Xbox FTC Settlement and Reimagining the Future of Safety on Xbox

At Xbox, we have the fundamental commitment to provide all players with a safe and secure experience on our platform – and this is especially true for our youngest players. In collaboration with the community and regulators, we constantly improve our security measures. Recently, we reached a settlement agreement with the U.S. Federal Trade Commission to improve our system’s data retention and update our account-creation process. We regrettably did not live up to customer expectations. However, we are determined to follow the orders to further improve our safety measures. We believe that we can and should do more, and we’ll remain steadfast in our commitment to safety, privacy, and security for our community.

During our two decades in the safety industry, we have learned that players are concerned about their privacy and safety. Since 2005, when we launched the first console that could connect players online, we’ve continued to invest in tools and technologies to protect our community. This work has evolved into a comprehensive safety strategy. The suite of privacy, safety and security features we offer is designed to protect player privacy, while giving players and their parents or caregivers the power to control and manage their gaming experience.

Below we detail the changes we made to verify child accounts, however, our work on age validation doesn’t stop there. This is an excellent opportunity for us to continue to advance the development of safe digital experiences, which are easy to use and accessible to all players. We are innovating on next-generation identity and age validation – a convenient, secure, one-time process for all players that will allow us to better deliver customized, safe, age-appropriate experiences. Children and families will reap the benefits in the future. While we believe this to be the future for the gaming industry as a whole, we also expect that it will become the norm.

Over the coming months, we will test new methods to validate age and take feedback from our customers’ experience. Learnings from the trials will be used to advance our systems for player identification. We are incorporating Microsoft’s insights from across industries to develop a principled approach to secure digital identities that minimizes data collection, prioritizes security, and makes it easier for players to understand how their data is used.

We’ll continue to put players at the center – giving them full control over their online experiences and digital identities. We’ll continue to empower parents and caregivers to exercise appropriate oversight of the gaming experience for their children and families, in addition to tools like the Xbox Family Settings App and child accounts. Parents and caregivers are able to control settings, privacy and spend by creating child accounts for players under the age of 18. As we have done in the past, we will remain transparent about our actions and be clear when it comes to our service.

The Xbox community is our community – one we shape together. As we innovate and trial new experiences, we’ll work with the community to gather feedback so we can create a safer gaming experience together.

What this settlement means to players

After the FTC settled, we updated our account registration process. Players must now provide us with their birth date and obtain consent from parents if you are below 13 years of age before we can ask for any personal information like a telephone number or email. This updated process ensures that we can identify potential child accounts immediately and make clear to parents and caregivers the next steps to protect their children’s data and play safely on our network.

Over the coming months, players who are under the age of 13 and created an account prior to May 2021 will require parental reconsent – meaning a parent will be prompted to reverify the account and grant permission for their child to continue gameplay and activity on Xbox. Our goal is to make this as easy as possible. We are working hard to ensure that when parents are prompted to reconsent, they will have the information needed to proceed without disruptions to their child’s access. Visit this page to learn how to set up a child’s account.

We discovered a bug in our system that prevented us from deleting the data created by child accounts whose account creation was not complete.  Our policy only allows us to store this information for 14-days to help gamers pick up from where they stopped to finish the account creation process. Our engineers took immediate action. They fixed the problem, deleted all the data and put in place practices to avoid the mistake from occurring again. This data was never shared or used for monetary gain.

Microsoft’s Privacy Statement has been updated to include a section dedicated to how Xbox manages user data. On our new home page, we have added a clear link to Microsoft’s Privacy Statement. This link is also displayed in every area where personal data is collected. Microsoft provides families with a privacy dashboard which explains how data are collected and used. The privacy settings can be changed at any time by the player, and children’s accounts have default settings that are as strict as possible. To learn more about Xbox’s privacy features, please visit here.

More resources available for families

We want all parents, caregivers, and families to know that, more than anything else, we have their children’s safety and privacy top of mind. In order to better protect our children, we will keep communicating the changes that we make to our policies and data collected. Also, we continue to look for creative ways to inform players of online safety.

This past Safer Internet Day, we released Minecraft’s Privacy Prodigy, aimed at teaching young people about privacy and how to safeguard their sensitive personal information. This world is the second chapter in the CyberSafe series, following last year’s release of Minecraft CyberSafe: Home Sweet Hmm, reaching millions of players, with unprecedented downloads of support materials underscoring the demand by teachers and families to teach these critical skills and integrate safer online practices daily. Both CyberSafe Home Sweet Hmm, and CyberSafe Privacy Prodigy can be downloaded for free from Minecraft Bedrock and Minecraft Education Edition.

The updated Xbox Family Hub provides information on creating family groups, managing child account, as well as helping parents and caregivers to understand our safety measures, including the Xbox Family Settings App.

Please see below for more resources on Microsoft Privacy, Safety, and Responsible Gaming.