FTC hits Epic Games with record $520 million in penalties over Fortnite privacy breaches

Epic Games, the maker of the hit game Fortnite, will pay the Federal Trade Commission a record $520 million to settle claims that it violated children’s privacy.

The North Carolina-based company’s popular game duped millions of players into making unintentional purchases, the FTC said in a statement Monday.

As a result, Epic has agreed to pay $275 million for violating the Children’s Online Privacy Protection Act — the largest penalty ever obtained for breaching an FTC rule.

Epic will also pay $245 million to refund consumers, which the regulator said was the largest refund in a gaming case. Under the agreement, Epic will impose new default privacy settings for children and teens that ensure voice and text communications are turned off by default.

“Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children,” said FTC Chair Lina M. Khan in a statement. “Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”

Epic Games said in a statement that it accepted the deal so it could be at “the forefront of consumer protection and provide the best experience for our players.”

In its release Epic pointed to outdated statutes that govern gaming and said the video games industry was fast-moving and expectations were high.

“This proposed order sends a message to all online providers that collecting children’s personal information without parental consent will not be tolerated,” said Associate Atty. Gen. Vanita Gupta in a statement.

The FTC said Epic violated its rules by collecting personal information from children under 13 who played Fortnite, without notifying their parents. It also broke rules by enabling real-time voice and text chat communications for children and teens by default. The FTC said that children and teens have been bullied, threatened, harassed and exposed to traumatizing issues such as suicide while on Fortnite.

The regulator said that Epic employees had been warning about the default settings as early as 2017. Although Epic added a button allowing users to turn voice chat off, it was difficult to find, the FTC said.

Epic said Monday that it had already added additional high privacy default settings for all players under the age of 18, including changes such as profiles automatically being hidden and players under 16 also also have a mature language filter defaulted to on.

In a separate complaint, the FTC alleged Epic Games used so-called dark patterns to trick users into making purchases.

“Players could be charged while attempting to wake the game from sleep mode, while the game was in a loading screen, or by pressing an adjacent button while attempting simply to preview an item,” the regulator said. “These tactics led to hundreds of millions of dollars in unauthorized charges for consumers.”

The FTC said that Epic received more than 1 million user complaints, and there were employee concerns that large numbers of users were being wrongfully charged.

“All game developers should rethink steps they’ve taken to simplify payment flows in favor of practices that provide the largest amount of clarity to players when they make purchase decisions,” Epic said in its statement.