## Facts

- Epic Games, Inc. developed and released the video game Fortnite in 2017.
- From launch, Fortnite was widely played by children and young teens, and Epic marketed Fortnite with youth-oriented elements such as cartoon-like visuals, no blood or gore, and building mechanics centered on constructing forts and other creations.
- Epic also pursued licensing tied to youth audiences, including Fortnite-branded goods such as toys, clothing, and costumes, and worked with musicians and celebrities popular with children and teens.
- Fortnite’s gameplay matched players with other players worldwide, including strangers.
- Players’ account/display names were publicly broadcast.
- By default, real-time voice and text chat were enabled to encourage player-to-player communication.
- The United States alleged that these default communication features contributed to harmful in-game experiences for some children and teens, including bullying, threats, harassment (including sexual harassment), and exposure to disturbing topics such as suicide and self-harm.
- The government alleged that Epic targeted Fortnite to children and knew many users were children, yet delayed adding meaningful privacy and parental controls.
- At launch, Fortnite allegedly had no parental controls and minimal privacy settings.
- The government alleged that Epic collected, used, and disclosed personal information from children under 13 without providing parents the notices required by COPPA and without obtaining verifiable parental consent.
- The government also alleged Epic did not provide parents with required means to review children’s personal information and did not honor deletion requests as required by COPPA and the COPPA Rule.
- Between 2017 and 2019, Epic made some changes. Epic added a voice-chat off switch, but the United States alleged it was hard to find and voice chat remained on by default.
- In 2019, Epic began requiring U.S. players under age 12 to provide a parent’s email address, sending notices and seeking verifiable parental consent, but the government alleged this process did not cover millions of existing child accounts and did not change the default public-facing settings.
- On December 19, 2022, the United States, acting on behalf of the Federal Trade Commission, filed a civil enforcement action alleging COPPA/COPPA Rule violations and unfair practices under § 5(a) of the FTC Act based on Fortnite’s child data practices and default communication settings.
- The matter was resolved through a stipulated (consent) order for permanent injunctive relief and a civil penalty, rather than a litigated merits opinion.

## Issues

1. Whether Epic violated COPPA and the COPPA Rule by collecting, using, or disclosing personal information from children under 13 without required parental notice and verifiable parental consent, and by failing to provide required parental review and deletion mechanisms.
2. Whether Epic’s default settings that publicly broadcast child account names and enabled real-time voice/text communications with strangers constituted an unfair act or practice under § 5(a) of the FTC Act because they allegedly created substantial, not reasonably avoidable injury not outweighed by countervailing benefits.

## Decision

- The case concluded through a stipulated order for permanent injunction and civil penalty judgment.
- Epic agreed to pay a $275 million civil penalty relating to the alleged COPPA violations (described by the government as a record civil penalty for COPPA enforcement).
- Epic was permanently enjoined from violating COPPA and the COPPA Rule in connection with products or services directed to children or where Epic has actual knowledge it is collecting personal information from children.
- The stipulated order imposed conduct restrictions and required changes directed at child and teen users, including privacy-protective default settings and limits on default real-time communications with strangers unless conditions in the order are met.
- The order required implementation of a privacy program with specified controls and independent assessments, along with related compliance, recordkeeping, and reporting obligations.
- As typical in consent resolutions, Epic did not admit liability beyond jurisdictional matters, and the order’s terms reflect negotiated relief rather than a judicial interpretation of disputed legal questions.

## Legal Principles

- COPPA and the COPPA Rule apply to operators of online services directed to children under 13 and to operators with actual knowledge they collect personal information from children under 13.
- COPPA generally requires clear parental notice and verifiable parental consent before collecting, using, or disclosing a child’s personal information, subject to limited exceptions set out in the statute and rule.
- COPPA requires that parents be given a means to review a child’s personal information and to request deletion, and operators must comply with those requests consistent with the rule.
- FTC Act § 5(a) prohibits unfair or deceptive acts or practices in or affecting commerce; an “unfair” practice is assessed under the substantial-injury / not-reasonably-avoidable / countervailing-benefits framework.
- In the government’s theory of liability, default product settings that place children and teens into real-time communications with strangers and publicly broadcast identifiers can qualify as unfair when they create meaningful risk of harm that minors cannot reasonably prevent on their own.
- A stipulated order (consent decree) resolves the case without a litigated merits ruling; it provides binding injunctive terms and monetary relief but typically carries limited precedential value on statutory interpretation.

## Conclusion

In *United States v. Epic Games, Inc.*, filed December 19, 2022, the United States (on behalf of the FTC) alleged that Epic’s operation of Fortnite violated COPPA by collecting and using children’s personal information without required parental notice, verifiable parental consent, and parental access/deletion mechanisms, and further alleged that Fortnite’s default public display names and on-by-default voice/text chat with strangers were unfair under FTC Act § 5(a). The matter ended by consent order requiring injunctive changes and compliance measures and imposing a $275 million COPPA civil penalty, without a contested merits decision.


United States v. Epic Games, Inc., No. 5:22-CV-00518 (Dec. 19, 2022)