The Federal Trade Commission in the United States has announced a $20 million penalty against Microsoft for collecting and processing data from minors in ways that violated privacy rules. The decision centers on Microsoft’s Xbox gaming division and the handling of personal information during the account creation process. Reports indicate that children could enter personal data before a parental consent notice appeared, and this data was automatically transmitted to Microsoft servers and stored for years even if the user did not complete the account setup. Microsoft states that the issue was addressed by late 2021.
Microsoft responded to the FTC ruling by acknowledging that expectations were not met and emphasizing a commitment to stronger privacy protections. The company noted that it aimed to improve security measures to safeguard users and their information, and it asserted that data obtained from minors during the incident would not be used, transferred, or monetized as a result of the failure.
Industry observers have described the problem as a technical error within the Xbox interface, one that allowed data from child accounts to bypass certain consent controls. The disclosure highlights ongoing concerns about how gaming platforms collect and secure data, especially when minors are involved. The broader regulatory climate is increasingly focused on ensuring parental awareness, consent mechanisms, and robust data protection across online services used by young users.
In related coverage, some reports note that games and services associated with major platforms occasionally offer promotions or changes that affect accessibility for users with different subscription plans. While these items are distinct from the FTC action, they illustrate the evolving landscape of digital privacy, user rights, and platform accountability across major tech companies. [via The Verge]