Epic slammed with half-a-billion dollar FTC fine in landmark ruling over Fortnite's failure to protect childrens' privacy

sign of a person dancing with a big "do not do this" slash over it
(Image credit: Epic Games)

The US Federal Trade Commission has reached agreements with Epic Games that will see the videogame giant pay a total of $520 million in penalties and refunds, following allegations that the company violated the Children’s Online Privacy Protection Act (COPPA) and used dark patterns (UI design tricks meant to fool users) to dupe players into purchases.

There are two settlements. Epic will pay a $275 million penalty for violating the COPPA rule— the largest penalty ever levied for violating an FTC rule. As part of this agreement Epic will also adopt "strong privacy default settings for children and teens," meaning communications via voice and text will be turned off by default.

The second part of it is Epic paying $245 million to refund consumers affected by Fortnite's "dark patterns and billing practices", which is the largest refund amount the FTC has ever obtained in a videogame matter.

"As our complaints note, Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children," said FTC chair Lina M. Khan. "Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices."

The FTC had filed two separate complaints against Epic in federal court, first alleging that Epic through Fortnite had violated the COPPA rule "by collecting personal information from children under 13 who played Fortnite, a child-directed online service, without notifying their parents or obtaining their parents’ verifiable consent". It further alleged a violation against the FTC Act's prohibition against unfair practices "by enabling real-time voice and text chat communications for children and teens by default".

The failure to notify parents and obtain consent seems to be the real biggie here, with the FTC saying Epic knew a huge part of Fortnite's audience was children and didn't take this seriously enough (I am obviously paraphrasing). It also says that Epic "required parents who requested that their children’s personal information be deleted jump through unreasonable hoops, and sometimes failed to honor such requests".

Which is exactly the kind of thing that really sets off a regulator's alarm bells. The FTC also says the default settings, alongside the game's nature of matching players with strangers, led to children and teens being "bullied, threatened, harassed, and exposed to dangerous and psychologically traumatizing issues such as suicide while on Fortnite".

Interestingly enough one of the key pieces of evidence for this was Epic's own concerns. As early as 2017 Epic employees were expressing concern internally about the makeup of the audience and default settings, per the FTC filing: "The company resisted turning off the default settings. And while it eventually added a button allowing users to turn voice chat off, Epic made it difficult for users to find".

Gimme dat cheddar.

(Image credit: Epic Games)

The dark patterns side is all about whether Fortnite tricked players into making purchases. The FTC says it did thanks to a "counterintuitive, inconsistent, and confusing button configuration" whereby players could incur charges through the press of a single button, for example, to wake the game from sleep mode, or within a loading screen, or when trying to preview an item.

Part of this is also that until 2018 buying V-Bucks, Fortnite's in-game currency, had fewer checks on it, so once an account was linked up to a payment method kids could buy V-Bucks without their parents realising. Similar claims have been brought against other big tech companies in different contexts, most notably Apple and the App Store.

Wait, there's more. The FTC alleged Epic locked the accounts of customers who disputed such charges directly through their credit card companies, in turn locking them out of previously purchased content. Even when Epic agreed to unlock an account, apparently, users would be warned that they risked a permanent ban on the account if they disputed future charges. The company "ignored" over a million user complaints and internal warnings and, says the FTC, went on to "purposefully obscure cancel and refund features to make them more difficult to find."

The settlement accepted by the FTC will see Epic barred from blocking customers who dispute unauthorised charges, and prohibited from using dark patterns. Epic will also have to seek affirmative consent before charging users. The proposed agreement will be published in the Federal Register soon, open for public comment for 30 days, after which the commission will decide whether to make the order final.

That was a lot of information, and there's a fair amount of context that needs to go around it before we get to Epic's response. The first is that this is mostly historical behaviour. Epic has clearly cleaned up its act in some regard and also, it must be said, was dealing with a success it hadn't predicted or prepared for. This is not to excuse the areas where we're crossing into unethical activity like dark patterns but, when the FTC and Epic are reaching agreement rather than going down the adversarial route, it suggests the publisher belatedly realised it made mistakes.

