This week the Federal Trade Commission unveiled hefty settlements with Epic Games Inc.—the creator of the video game Fortnite—to resolve separate actions alleging violations of Section 5 of the FTC Act and the Children’s Online Privacy Protection Act (COPPA), respectively.

Epic Games will pay $245 million in consumer redress to settle the alleged Section 5 violations in an FTC administrative proceeding and will pay $275 million in monetary penalties to settle the COPPA action in federal court. The cases highlight two hot spots for the FTC—dark patterns and children’s privacy.

In its administrative complaint, the FTC alleges that Epic Games used dark patterns, making the gameplay interface confusing and tricking players into making in-game purchases, often when they did not intend to. Specifically, the complaint alleges that:

• Fortnite players can make in-game purchases with “V-Bucks” to enhance their gaming experience. Gamers could acquire V-Bucks simply by pressing buttons with no parental or card-holder action or consent. As a result, Epic Games automatically billed the parents’ stored payment information for the V-Bucks without any steps for the parents to authorize the payments or without offering any mechanism for the parents to enable such a control.
• Gamers can view items available for in-game purchases in the Fortnite Item Shop, with a few options available to either purchase the item, preview the item, or go back to the Item Shop. On mobile devices, for example, the button to preview different outfit styles appears directly below the button to purchase the item. If the “purchase” button is pressed, Epic Games immediately deducts the cost of the item from the player’s V-Bucks balance without any confirmation. Moreover, the button to purchase items on video game consoles is also associated with other actions in different contexts. Again, if the button is pressed at the wrong time, the player will immediately be charged without confirming the V-Bucks payment.
• Epic Games locked accounts of customers who disputed unauthorized charges with their credit card companies. These customers lost access to all content they had purchased. Even when Epic Games agreed to unlock an account, consumers were warned they could be banned for life if they disputed future charges.

The FTC asserted that Epic Games began and persisted engaging in these practices despite law enforcement actions in prior cases for failing to obtain parents’ consent to charges in children’s gaming apps. Moreover, the FTC claims Epic ignored over a million user complaints and repeated employee concerns regarding wrongful charges, and even purposefully obscured cancel and refund features to make them more difficult to find.

To settle these charges, the proposed administrative order requires refunds to consumers totaling $245 million, and prohibits Epic from charging consumers through the use of dark patterns and without obtaining their affirmative, express, informed consent. The order also requires a cancellation mechanism as simple as the means used to initiate the charge. The order also bars Epic from blocking access to consumers’ accounts for disputing unauthorized charges. The settlement marks the FTC’s largest refund amount in a gaming case, and the largest financial settlement in an administrative order in FTC history.

The complaint in the COPPA action, filed on the FTC’s behalf by the Department of Justice in the Eastern District of North Carolina, details how Fortnite collected users’ unique device and account IDs, as well as other persistent identifiers, to keep track of players’ progress, purchases, settings, and friends lists, all without notifying their parents or obtaining verifiable parental consent as required by COPPA.

The FTC also took issue with Fortnite‘s default settings, which, according to the FTC, facilitated bullying and harassment. For example, while users played Fortnite, voice and text chat features allowing users to communicate with one another, including strangers, were turned on by default. The FTC and DOJ asserted these default settings exposed children and teens to “dangerous and psychologically traumatizing issues, such as suicide and self-harm.”

The proposed order obligates Epic Games to delete all of the data it collected in violation of COPPA and to establish a comprehensive privacy program. In addition, the order prohibits Epic Games from turning on the communication features without affirmative consent. Finally, the order includes a $275 million monetary penalty—the largest penalty ever obtained for violating an FTC rule. The combined settlement totals $520 million.

These cases and settlements underscore a growing scrutiny by the FTC of the video game industry, including two ongoing merger challenges in the industry.

Now the FTC’s targeting of Epic Games for alleged dark patterns suggests the FTC has its sights set on the increasingly populous virtual world of gaming, an area where it seems to see much potential for unfair or deceptive business practices and a growing need for regulatory intervention. This case should serve as a reminder to gaming companies, and online sellers in general, that billing practices should not be confusing or misleading, and that sellers should always obtain affirmative consumer consent for any charges.

For more insights into advertising law, bookmark our All About Advertising Law blog and subscribe to our monthly newsletter. 

The authors thank Jay V. Prapaisilp, a law clerk in Venable’s Washington, DC office, for his assistance in writing this article.