FTC reaches record settlement with Epic Games, owner of Fortress Heroes, the latest “battle royale” hit over violations of children’s privacy and use of digital dark modes

Two separate settlements with Epic Games, owner of the popular online game “Fortress Heroes,” send an unmistakable message to businesses: The Federal Trade Commission is stepping up online protections for children and cracking down on consumer spending. Dark Mode is serious about charging fees without the author’s knowledge. Explicit consent. If that’s not enough to get the company’s attention, maybe these numbers will. Epic will pay a record $275 million in civil penalties for allegedly violating the Children’s Online Privacy Protection Act. The company will pay an additional $245 million for allegedly using dark graphics to trick millions of Fortnite players into making unintentional purchases, the largest administrative settlement in the history of the Federal Trade Commission. This article will focus on the FTC’s allegations of COPPA violations and Epic’s choice of default settings that allowed strangers to communicate with children and teenagers under the age of 18. subscriber The business blog will publish a second article soon, which will delve into how the FTC says Epic used design tricks to target Fortnite players with unauthorized payments. You definitely don’t want to miss part two.

First, review the requirements of the COPPA rules. Article 312.3 It is clarified that the rules cover operators of websites and online services directed to children (decisions made by evaluating the subject matter, visual content, use of animated characters or activities and incentives for children, among other factors) as well as websites and online services Online services where the operators of such services actually know that they are collecting or maintaining personal information from children under the age of 13. If a company is covered by COPPA, it must obtain verifiable parental consent before (among other things) collecting, using or disclosing personal information from children under the age of 13.

According to the FTC, a large portion of Fortress Heroes’ 400 million players are children under the age of 13, and Epic collected children’s personal information during the registration process, including their full names, email addresses, and usernames. No informed consent was obtained from their parents. The complaint cites numerous factors to prove that Fortress Heroes is a “child-directed” service. First, a 2019 survey showed that 53% of U.S. children ages 10 to 12 play Fortnite on a weekly basis, compared with 33% of teens ages 13 to 17 and 18% of teens ages 18 to 24. This proportion is 19%. The gameplay style is relevant, as is Fortress Heroes’ cartoony graphics and colorful animations. In fact, according to the complaint, Fortnite Heroes has proven so popular with kids that Epic Games has approved a licensing deal for Fortnite-branded merchandise aimed at kids, earning millions of dollars in revenue, including Including children’s clothing, Halloween costumes, school supplies and toys.

Other telling evidence comes from Epic’s own employees. The complaint cites quotes such as, “We want the living room to be safe, but barely safe. We don’t expect your mom to enjoy this game – compared to other games, just accept it,” and “agree with the view that, in general, all themes “Should be relevant to kids aged 8-14 as a touchstone”, “We are not adults: the experience must be comfortable for parents aged 10+.”

The FTC claims that Epic launched “Fortress Heroes” without parental controls and minimal privacy settings. Instead, the company added a paragraph to the end of a lengthy privacy policy denying that the policy was directed at children. As a result, Epic allegedly took no steps to obtain parental consent before collecting personal information from children for two years. Furthermore, as the complaint alleges, “Epic took no steps to comply with COPPA during this period, even if Epic had actual knowledge that certain Fortress Heroes players were under the age of 13.” The company finally instituted an age limit in 2019, but Epic didn’t apply it to the majority of the hundreds of millions of Fortnite players who already had accounts. The complaint alleges that Epic violated COPPA by failing to comply with requirements designed to ensure that parents, not companies, control children’s online information.

But according to the FTC, Epic’s violations didn’t end there.When designing Fortnite to match users playing together, Epic set By default Players can engage in direct, instant voice chat with other players. Considering the number of child or teen players in Fortress Heroes, the inevitable result is that children and teens are often paired up with strangers.

Epic’s user experience director at the time discovered this problem early on. Noting that “there are definitely a lot of kids” playing Fortress Heroes, the user experience director urged Epic leadership to establish “basic toxicity prevention” mechanisms to “avoid voice chat or at least opt-in.” An Epic employee raised similar concerns after a well-known gamer verbally harassed a young player during a public live stream to thousands of viewers.As the employee admitted: “…honestly, we should have seen this coming, or [at least] The default voice chat system expects this. This situation is bound to happen. . ”.

Another employee summed up the issue this way:

I think you all know this, but as far as kids and parents are concerned, our voice and chat controls are complete garbage. This is not a good thing. It was on my list a year ago but never surfaced. This is one of those things that companies are generally reluctant to pursue, but it does impact our entire system and cognition. I’ve made a game that’s COPPA compliant and we’re still far away from it, but we don’t need to be that far away. . .

How is Epic responding to employee concerns? According to the FTC, words come first, crickets second. Despite employee pleas, Epic chose to maintain preset in-game communications to allow for personal interactions between kids and strangers. When the company rolled out a toggle that allowed “Fortress Heroes” players to turn off voice chat, the Federal Trade Commission said the control was buried on a settings page that was hard to find. Additionally, even if Epic eventually implements age restrictions, the FTC said the company will still default to providing direct communication to all players, including those who identify themselves as under 13 or teenagers.

The complaint outlines disturbing allegations about how Epic’s selection of preset settings has caused harm to children and teenagers, including threats, bullying, and sexual harassment. Numerous news reports say predators forced teenagers they met through Fortress Heroes to share explicit images or meet offline for sexual activity. Additionally, some children and teenagers have suffered traumatic experiences, including self-harm, suicide, and others advising players to “kill themselves.” As one parent reported to Epic, “While playing Fortnite this morning, my 9-year-old son had a ‘friend’ (who he doesn’t know in real life but has been playing with for months). ) told him he was going to kill himself tonight. It shook him to his core.”

In addition to the $275 million in civil penalties required to be paid to the U.S. Treasury Department, the proposed court order prohibits Epic from enabling voice and text communications unless the parent of a user under 13 or a teen user (or their parent) passes the privacy settings. Epic must also delete personal information previously collected from Fortnite users in violation of COPPA’s parental notification and consent requirements, unless the company obtains parental consent to retain the data or identifies the user as 13 or older through a neutral age restriction. To protect children and other users in the future, Epic must establish a comprehensive privacy program to address the issues raised in the FTC complaint.

What can other companies gain from the record settlement?

CThe Company cannot deny that it does not participate in COPPA coverage. Simply saying that your business is not covered by COPPA does not relieve you of your legal obligations. The COPPA rules include detailed definitions of websites and online services that are subject to legal protections. If you have any doubts about whether COPPA applies to your business, now is the time to clear up the ambiguity.

Listen to what your employees tell you. When a knowledgeable employee says, “Houston, we have a problem,” take their concerns seriously. One of the best tools a company has to reduce the risk of legal quicksand is for employees to feel empowered to bring potential difficulties to management’s attention.

Under the FTC Act, presumptions that harm consumers may be unfair. As stated in the complaint, Epic chose to configure its system to default to voice and text chat, which caused harm to children in the COPPA age group under 13, as well as teenagers. Carefully consider the potential dangers your default settings may pose to users of all ages.

Looking for COPPA compliance resources?Visit the Federal Trade Commission Children’s Privacy Page. Be sure to read the follow-up Business Blog post to learn about the FTC’s challenge to Epic’s use of digital dark patterns.