US IT giant Microsoft will have to pay $20 million to settle a lawsuit with the U.S. consumer agency accusing the company of collecting children's personal data without parental consent.
The Federal Trade Commission (FTC) accuses the Redmond company of having collected and stored, between 2015 and 2020, data from children and adolescents under 13 who had registered on the online gaming platform of the Xbox console providing name and surname, email address and date of birth.
According to the FTC, Microsoft has thus broken the law on the protection of children's privacy. "Microsoft will have to take several steps to strengthen the privacy protection of children using its Xbox system," the agency said in a statement.
The Children's Online Privacy Protection Act (COPPA) mandates that online services and websites intended for children and adolescents under the age of 13 have an obligation to inform parents of the personal information they collect and to obtain their consent.
Microsoft Xbox Vice President Dave McCarthy outlined on the platform's blog the additional steps the company is taking to improve its age verification systems, and to ensure that parents are involved in creating accounts for children.
McCarthy also said that the company identified and fixed a technical issue that prevented an account from being deleted if the creation process was not completed. Microsoft's policy was to retain user data for no more than 14 days, so that players who stopped recording could resume recording from the same point.
The deal will need to be approved by a federal court before it can go into effect, the FTC said.