Microsoft settles alleged violations of children’s privacy

Microsoft agreed to pay a $20 million civil penalty to settle children’s privacy transgressions alleged by the Federal Trade Commission, the Justice Department announced Monday.

The purported violations were connected to the Xbox Live accounts of children. Xbox Live is the online multiplayer and digital media platform owned by Microsoft, available for use on the company’s Xbox game consoles as well as PCs.

The software giant is accused of collecting personal information of juvenile users before notifying their parents about the data-gathering. That happened while knowing that certain Xbox Live accounts belonged to kids.

When Microsoft sent notices to parents, they were incomplete, the FTC alleged.

The notices failed to disclose that more information, such as the child’s photo and data associated with the account’s ID, would be collected after parental consent was provided.

In addition, Microsoft is accused of retaining information of child users who started to create an account but did not finish the process. That retention was longer than is permitted by the Children’s Online Privacy Protection Act.

In addition to the $20 million civil penalty, Microsoft must inform parents that creating a separate Xbox Live account for their kids will have additional privacy protections by default.

If Microsoft shares the information of juvenile users with other companies, those companies will have to be informed that the information comes from a child.

“Our order makes it easier for parents to protect their children’s privacy on Xbox and limits what information Microsoft can collect and retain about kids. This action should also make it abundantly clear that kids’ avatars, biometric data and health information are not exempt from COPPA,” FTC Bureau of Consumer Protection Director Samuel Levine said in a statement.

Microsoft neither admitted nor denied the claims made by the FTC, except for what admissions were needed to establish jurisdiction for the FTC order.

“I commend Microsoft for quickly acknowledging it was illegally collecting and retaining personal data of children younger than 13, and for taking steps to fix the problem,” U.S. Attorney for the Western District of Washington Nick Brown said in a statement.