US FTC fines Fortnite-maker Epic half a billion dollars
Company deliberately hid important privacy controls
A pair of unanimous 4-0 decisions have seen Epic Games, the creator of Fortnite, charged $520 million for violating children's privacy and tricking customers into making unwanted purchases.
Epic will pay the USA's Federal Trade Commission (FTC) $275 million for violating the Children's Online Privacy Protection Act (COPPA), and another $245 million for fooling users. The latter payment will go towards refunds.
Both settlements are record-breakers, the regulator says. The $275 million payment in particular is the largest monetary penalty ever obtained for violating an FTC rule, and the $245 million is the largest refund ever recorded in a gaming case.
As well as the charge for violating COPPA, Epic will have to change its privacy settings for children and teenagers, turning off both voice and text communication by default.
"As our complaints note, Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children," said FTC Chair Lina M. Khan. "Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices."
Associate Attorney General Vanita Gupta said the proposed ruling "sends a message" to online providers that collecting children's personal information without parental permission is not allowed.
The FTC has ruled that Epic violated COPPA by collecting information from children under 13 and failed to obtain consent from parents. It also required parents who asked for their children's personal information be deleted to jump through 'unreasonable' hoops, and sometimes failed to honour such requests.
The regulator also noted that, by having voice and text chat on be default, 'children and teens have been bullied, threatened, harassed, and exposed to dangerous and psychologically traumatising issues such as suicide while on Fortnite.'
Epic employees registered their concerns about children's use of voice and text chat in Fortnite as far back as 2017, but the company resisted any attempt to change its default settings. While it did eventually add a button to turn off voice chat, the complaint judges that the developer 'made it difficult for users to find'.
As well as turning off chat functionality by default for younger users, Epic must also now delete personal information it had previously collected from those users, unless it obtains parental consent or the user identifies as 13 or older through a neutral age gate. In addition, Epic must establish a comprehensive privacy programme that addresses the problems identified in the complaint, and obtain regular, independent audits.
Confusing UI tricked players into spending money
In a separate complaint, the FTC alleges that Epic used dark patterns to trick users into making unwanted purchases. The regulator says, 'Fortnite's counterintuitive, inconsistent, and confusing button configuration led players to incur unwanted charges based on the press of a single button.' Examples include players purchasing items simply by waking the game from sleep mode, while in a loading screen, or while attempting to preview an item.
These design elements led to 'hundreds of millions of dollars' in unauthorised charges for consumers, and the FTC alleges that Epic locked accounts belonging to customers who disputed the charges - spending the money but losing access to any and all purchased content.
'Even when Epic agreed to unlock an account, consumers were warned that they could be banned for life if they disputed any future charges.'
According to the FTC, Epic ignored more than a million complaints about the issue, and in fact made cancel and refund features even more difficult to find.
As well as the $245 million settlement, the FTC's proposed order suggests Epic will be banned from charging users through the use of dark patterns (Editor's note: There is no quantifiable metric to determine use of dark patterns - it's largely a subjective judgement call), or from otherwise charging users without specific affirmative consent. It may also not block access to accounts for disputing unauthorised charges.
In response to the ruling, Epic said:
'The old status quo for in-game commerce and privacy has changed, and many developer practices should be reconsidered.
'We share the underlying principles of fairness, transparency and privacy that the FTC enforces, and the practices referenced in the FTC's complaints are not how Fortnite operates. We will continue to be upfront about what players can expect when making purchases, ensure cancellations and refunds are simple, and build safeguards that help keep our ecosystem safe and fun for audiences of all ages.'
Epic is still battling Apple and Google in court over their stranglehold on in-app purchases: a monopoly that could soon be broken, at least in Europe, through the Digital Markets Act.