On December 19, 2022, the Federal Trade Commission (“FTC”) and the U.S. Department of Justice jointly announced that Epic Games Inc. (“Epic Games”) will pay two record fines, in twin settlements, totaling half a billion dollars. If the settlements are approved by a federal court, Epic Games will pay $275 million in civil penalties for violating the Children’s Online Privacy Protection Act (“COPPA”), in the largest fine ever imposed under COPPA. Epic Games will also pay $245 million in refunds to consumers who made unintended purchases, in the largest administrative order in FTC history. FTC’s announcement signals a more muscular role in policing the online children’s game industry for privacy-invasive practices.

FTC’s First Complaint - Alleged Online Privacy Invasions

Fortnite, released by Epic Games in 2017, is one of the world’s most popular video games with more than 400 million players worldwide.¹ But Epic Games allegedly put those players at risk through its lax privacy practices.² In the FTC’s privacy complaint and proposed settlement against Epic Games, the FTC alleged that Epic Games (i) violated COPPA by failing to notify parents or obtain verifiable consent and (ii) enabled real-time voice and text chat communications for children and teens by default. Below are brief summaries of the allegations.

• Collecting personal data without parental consent: The FTC alleged that Epic Games actively collected children’s names, email addresses, and identifiers that kept track of their progress, purchases, settings, and friends list, without first obtaining parental consent. When parents requested that the company delete their children’s personal information, Epic Games failed to honor such requests or made it unreasonably difficult for parents to take steps to protect their children’s personal information.³ The company also implemented a default privacy setting that automatically broadcasted children’s display names and matched children and teens with strangers—some of whom were adults—to play Fortnite together.
• Setting default voice and text chat communications: Epic Games allegedly chose to enable live on-by-default voice and text chat communications for players. As early as 2017, company employees allegedly urged Epic Games to change the default settings and require players to opt-in to voice and text chat communications, due to the potential harm to children that this practice might impose. However, the company resisted turning off the default settings. Epic Games eventually allowed players to disable the feature, but made it difficult to locate, according to the complaint.⁴

FTC’s Second Administrative Complaint - Alleged “Dark Patterns”

In a separate complaint, FTC alleged Epic Games deceived players of all ages into a phenomenon known as “dark patterns.” The FTC alleged, for example, that Epic Games made it easy for children and teens to purchase online credits for in-game items, such as costumes and dance moves. Yet, the company made it extremely difficult for players to easily cancel accidental charges. Other examples of “dark patterns” included players being charged while trying to wake the game from sleep mode, while the game was loading, or when a player mistakenly pressed a button when simply trying to preview an item.

The FTC alleged that Epic Games would lock accounts of those who disputed unwanted charges and warned them that they could be banned for life if they disputed any future charges. Epic Games allegedly earned hundreds of millions of dollars through “dark patterns” and billing practices. These practices also resulted in more than one million parental complaints according to the FTC’s complaint.

Settlement Terms

If the U.S. District Court for the Eastern District of North Carolina approves the terms of the twin settlements, Epic Games must pay a record penalty in the amount of $275 million for violating COPPA. The company must also refund $245 million to consumers who made unintended purchases. Other terms of the settlement mandate that Epic Games obtain parental consent before the voice and text communications feature is enabled, delete minors’ personal information that it obtained in violation of COPPA, establish a comprehensive privacy program, and obtain regular, independent audits. The agreement will last for 20 years from the time it is approved.

The FTC’s recent announcement stated that “protecting the public, especially children, from online privacy invasions and ‘dark patterns’ is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”⁵

For its part, Epic Games did not confirm or deny the FTC’s allegations, but the company agreed to revise some of its practices, including the creation of features to protect children such as easier-to-access parental controls, a PIN requirement to allow parents to authorize purchases, and a daily spending limit for kids under 13 years of age.⁶ Epic Games stated, “no developer creates a game with the intention of ending up here. Statutes written decades ago don’t specify how gaming ecosystems should operate. We accepted this agreement because we want Epic to be at the forefront of consumer protection and provide the best experience for our players.”⁷

In May 2022, FTC announced stepped up enforcement in the children’s privacy sector and stated that it would “vigorously enforce COPPA.” The FTC’s investigation and record-breaking fines against Epic Games embody and further that objective, with 2023 presumably headed into yet further regulatory challenges for companies active in the “gaming ecosystem.”

¹ Thomas Barrabi, ‘Fortnite’ maker to pay $520M for allegedly tricking kids into making purchases, New York Post (December 19, 2022, 1:27 PM), https://nypost.com/2022/12/19/fortnite-maker-to-pay-520m-for-allegedly-tricking-kids-into-making-purchases/.

² Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars over FTC Allegations of Privacy Violations and Unwanted Charges, https://www.ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations.

³ Id.

⁴ Id.

⁵ Id.

⁶ Epic FTC Settlement and moving beyond long-standing industry practices (December 19, 2022) https://www.epicgames.com/site/en-US/news/epic-ftc-settlement-and-moving-beyond-long-standing-industry-practices.

⁷ Id.