Epic's response comes in a statement that announces the settlement, before making the case for how and why this happened and what it's going to be doing in the future.

"No developer creates a game with the intention of ending up here," Epic's statement reads, before going on to describe the games industry as a fast-moving and innovative space that has simply got ahead of statutes "written decades ago [that] don’t specify how gaming ecosystems should operate. The laws have not changed, but their application has evolved and long-standing industry practices are no longer enough".

Epic goes on to outline some of the ways it has changed its payment and refund systems, with some changes occurring many years ago and others more recent, and all of which are now within the parameters of what the FTC says are acceptable. This includes a "hold to buy" system to ensure users don't accidentally buy something with one click. As for barring accounts that dispute charges through their bank, Epic said it has changed its chargeback policy "to account for non-fraud related scenarios and will only disable accounts when fraud indicators are present". It says it has restored "thousands" of accounts previously banned under this policy.

As for the children's privacy aspects, Epic notes that "developers who create a teen-rated or mature-rated game can no longer assume that it won't be deemed to be directed to children, according to the United States’ Children’s Online Privacy Protection Act (COPPA)". That is, Fortnite is rated Teen and was aimed at an older audience, but the one it found was younger than expected.

It goes on to list newer measures such as "Cabined" accounts, which are for users under 13, and new default communications settings. Epic's list of features for younger players in Fortnite now includes:

  • Parental Controls that are easily accessible in the main Fortnite Lobby menu and the Epic Account portal. 
  • Parental Controls that include the option to require a PIN to send and accept friend requests and enable parents to authorize purchases before they are made. 
  • A daily spending limit for players under the age of 13.
  • Granular privacy options for chat, which include "Everybody," "Friends and Teammates," "Friends Only," or "Nobody."
  • Cabined Accounts that provide a tailored experience that is safe and inclusive for younger players while they wait for parental consent.
  • Settings that default to the highest privacy option for players under the age of 18, including voice and text chat defaulting to "Nobody."

The publisher notes that "the old status quo for in-game commerce and privacy has changed, and many developer practices should be reconsidered". It's certainly been an expensive lesson for the gaming giant, though there is also a slight sense here that it is being held responsible for the wider industry as well as its own game. Fortnite is far from the only title that attracts younger players and often children, but it is the emblematic example of the moment, and Epic's statement makes clear that other developers should be looking at this example with extreme caution.

Epic CEO Tim Sweeney took to social media to share some thoughts, and it may be possible to detect a vague hint of resentment here that Epic has been left carrying the can.

"Developers should dig into the topic, as this settlement reflects state of the art American regulatory practice, for example now applying principles similar to the UK Age-Appropriate Design Code to voice chat defaults," writes Sweeney. "In-app purchasing is also a hot topic, with rigorous expectations of 'Affirmative Express Consent' for purchases made both in real money and paid virtual currency."

The tiniest violin in the world is playing for Epic right now. The publisher may be bang-to-rights on elements of the FTC charge, but it's also being used as an example to push wider industry change that the regulator wants to see. Other companies will be looking at the size of this settlement, and tomorrow morning a lot of development studios are going to be holding meetings about their default account settings and microtransaction pathways.

Ultimately it may hurt the bottom line but Epic has the money, and no FTC ruling is going to make a dent in Fortnite's popularity. The publisher is right that the games industry has, through no fault of its own, outpaced regulators, and has to deal with decade-old statutes that never imagined entertainment products like Fortnite. As this shows, however, just because you're out in front for a time doesn't mean the man won't eventually catch up.

Rich Stanton
Senior Editor

Rich is a games journalist with 15 years' experience, beginning his career on Edge magazine before working for a wide range of outlets, including Ars Technica, Eurogamer, GamesRadar+, Gamespot, the Guardian, IGN, the New Statesman, Polygon, and Vice. He was the editor of Kotaku UK, the UK arm of Kotaku, for three years before joining PC Gamer. He is the author of a Brief History of Video Games, a full history of the medium, which the Midwest Book Review described as "[a] must-read for serious minded game historians and curious video game connoisseurs alike."

