Epic To Pay $520 Million Over Deceptive Practices To Trick Kids

Maybe, just maybe, before we rush to pass questionable new laws about “protecting children online,” we should look to make use of the old ones? The Children’s Online Privacy Protection Act (COPPA) has been in place for years, and it has problems, but so many companies ignore it. I’ve mentioned in the past how I once walked around a part of CES that had a bunch of startups focused on offering services to kids, and a DC lawyer I was with made sure to ask each one what their COPPA compliance strategy was… and we just got blank stares.

On Monday, video game giant Epic agreed to pay $520 million in two separate fines to the FTC for violating COPPA with some pretty deceptive behavior targeted at kids. First up were your garden variety privacy violations in collecting data on kids under 13 without obtaining parental consent:

• Violated COPPA by Failing to Notify Parents, Obtain Consent: The FTC alleged that Epic was aware that many children were playing Fortnite—as shown through surveys of Fortnite users, the licensing and marketing of Fortnite toys and merchandise, player support and other company communications—and collected personal data from children without first obtaining parents’ verifiable consent. The company also required parents who requested that their children’s personal information be deleted to jump through unreasonable hoops, and sometimes failed to honor such requests.
• Default settings harm children and teens: Epic’s settings enable live on-by-default text and voice communications for users. The FTC alleges that these default settings, along with Epic’s role in matching children and teens with strangers to play Fortnite together, harmed children and teens. Children and teens have been bullied, threatened, harassed, and exposed to dangerous and psychologically traumatizing issues such as suicide while on Fortnite.

As the FTC notes, Epic employees knew this was a problem, but the company didn’t fix things. In fact, when it finally did create an option to turn the voice chat off, “Epic made it difficult for users to find.”

Perhaps more concerning were the deceptive practices.

• Used dark patterns to trick users into making purchases: The company has deployed a variety of dark patterns aimed at getting consumers of all ages to make unintended in-game purchases. Fortnite’s counterintuitive, inconsistent, and confusing button configuration led players to incur unwanted charges based on the press of a single button. For example, players could be charged while attempting to wake the game from sleep mode, while the game was in a loading screen, or by pressing an adjacent button while attempting simply to preview an item. These tactics led to hundreds of millions of dollars in unauthorized charges for consumers.
• Charged account holders without authorization: Children and other users who play Fortnite can purchase in-game content such as cosmetics and battle passes using Fortnite’s V-Bucks. Up until 2018, Epic allowed children to purchase V-Bucks by simply pressing buttons without requiring any parental or card holder action or consent. Some parents complained that their children had racked up hundreds of dollars in charges before they realized Epic had charged their credit card without their consent. The FTC has brought similar claims against companies such as Amazon, Apple, and Google for billing consumers millions of dollars for in-app purchases made by children while playing mobile app games without obtaining their parents’ consent.
• Blocked access to purchased content: The FTC alleged that Epic locked the accounts of customers who disputed unauthorized charges with their credit card companies. Consumers whose accounts have been locked lose access to all the content they have purchased, which can total thousands of dollars. Even when Epic agreed to unlock an account, consumers were warned that they could be banned for life if they disputed any future charges.

I generally dislike the term “dark patterns,” as it’s frequently used to basically just mean “making a service useful in a way that someone else dislikes.” But, uh, yeah, making it way too easy for kids to rack up huge bills on their parents’ credit cards? That seems super sketchy.

For this behavior, Epic will pay $245 million, which the government will use to provide rebates for Fortnite players.

This all seems like the kind of thing that the FTC should be doing, rather than some of the other sillier things it’s been focused on of late. And, also, again, suggests that maybe we don’t need these new, badly drafted laws, but instead should just make sure the FTC is able to better enforce existing laws.