Microsoft has agreed that it will pay the Federal Trade Commission 20 million dollars for not properly informing parents and collecting personal data on Xbox players under 13 years old.
Microsoft, the owner of the Xbox video game console series, has said it is “committed to complying” with the court order. The settlement, announced on Monday, must be approved by the federal court in order to take effect.
Xbox encourages all players to create a Microsoft “gamertag” account in order to play online. When players sign up, the company collects their email addresses as well as their first and last name and birthday.
According to, the FTC, Microsoft has stored data from 2015 to 2020 about 10 million people including children who created accounts but did not complete the process.
There are few regulations in the United States that protect digital privacy. The Children’s Online Privacy Protection Rule requires that for-profit companies notify parents before they store information about children younger than thirteen longer than is necessary. They also give them the option to stop the information being shared.
Microsoft offers an account type for children under 13 years old that requires parental consent. In the years when the FTC claims that Microsoft violated its order, it only asked players younger than 13 to obtain their parents’ permission after they entered the other information. The agency stated that if a child did not complete the sign-up, then the company would store the data for as long as they wanted.
Microsoft’s spokesperson confirmed that this issue was not intentional and called the data storage glitch “found in our system” the cause. The company is currently working on a system to verify age and identify users.
Microsoft didn’t make it clear whether they advertised to kids who hadn’t finished setting up their account. The spokesperson did not respond to any questions regarding this practice. The gamertag signup form had pre-checked boxes stating that users accepted promotional offers, and Microsoft Advertising could use their account data.
