Microsoft To Pay $20 Million Settlement For Illegally Collecting Children's Personal Data
The federal consumer watchdog said Microsoft violated the Children's Online Privacy Protection Act (COPPA), the federal law that governs the online privacy protections for children under the age of 13, which requires companies notify parents about the data they collect, obtain parental consent and delete the data when it's no longer necessary. The FTC said children signing up to Microsoft's Xbox gaming service were asked to provide their personal information -- including their name, email address, phone number and date of birth -- which until 2019 included a pre-filled check box allowing Microsoft to share user information with advertisers. The FTC said Microsoft collected this data before asking for the parent to complete the account setup, but held onto children's data even if the parent abandoned the sign-up process.
"Only after gathering that raft of personal data from children did Microsoft get parents involved in the process," said FTC's Lesley Fair in a corresponding blog post. As a result, the FTC will require Microsoft to notify parents and obtain consent for accounts created before May 2021. Microsoft will also have to establish new systems to delete children's personal information if it hasn't obtained parental consent, and to ensure the data is deleted when it's no longer needed.
