Xbox (Microsoft)

Microsoft's $20 million COPPA fine for collecting children's data on Xbox Live without parental consent worked out to roughly 0.04% of Microsoft's $56.2 billion revenue for the SINGLE QUARTER the settlement was announced in (April-June 2023) — a fraction small enough to raise a fair question about deterrence for a company Microsoft's size. The FTC specifically said the case established that kids' AVATARS and BIOMETRIC DATA collected through a game console count as protected children's data just like a name or email address would.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.ftc.gov/news-events/news/press-releases/2023/06/ftc-will-require-microsoft-pay-20-million-over-charges-it-illegally-collected-personal-information — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected (Microsoft's Xbox Services Agreement).

Data sharing

$20 MILLION FTC/DOJ COPPA SETTLEMENT (2023, still governing precedent): the FTC alleged Microsoft knowingly collected personal information (including phone numbers) from children under 13 signing up for Xbox Live WITHOUT parental notice/consent; separately, even when Microsoft DID provide some parent notice, the FTC found it was incomplete and failed to meet COPPA's specific disclosure requirements; AND when children started but did not finish creating an Xbox Live account, Microsoft retained their personal information LONGER than COPPA permits. The FTC's Samuel Levine stated the action 'should also make it abundantly clear that kids' avatars, biometric data, and health information are not exempt from COPPA' — an explicit statement that in-game avatars and biometric data collected via gaming hardware (e.g., Kinect-style sensors, controllers) count as protected children's data. ADDITIONAL CONTEXT: this $20 million COPPA penalty equals roughly 0.04% of Microsoft's $56.2 billion revenue for the quarter in which it was announced (April-June 2023) — small enough relative to Microsoft's business to raise a fair question about deterrence.

Contacts

Privacy contact. No published privacy email; Microsoft routes requests via microsoft.com/concern/privacy (30-day response commitment)

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA