FTC Announces $520 Million in Penalties for Fortnite Game Maker Over Privacy Violations, Dark Patterns

The Federal Trade Commission today announced two historic settlements with Fortnite video game maker Epic Games for privacy and consumer protection violations. Fortnite has more than 400 million users worldwide, many of them minors. In addition to changing default privacy settings, Epic Games will be required “to pay a total of $520 million in relief over allegations the company violated the Children’s Online Privacy Protection Act (COPPA) and deployed design tricks, known as dark patterns, to dupe millions of players into making unintentional purchases.”

One settlement is a result of a federal court order filed by the Department of Justice on behalf of the FTC. The two-part complaint alleged that Epic Games violated COPPA by failing to “comply with the COPPA Rule’s parental notice, consent, review, and deletion requirements.” Independent of COPPA, the FTC also alleged that Fortnite’s default settings related to in-game voice and text communications were harmful, violating the FTC Act’s prohibition against unfair and deceptive practices. The proposed federal court order requires Epic Games to pay a $275 million monetary penalty, the largest ever obtained for an FTC rule violation. Additionally, Epic Games is required to adopt strong “default privacy settings for children and teens,” and delete personal information collected from Fortnite users in violation of COPPA.

The FTC also filed an administrative complaint alleging Epic Games violated the FTC Act by employing dark patterns to trick consumers into purchasing in-game items “without first obtaining their express informed consent,” and blocking access to purchased content. In addition to employees of Epic Games raising concerns, millions of consumers complained “about these unfair practices and disputed Epic’s unauthorized charges with their credit card providers.” As a result, the proposed administrative order will require Epic Games to pay $245 million to refund consumers. The order would also prohibit Epic Games from using dark patterns to charge consumers, and instead would require Epic Games to obtain affirmative consent.

EPIC regularly engages with the FTC on consumer protection and data protection issues, including privacy for children. The FTC previously considered EPIC’s recommendations in an early review of the COPPA Rule and incorporated several of EPIC’s recommendations in the 2013 regulations. Recently, EPIC filed comments in response to the FTC’s rulemaking on commercial surveillance, arguing for regulations that would prevent harmful dark patterns and safeguard the privacy of minors. EPIC argued that is an unfair practice to use dark patterns to nudge consumers to accept certain conditions or terms, noting that “Dark patterns are prevalent, harmful practices that undermine a consumer’s autonomy and manipulate them to their detriment.” EPIC also highlighted the unique vulnerabilities of minors to the damaging effects of commercial surveillance systems.