Microsoft paid $20M for collecting kids' Xbox data without parental consent

In June 2023, Microsoft agreed to pay $20 million to settle Federal Trade Commission charges that it violated the Children's Online Privacy Protection Act (COPPA) by collecting personal information from children who signed up to its Xbox gaming system without notifying their parents or obtaining their consent.

To create an Xbox account, users had to provide their first and last name, email address and date of birth. Even when a user said they were under 13, Microsoft asked them for additional data such as a phone number and — until 2019 — had a pre-checked box allowing Microsoft to send promotional messages and share data with advertisers.

The FTC charged that, from 2015 to 2020, Microsoft retained this personal information — sometimes for years — even when a parent never completed the account creation process. It also failed to fully disclose all the information it collected, such as a child's profile picture, and combined that data with a persistent identifier that could be shared with third-party game and app developers.

Under the proposed order, Microsoft paid the $20 million, had to delete data it collected from children without keeping it longer than needed, obtain parental consent for accounts opened before May 2021 still held by children, and extend COPPA protections to third-party publishers it shares children's data with. The order also made clear that child avatars, biometric data and health information are covered by COPPA.