Epic Games will issue the largest customer refund in history in connection with unwanted charges in Fortnite — $245 million — and pay a record penalty of $275 million for alleged violations of the Children’s Online Privacy Protection Act.
“Epic put children and teens at risk through its lax privacy practices, and cost consumers millions in illegal charges through its use of dark patterns,” said FTC consumer protection bureau director Samuel Levine in a Monday announcement. “Under the proposed orders announced today, the company will be required to change its default settings, return millions to consumers, and pay a record-breaking penalty for its privacy abuses.”
In its complaint, the FTC alleges that Epic put children and teens in harmful situations by allowing them to interact with adult strangers online without requiring parental consent, which is required under COPPA. And the FTC says Epic employees began flagging problematic default settings as early as 2017.
“Epic’s matchmaking children and teens with strangers while broadcasting players’ account names and imposing live on-by-default voice and text communications has caused substantial injury,” states the complaint. “Children and teens have been bullied, threatened, and harassed within Fortnite, including sexually. Children and teens have also been exposed to dangerous and psychologically traumatizing issues, such as suicide and self-harm, through Fortnite. And the few relevant privacy and parental controls Epic has introduced over time have not meaningfully alleviated these harms or empowered players to avoid them.”
FTC commissioner Christine Wilson issued a concurring statement emphasizing the dangers of ignoring children’s privacy issues when it comes to online gaming. She shared three examples of real underage users involving child pornography and sexual abuse and said she hopes it is “a wake-up call to skeptics who believe that invasions of privacy lead merely to targeted advertising.”
Epic published a lengthy post on its website addressing the allegations and settlement.
“No developer creates a game with the intention of ending up here,” it reads. “The video game industry is a place of fast-moving innovation, where player expectations are high and new ideas are paramount. Statutes written decades ago don’t specify how gaming ecosystems should operate. The laws have not changed, but their application has evolved and long-standing industry practices are no longer enough. We accepted this agreement because we want Epic to be at the forefront of consumer protection and provide the best experience for our players.”
The company also says that the gaming industry needs to make it standard practice to assume that kids are playing games above their age rating: “Fortnite is rated Teen and is directed at an older teen and college-aged audience. We recently rolled out Cabined Accounts, a new type of Epic account that provides a tailored experience that is safe and inclusive for younger players. Players under 13, or their country’s age of digital consent, whichever is higher, will be able to play Fortnite while they wait for parental consent, but in a tailored environment where certain features, such as chat and purchasing, are disabled.”
In addition to the monetary penalty, Epic will be barred from enabling voice and text communications for children and teens unless parents give affirmative consent, and the company will have to delete any personal information it has previously connected through Fortnite in violation of COPPA rules unless it gets parental consent to retain it.
“Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children,” said FTC Chair Lina M. Khan in a Monday statement. “Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission.”
With regard to the game maker’s charging and billing practices, the FTC claims Epic “deployed design tricks, known as dark patterns, to dupe millions of players into making unintentional purchases” and “let children rack up unauthorized charges without any parental involvement.”
Epic notes that “games should go above and beyond to make sure players even more clearly understand when they are making a purchase with real money or with virtual currencies to prevent accidental purchases.”
The $245 million Epic pays in that part of the settlement will go toward user refunds. The FTC has created a page with details about eligibility and the refund process for users whose children made unauthorized purchases between January 2017 and November 2018 and others who were charged in-game currency or had accounts locked after disputing unauthorized charges with their credit companies.
