In a warning shot across the bow to all online information gatherers, the Federal Trade Commission and Justice Department say they have struck an agreement with Fortnite creator Epic Games that will see the online gaming giant pay $520 million to settle allegations it broke the law by designing "dark patterns" that tricked game players into make millions of unintended in-game purchases like costumes and dance moves.
Associate Attorney General Vanita Gupta said the settlement should send a message to all online providers that collecting personal information from children without parental consent "will not be tolerated."
The settlement is divided into a $275 million payment to the Treasury, the largest such penalty in FTC history, and $245 million in consumer refunds for its billing practices, the biggest refund in an FTC gaming case.
The FTC alleged that Epic used "privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children," according to FTC chair Lina Khan.
As part of the agreement, Epic will have to employ "strong privacy default settings for children and teens," including that voice communications and texting are turned off by default, the FTC said.
The FTC said the game violated the Children's Online Privacy Protection Act (COPPA) by failing to notify parents about the data collection from their children, then requiring parents to "jump through unreasonable hoops" if they wanted that data deleted.
In a separate complaint, it said Epic used dark patterns -- including confusing button configurations, which tricked players into hundreds of millions of dollars worth of unwanted purchases -- as the game was loading or being awakened from sleep mode.
The FTC said the company had been put on notice of problems by some of the people working for it. "As early as 2017, Epic employees urged the company to change the default settings to require users to opt in for voice chat, citing concern about the impact on children in particular," the FTC said. It also said the company had ignored over a million consumer complaints as well as the repeated employee concerns.
The FTC referred the complaint to Justice (the vote was 4-0), which then proposed the settlement.
Sen. Ed Markey (D-Mass.), a member of the Commerce Committee who authored COPPA, signaled the issue went beyond Epic and put in a plug for passing his update to COPPA that would extend its protections to teens.
"Congress must meet this moment in history by stepping up and stepping in for the wellbeing of young people across America," said Markey in a statement. "Without immediate action to thwart the pernicious threats facing young people, we will fail to safeguard them in the face of a generation-defining mental health and privacy crisis. This is a bipartisan issue for American families, and I won’t stop fighting until we pass updated legislation for kids' and teens' privacy protections online."Sen. Maria Cantwell (D-Wash.), chair of the Commerce Committee, agreed.
“The FTC’s lawsuit against Epic proves we need stronger online privacy protections for children and teens," she said in response to the settlement. "Kids were bullied, harassed, and threated because Epic designed its games to let them communicate with strangers from all over the world. It’s time for Congress to step up for kids and protect them from online harms and to make sure we have a stronger FTC to enforce against bad actors.”
Sen. Mark Warner (D-Va.) similarly promoted his legislative effort to weed out dark patterns.
“I’m glad to see the FTC cracking down on the use of manipulative dark patterns against children. Companies and platforms that cater to young people have a responsibility to protect their users — not to target them with deceptive interfaces that manipulate them into ceding their personal information or making unwanted purchases," Warner said in a statement. "I will continue working to pass my DETOUR Act in order to establish greater safeguards for users of all ages.”
Dark patterns are online interfaces designed to trick users into taking actions they might not ordinarily take. Examples include: 1) simple buttons that say "yes" to user data collection while the "no" button is tiny or hidden or several steps removed; 2) suggesting others are about to buy an item to try to close the sale; or 3) deliberately obscuring alternative choices or settings. Then there are the online game designs that lure kids into in-app purchases their parents have to either pay for or seek refunds. ■
