The Epic Games FTC Settlement

What $520 Million in Penalties Means for Gaming Platform Accountability

A Record-Breaking Settlement

In December 2022, the Federal Trade Commission secured what remains the largest penalty in FTC history against a gaming company: $520 million from Epic Games, maker of the wildly popular Fortnite. The settlement addressed both children’s privacy violations and deceptive design practices that manipulated players—including children—into making unwanted purchases.

The Epic settlement offers a blueprint for platform accountability and demonstrates that regulators are willing to pursue aggressive enforcement against companies that fail to protect young users. For families harmed by other platforms, it shows that accountability is possible.

[Source: https://www.ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations]

Two Separate Violations

The FTC’s action involved two distinct complaints:

Children’s Privacy Violations ($275 million): Epic violated the Children’s Online Privacy Protection Act (COPPA) by collecting personal information from children under 13 without obtaining their parents’ verifiable consent. This penalty was the largest ever imposed for violating an FTC rule.

Dark Patterns and Deceptive Billing ($245 million): Epic used manipulative design tricks to cause players to make unintended purchases and charged accounts without proper authorization. This amount was designated for consumer refunds—the largest administrative order in FTC history.

[Source: https://www.cnn.com/2022/12/19/tech/fortnite-epic-ftc-settlement

The COPPA Violations

COPPA requires operators of websites and online services directed at children under 13 to notify parents and obtain verifiable consent before collecting children’s personal information. The FTC found Epic violated these requirements in multiple ways:

Collecting without consent: Epic collected children’s full names, email addresses, and usernames, and allowed children to participate in real-time interactive features without parental consent.

Ignoring actual knowledge: Epic was aware through surveys, licensing deals for children’s toys, and player support communications that many Fortnite players were under 13—yet took no meaningful steps to comply with COPPA.

Obstructing deletion requests: When parents did request deletion of their children’s data, Epic required them to “jump through extraordinary hoops” and sometimes failed to honor requests.

Disclaiming COPPA obligations: For the first two years of Fortnite’s operation, Epic’s privacy policy “disavowed” that its services were directed to children. The FTC made clear that such disclaimers don’t shield companies from COPPA liability when the facts show otherwise.

[Source: https://www.orrick.com/en/Insights/2023/02/6-Top-Takeaways-from-FTCs-Landmark-Epic-Games-Settlements]

Harmful Default Settings

Perhaps most significantly, the FTC charged Epic with an unfair practice under Section 5 of the FTC Act: enabling voice and text chat by default for all users, including children and teens.
Fortnite’s matchmaking system connected children with strangers during gameplay while broadcasting their display names and allowing real-time voice and text communication. The FTC documented that this resulted in:

Children being bullied, threatened, and harassed

Sexual harassment of minors during gameplay

Exposure to dangerous and traumatizing interactions

Epic employees warned about these risks as early as 2017, recommending changes to default settings. According to the FTC, “the company resisted turning off the default settings” despite reports of children being harassed, “including sexually.”

[Source: https://www.bakerbotts.com/thought-leadership/publications/2023/january/ftcs-520-million-settlement-with-epic-games]

Dark Patterns in Game Design

The deceptive billing complaint detailed how Epic used “dark patterns”—manipulative design choices—to trick players into unwanted purchases:

Confusing button configurations: Players could be charged while attempting to wake the game from sleep mode, during loading screens, or by accidentally pressing buttons adjacent to purchase prompts.

Hidden cancellation options: Epic “purposefully obscured cancel and refund features to make them more difficult to find.”

No parental controls on purchases: Until 2018, children could make in-game purchases simply by pressing buttons, with no parental or cardholder consent required.

Account lockouts: When customers disputed unauthorized charges with their credit card companies, Epic locked their accounts rather than addressing the billing issues.

The FTC noted that Epic ignored more than 1 million user complaints and “repeated employee concerns that ‘huge’ numbers of users were being wrongfully charged.”

[Source: https://variety.com/2022/digital/news/epic-games-ftc-settlement-fortnite-kids-privacy-deceptive-practices-1235465164/]

Required Changes

Beyond the monetary penalties, the settlement required Epic to fundamentally change its practices:

Privacy defaults for children and teens: Voice and text communications must be turned off by default. Parents must provide affirmative consent for children under 13, and teens or their parents must consent for users 13-17.

