. Epic also threatened to lock accounts permanently if users disputed charges again. This had a chilling effect on disputes, since users didn’t want to risk losing their entire accounts and the potentially thousands of dollars and hours of time they had poured into them.

In both cases, the FTC claims that Epic knew there were issues because its own employees raised concerns that Epic largely ignored. There were also more than 1 million complaints from consumers over those unauthorized charges.

Epic Games said in a statement that the FTC’s complaints were about past practices that were common in the gaming industry. Basically, it was only doing what everyone else did and it’s not doing those things anymore.

“The old status quo for in-game commerce and privacy has changed, and many developer practices should be reconsidered,” the company said. “We want Epic to be at the forefront of consumer protection and provide the best experience for our players.”

The $275 million privacy penalty goes to the government. The $245 million will be refunded to consumers. If you think that includes you, this FTC link has more information about what to do next.

While the $520 million it will have to pay over violations in Fortnite is a record-setting amount of money, Epic pulls in billions of dollars in revenue every year. Most of that comes from Fortnite.