According to the Federal Trade Commission (FTC), Microsoft obtained this data without notifying parents or obtaining their consent, and furthermore, it unlawfully held onto the collected information.
Microsoft has agreed to pay a hefty fine of $20 million to resolve charges brought by the FTC regarding the unlawful collection and retention of data from children who signed up for its Xbox video game console
These actions were found to be in violation of the Children’s Online Privacy Protection Act. In response to the charges, Microsoft‘s corporate vice president for Xbox, Dave McCarthy, detailed in a blog post the measures the company is now implementing to enhance its age verification systems and involve parents in the creation of child accounts for the service. The focus of these measures primarily revolves around improving age verification technology and educating both children and parents about privacy concerns.
McCarthy also acknowledged and rectified a technical issue that prevented the deletion of child accounts in cases where the account creation process was left unfinished
Microsoft’s policy was to retain such data for a maximum of 14 days, allowing players to resume the account creation process seamlessly if they were interrupted.
However, before the settlement can take effect, it must receive approval from a federal court, as stated by the FTC. This settlement marks Microsoft’s commitment to addressing the concerns raised by the FTC and to implementing stronger safeguards to protect the privacy of children using its Xbox platform.