Data deletion: Epic must delete personal information collected from children in violation of COPPA unless it obtains parental consent to retain the data.

Comprehensive privacy program: Epic must establish a privacy program addressing the violations and submit to regular independent audits.

End to dark patterns: The company must eliminate deceptive billing practices, make cancellation easy, and stop locking accounts over chargebacks.

Payment confirmation: New “hold-to-purchase” mechanics require users to confirm purchase intent.

[Source: https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20221227-settlement-with-epic-games-highlights-continued-focus-by-regulators-on-unfair-privacy-practices-teens-and-user-interface-design]

Precedent for Future Enforcement

The Epic settlement established important precedents for platform accountability:

COPPA applies despite disclaimers: Companies cannot disclaim their way out of children’s privacy obligations. If a service is directed to children or the company has actual knowledge children are using it, COPPA applies.

Default settings can be unfair practices: For the first time, the FTC alleged that public-by-default privacy settings constituted an unfair practice. This theory could apply to any platform with communication features that expose children to strangers.

Teen privacy matters: The settlement extended heightened privacy protections to teens 13-17, who aren’t covered by COPPA. This signals regulatory interest in adolescent privacy beyond current statutory requirements.

Penalties will escalate: The trajectory from TikTok/Musical.ly’s $5.7 million fine to Google/YouTube’s $170 million to Epic’s $275 million shows regulators are willing to impose increasingly severe penalties.

[Source: https://www.esrb.org/privacy-certified-blog/wrapping-up-2022-with-a-huge-epic-fortnite-privacy-case/]

Implications for Roblox and Similar Platforms

The Epic settlement has direct implications for the ongoing Roblox litigation and similar cases against gaming platforms:

Knowledge creates liability: Like Epic, Roblox allegedly knew children used its platform and knew about safety risks. The Epic case shows this knowledge creates accountability.

Default settings matter: Platforms that enable communication between children and strangers by default face potential liability for resulting harms.

Employee warnings are damning: Epic employees raised concerns that were ignored. Similar allegations appear in the Roblox complaints.

Partial compliance isn’t enough: Epic’s eventually-implemented parental controls didn’t shield it from liability for years of violations.

FTC Chair Lina Khan stated the settlements “make clear to businesses that the FTC is cracking down on these unlawful practices.” Platforms operating children’s services should take notice.

[Source: https://www.ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations]

Consumer Refunds

The $245 million in dark patterns penalties was designated for consumer refunds. The FTC made payments available to:

Parents whose children made unauthorized credit card purchases in the Epic Games Store between January 2017 and November 2018

Fortnite players charged for unwanted in-game items between January 2017 and September 2022

Players whose accounts were locked after disputing unauthorized charges between January 2017 and September 2022

This consumer redress component demonstrates that enforcement can provide direct relief to harmed families, not just penalties paid to the government.

[Source: https://variety.com/2022/digital/news/epic-games-ftc-settlement-fortnite-kids-privacy-deceptive-practices-1235465164/]

The Impact of the Epic Games Settlement

The Epic Games settlement represents a watershed moment in gaming platform accountability. The record-breaking penalties, combined with required changes to business practices, show that regulators can effectively address both children’s privacy violations and deceptive design.

For families harmed by other platforms, Epic’s settlement provides both legal precedent and hope. The FTC’s theories—particularly around harmful default settings and knowledge-based liability—apply broadly to gaming and social media platforms that expose children to risk.

As the Roblox MDL and similar cases proceed, Epic’s $520 million day of reckoning looms as a reminder of what accountability can look like—and what gaming platforms have at stake if they continue to prioritize engagement over child safety.

Get Help Understanding Your Rights

Regulatory actions and major settlements can signal that platforms have real obligations to protect kids, but every situation is different. If you believe a companys design choices, safety failures, or billing practices harmed your child or family, it is worth getting a legal review that focuses on the specific facts of what happened.

Contact Alonso Krangle at [PHONE] for a free consultation. The conversation is confidential, and we can explain your rights, potential next steps, and what information can help evaluate a possible claim.