Almost from the beginning, Epic Games and its mass-multiplayer game Fortnite have been tied to discussions of the metaverse, an immersive parallel online world branded as a successor internet. More than a video game, Fortnite is a place where people—especially young people—go to hang out with friends, or maybe attend virtual concerts, like the ones performed on the platform by Ariana Grande, Travis Scott, and Lil Nas X.
“Fortnite isn’t the Metaverse, but nothing is closer to the Metaverse today in spirit and it is clear how the ‘game’ might eventually underpin one,” venture capitalist and metaverse theorist Matthew Ball wrote in an influential essay in 2020.
Little wonder, then, that the LEGO Group teamed up with Epic earlier this year to create metaverse play spaces for kids—spaces that LEGO CEO Niels Christiansen said would need to be “safe, inspiring and beneficial for all.”
But LEGO may want to keep a close eye on its partner. In two separate settlements announced on Dec. 19, the US Federal Trade Commission (FTC) said Epic Games violated the children’s privacy law (COPPA) with Fortnite and used deceptive billing tactics targeting its youngest users.
Epic agreed to pay $520 million to settle the two lawsuits.
“No developer creates a game with the intention of ending up here,” the company said in a statement about the settlements. “We accepted this agreement because we want Epic to be at the forefront of consumer protection and provide the best experience for our players.”
US Congress passed COPPA into law in 2000 to protect the privacy of children under 13 on the internet.
“Even though Fortnite is directed to children, and even when Epic had actual knowledge that Fortnite users were children, Epic failed to comply with the COPPA Rule’s parental notice, consent, review, and deletion requirements,” the first complaint against Epic (pdf) alleges.
The second complaint against Epic (pdf) accused the company of employing “dark patterns,” or design choices intended to trick users, and then making it difficult to dispute charges. The FTC alleged that “millions of consumers have complained to Epic” and disputed their credit card charges, generally without success.
Under a new consent decree, Epic agreed to disable voice and text communications for users under 13 unless it received parental consent, and would do the same for teenagers unless it received affirmative consent. The privately held company also agreed to delete illegally obtained data from users under 13 and vowed to “establish a comprehensive privacy program” and obtain regular third-party audits.
Fortnite has 400 million users, according to the FTC’s figures. (For reference, Twitter has fewer than 300 million.) The game uses a “freemium” model, whereby users play the game for free but purchase “skins”—items that users can buy within the game to customize their avatar’s appearance.
“Pushing a button to complete a purchase is one of the most commonly used and easiest mechanics to complete online purchases,” Epic said in its settlement statement. But “[g]ames should go above and beyond to make sure players even more clearly understand when they are making a purchase with real money or with virtual currencies to prevent accidental purchases. ... We’ve updated our payment flows with a hold-to-purchase mechanic that re-confirms a player’s intent to buy, as an additional safeguard to prevent unintended purchases alongside instant purchase cancellations and self-service refunds.”
The huge popularity of Fortnite has led to other legal entanglements for Epic, in some cases with the North Carolina-based company on the offensive. For example, sued Apple over its app-store fees and prohibitions on third-party payment processors, alleging that Apple’s rules amounted to anticompetitive behavior. Epic lost in court on the bulk of its charges, but is appealing the decision.