Microsoft has agreed to pay a $20 million fine to the Federal Trade Commission for allegedly violating the Children's Online Privacy Protection Act (COPPA) by collecting personal information from minors who registered for the Xbox gaming service without notifying their parents or obtaining parental consent.

Unlike PC games, which typically require nothing more than a functional Internet connection, Xbox consoles require an Xbox Live account to play online. A basic account can be set up for free, but of course the process requires entering all sorts of personal information, including full name, address, phone number, etc. According to the FTC, Microsoft's problem is that until late 2021, users had to enter personal information even if they were under 13 years old That is. The sign-up process also required users, including children, to agree to Microsoft's advertising policies and terms of use, which "included a pre-ticked box that allowed Microsoft to send promotional messages and share user data with advertisers until 2019."

It was only after this point that parents had to be involved in the process of completing account creation and allowing their children to have their own accounts, but in cases where parents did not complete the process, from 2015 to 2020, Microsoft had an incomplete sign-up process The FTC stated that it retained the data collected from the data anyway.

Under the terms of the proposed settlement, Microsoft will pay a $20 million fine and make a number of changes to its Xbox Live sign-up policy: [FTC Consumer Protection Bureau Director Samuel Levine said, "Our proposed order will make it easier for parents to protect their children's privacy on Xbox Our proposed order will make it easier for parents to protect their children's privacy on Xbox and limit the information Microsoft can collect and retain about their children. This action should make it clear that children's avatars, biometric and health information is not exempt from COPPA."

Under the terms of the proposed settlement, Microsoft "neither admits nor denies any allegations," but only "admits the facts necessary to establish jurisdiction" for purposes of the transaction.

"At Xbox, we have a fundamental commitment that every player should have a safe and secure experience on our platform," a Microsoft spokesperson said in a statement sent to PC Gamer. We recently entered into a settlement with the Federal Trade Commission (FTC) to update our account creation process and resolve data retention glitches found in our systems. We are committed to complying with the order.

"In addition to our existing multi-faceted security strategy, we also plan to develop next-generation identity and age verification. This is a convenient, secure, one-time process for all players that will allow us to better provide a customized, secure, and age-appropriate experience.

Like the famous "it depends on the context" meme, $20 million is both a lot of money and not a lot of money. For me, it would be life-changing if I had it, and life-destroying if I suddenly had to owe it to a huge government agency for violating federal law. On the other hand, for Microsoft, it's a drop in the bucket: by my calculations, it represents about 0.1% of the $18.3 billion in net income Microsoft earned in the third quarter (i.e., three months) of FY23.

Or, to look at it another way, it is a small rounding error in Microsoft's proposed purchase price for Activision Blizzard: less than one-tenth of the difference from the announced $6.89 billion. A price of $7 billion and no fraction of the $69 billion that is sometimes offered. I would call this a bargain.

Both Microsoft and the FTC have agreed to the settlement, but it will not go into effect until it is approved by a US federal court.