Fortnite maker Epic Games will pay a combined $520 million, in both fines and refunds, under an agreement reached with the Federal Trade Commission announced Monday. The settlement concerns violations of the Children’s Online Privacy Protection Act of 1998 (COPPA), and the refunds, of $245 million, are the largest the FTC has ever secured in a video gaming case.
“Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children,” FTC chairwoman Lina M. Khan said in a statement released Monday. “Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”
The $275 million Epic will pay for violating COPPA is the largest penalty the FTC has collected for violating a rule it enforces. The settlement results from an FTC investigation into Epic’s privacy protection and other practices, which came to light during the trial of its lawsuit against Apple back in 2021. The Justice Department filed both a complaint and the settlement of that complaint in federal court in North Carolina on Monday. Epic Games founder and chairman Tim Sweeney signed the settlement on Dec. 2.
The FTC alleged that Epic violated COPPA with a variety of practices, including gathering kids’ personal information without their parents’ consent, and default settings that matched children and teenagers with strangers, resulting in incidents of harassment, bullying, sexual coercion, and other harm. Additionally, parents who asked that their children’s personal information to be deleted had to “jump through unreasonable hoops,” the FTC said, “and sometimes [Epic] failed to honor such requests.”
The refunds, stemming from a separate complaint before the FTC, concern the use of “dark patterns” that the commission said tricked Fortnite players into making unintended, in-game purchases. “Fortnite’s counterintuitive, inconsistent, and confusing button configuration led players to incur unwanted charges based on the press of a single button,” the FTC alleged. “These tactics led to hundreds of millions of dollars in unauthorized charges for consumers.”
Epic Games, for its part, issued a statement outlining the changes it has made to Fortnite, many of them in the past year, in response to consumer complaints and privacy concerns. The most recent is a feature called “Cabined Accounts,” announced Dec. 7.
A cabined account is one set up by a user who indicates they’re under age 13 (or their country’s age of digital consent); they’re then asked for a parent’s email address, so that they may make affirmative consent for them to play Fortnite (or Rocket League or Fall Guys). Until that consent is received, cabined players will not have access to chat or purchasing features (but they do have access to all previously acquired in-game content).
“No developer creates a game with the intention of ending up here,” Epic Games said in Monday’s statement. “Statutes written decades ago don’t specify how gaming ecosystems should operate. The laws have not changed, but their application has evolved and long-standing industry practices are no longer enough.
“We accepted this agreement because we want Epic to be at the forefront of consumer protection and provide the best experience for our players,” the company said.
The FTC’s news release said that Epic’s own employees expressed their concerns about the default settings as far back as 2017, when Fortnite Battle Royale launched. These employees urged that Fortnite require an opt-in prompt for voice chat, “citing concern about the impact on children in particular.”
“Despite this and reports that children had been harassed, including sexually, while playing the game, the company resisted turning off the default settings,” the FTC said. The settlement prohibits Epic Games from enabling voice and text communications for children under age 13 unless their parents provide their affirmative consent. The cabined accounts feature seems to address this.
Regarding the “dark patterns” and unintended purchases, Epic pointed to several changes it has made in the past year, including the means of returning digital cosmetic items for a refund (of virtual currency); purchase commands that require holding a button (instead of merely pressing it); the means of canceling unintended purchases up to 24 hours after they were made; and updating the company’s chargeback policy, so that customers who report unauthorized transactions don’t automatically have their Epic Games accounts suspended.
The FTC said that Epic had, since 2017, “ignored more than one million user complaints and repeated employee concerns that ‘huge’ numbers of users were being wrongfully charged.” Epic, in its statement Monday, said “[t]he old status quo for in-game commerce and privacy has changed, and many developer practices should be reconsidered. […] [T]he practices referenced in the FTC’s complaints are not how Fortnite operates.”
“We will continue to be upfront about what players can expect when making purchases, ensure cancellations and refunds are simple, and build safeguards that help keep our ecosystem safe and fun for audiences of all ages,” Epic said.