Read more
Genshin Impact 5.0 codes - Murata
FTC says Genshin Impact 'deceived children' and orders its publisher to pay a $20 million fine and stop selling loot boxes to kids
Fortnite jacked Peter Griffin
Parents are suing Epic over Fortnite item shop 'FOMO' timers they say are inaccurate and manipulative
Tim Sweeney, CEO of Epic Games, looks at the camera.
Tim Sweeney says Epic is losing billions fighting Apple and Google because it can afford to, jokes that 'we might run into serious financial problems after a couple more decades'
talk to the joneses fortnite
Epic sues Fortnite cheater, donates his winnings to charity, forces him to publicly apologise, bans him for life, and all but sends him to his room without dinner
talk to the joneses fortnite
Epic's war against the Fortnite fraudsters sees it simultaneously name and shame alleged ne'er-do-wells as its high-powered lawyers sue them
talk to the joneses fortnite
Epic will give Fortnite cheaters 'a second chance' with a new, more forgiving ban policy, as long as they didn't do anything too awful or illegal
Latest in Survival & Crafting
Crying laughing emoji with disturbing realistic elements for REPO
REPO's first update will add a new map and a 'duck bucket' so we can finally give that pesky quacker a time out
Man facing camera
The Day Before studio reportedly sues Russian website for calling infamous disaster-game a 'scam'
Sunset in the desert in Hello Sunshine
Hello Sunshine is a desert survival sandbox where you live in the literal shadow of the colossus
Performers acting as zombies are seen on a train coach during the "Train to Apocalypse" event as part of the Pandora Box Artmire Festival 2024 held to attract commuters to ride the city's rapid transit system LRT (light rapid transit), in Jakarta on July 11, 2024. (Photo by BAY ISMOYO / AFP) (Photo by BAY ISMOYO/AFP via Getty Images)
Venerable browser-based MMO Urban Dead is closing this week after a 20-year run, not with a bang but with a whimper
Wearing a hazmat suit, a Rust player proudly holds up a freshly cooked pie, foregrounded by a table covered with pies and a large pumpkin on the left.
Rust's crafting update gives the survival sim real-time food cooking and pies to rival Monster Hunter, but the tastiest treat is the ability to make and throw 'bee grenades'
A pig, a cow, and two birds dance
Minecraft Live returns in March with everyone's favorite kind of content: 'exclusive movie content'
Latest in News
Sans, from the hit 2015 RPG undertale, folds his arms in a dashing suit as stonks rise in the background.
You can grab Undertale for less than $1, as the genre-defining indie RPG beats its all-time player peak for the first time in 10 years
Key art for the new Age of Empires 2 expansion showing an angry Viking and Japanese warlod.
Age of Empires 2 team continues to cook while delivering 'legendarily long' 8,000-word patch notes about 'the biggest updates' the 26 year-old game has ever had
Max, protagonist of Life is Strange and Life is Strange: Double Exposure, stares with trepidation at something off-screen with her friend.
Life is Strange: Double Exposure reportedly a 'large loss' for Square Enix, says analyst, who adds: 'The company's IP fundamentally varies too much between good and bad'
R.E.P.O. screenshots
'REPO is fun': Lethal Company creator recants their criticism of the new co-op horror game after trying to move a grand piano through a mansion
A "sensor-actuator–coupled gustatory interface chemically connecting virtual and real environments for remote tasting," or essentially a virtual reality tongue in an artificial mouth
Would you like to taste fish soup in VR? Me neither, but this electronic tongue does it anyway
Razer DeathAdder V3 Pro gaming mouse on a blue background
The DeathAdder V3 Pro is currently so cheap it's put the usually more affordable HyperSpeed version out of a job