Epic Games Fined $520M for Alleged Privacy Violations, Unwanted Charges

According to the FTC, Epic violated the Children’s Online Privacy Protection Act (COPPA) by collecting personal data from users under 13 years of age. COPPA requires that software publishers must notify children’s parents of personal data collection and obtain consent for said collection prior to gathering or storing any of it, something Epic allegedly failed to do. When a parent reached out to Epic to have their child’s information deleted, Epic reportedly made the parents “jump through unreasonable hoops” while failing to pursue some requests altogether.

The company is also said to have automatically enabled real-time voice and text chat communications within Fortnite, which made children vulnerable to harassment and discussion about sensitive topics like suicide. In 2017, some Epic employees expressed concern over young users’ vulnerability and urged the company to disable voice and text communications by default, using children’s sexual harassment experiences as justification for the change. Epic refused to change its default communications settings; while the company did make it possible to manually disable voice and text chats, they reportedly made it difficult to do so.

Separate from its alleged affronts to children and their parents, Epic is said to have used dark patterns—interface design that manipulates users into doing something they wouldn’t have otherwise done—to dupe Fortnite players into making purchases they didn’t really want. The FTC says Epic made it far too easy for young players to purchase V-bucks (Fortnite’s in-game currency) with the press of a button without verification from a parent or the cardholder. When users attempted to dispute those charges with their banks, Epic allegedly locked those users’ accounts.

“Fortnite’s counterintuitive, inconsistent, and confusing button configuration led players to incur unwanted charges based on the press of a single button,” the FTC’s statement reads. “For example, players could be charged while attempting to wake the game from sleep mode, while the game was in a loading screen, or by pressing an adjacent button while attempting simply to preview an item. These tactics led to hundreds of millions of dollars in unauthorized charges for consumers.”

The FTC has charged Epic $275 million for its children’s privacy violations. On top of that, Epic must refund $245 million—the largest gaming-related refund the FTC has ever ordered—in charges related to its manipulative interface design. Epic has additionally agreed to adopt “strong privacy default settings for children and teens,” delete young users’ personal data, and revamp Fortnite’s design to enhance purchase clarity. The company will no longer be able to lock user accounts once someone has disputed an Epic-related charge with their bank.