Epic Games, creator of Fortnite, has agreed to pay a record $520 million in penalties and refunds for violating children’s privacy laws and changing the default settings. Of the $520 million, $275 million is the penalty for violating children’s privacy laws and changing default settings, and $245 million is for refunds for using dark patterns to trick users into making unwanted purchases. The record settlement is part of a federal court order issued by the Department of Justice on behalf of the Federal Trade Commission.

Epic Games will pay a $275 million penalty to the U.S. Treasury for violating the Children’s Online Privacy Protection Act (COPPA). The FTC alleges that Epic Games collected personal data from children without getting their parents’ permission. When parents asked to have their children’s data deleted, Epic Games made it difficult and sometimes failed to honor the parents’ requests. This is the largest penalty ever paid for violating COPPA.

In addition, Epic Games enabled live on-by-default text and voice communications to users, and they matched children and teens with strangers which could be potentially harmful to the players. The FTC alleges that the young users were “bullied, threatened, harassed, and exposed to dangerous and psychologically traumatizing issues such as suicide” while playing Fortnite. According to the FTC, Epic Games employees expressed concern about the default settings as early as 2017, but their concerns were ignored.

Epic Games will be required to adopt privacy default settings for children and teens so that voice and text communications are turned off by default. They must delete personal information previously collected that violates COPPA unless they obtain parental consent or the user is 13 years of age or older. Also, Epic Games must create a comprehensive privacy program to ensure there will be no further violations. This program must be regularly audited by an outside firm.

Under a separate order, Epic Games will issue $245 million in refunds for using dark patterns and billing practices that duped users into paying unwanted charges. This is the largest refund settlement in a gaming case to date and the largest administrative order in history.

“As our complaints note, Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children,” said FTC Chair Lina M. Khan in a December 19, 2022 announcement. “Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”

A representative from the Justice Department also commented on the allegations and settlement.

“The Justice Department takes very seriously its mission to protect consumers’ data privacy rights,” said Associate Attorney General Vanita Gupta. “This proposed order sends a message to all online providers that collecting children’s personal information without parental consent will not be tolerated.”

The FTC’s Bureau of Consumer Protection weighed in as well.

“Epic put children and teens at risk through its lax privacy practices, and cost consumers millions in illegal charges through its use of dark patterns. Under the proposed orders announced today, the company will be required to change its default settings, return millions to consumers, and pay a record-breaking penalty for its privacy abuses,” said Samuel Levine.

Fortnite business model

Fortnite is free to download and play, but there are many opportunities for in-app purchases, including battle passes and battle bundles. By saving payment information without authorization, children and teens could make purchases, even without intending to.

Fortnite also has a monthly subscription, Fortnite Crew, for $11.99 a month. This is a recurring charge that is charged each month until canceled. On the subscription page, the price and terms can be found in small print (gray on gray) at the very bottom of the screen. Each month has different perks in the pack, including outfits, weapons and V bucks, in-game currency that can be used to purchase clothing, weapons, emotes and other items.

Insider Take

These settlements are HUGE and telling. The FTC has already shown they mean business, and they won’t accept this type of behavior – privacy violations and dark patterns – but this settlement sets a precedent for gaming companies. Violations of consumer protection acts will not be tolerated, and the FTC is willing to go to the DOJ to get these companies to settle and change their ways.

From a subscription company standpoint, Epic Games is not following best practices. Express, informed consent is required for purchases, and their purchase page ignores all the best practices. The price can only be found in tiny print at the bottom of the page, and the subscription terms are on a separate page altogether. The price and material terms should be clear and conspicuous and at least the same size type as the subscription’s features. Not following these FTC rules – not to mention any related state regulations – could be another red flag for Epic Games.

For more on dark patterns and subscription offers, check out our three-hour master class on How to Comply with Subscription Regulations, led by Marc Roth, Esq. and Lisa B. Dubrow, Esq., two of America’s leading subscription attorneys.