2022-28581. Epic Games, Inc.; Analysis of Proposed Consent Order To Aid Public Comment

AGENCY:

Federal Trade Commission.

ACTION:

Proposed consent agreement; request for comment.

SUMMARY:

The consent agreement in this matter settles alleged violations of Federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the draft complaint and the terms of the consent order—embodied in the consent agreement—that would settle these allegations.

DATES:

Comments must be received on or before February 3, 2023.

ADDRESSES:

Interested parties may file comments online or on paper by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Please write “Epic Games, Inc.; File No. 192 3203” on your comment and file your comment online at https://www.regulations.gov by following the instructions on the web-based form. If you prefer to file your comment on paper, please mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT:

James Doty (202-326-2628), Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

Pursuant to section 6(f) of the Federal Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule § 2.34, 16 CFR 2.34, notice is hereby given that the above-captioned consent agreement containing a consent order to cease and desist, having been filed with and accepted, subject to final approval, by the Commission, has been placed on the public record for a period of 30 days. The following Analysis to Aid Public Comment describes the terms of the consent agreement and the allegations in the complaint. An electronic copy of the full text of the consent agreement package can be obtained at https://www.ftc.gov/​news-events/​commission-actions.

You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before February 3, 2023. Write “Epic Games, Inc.; File No. 192 3203” on your comment. Your comment—including your name and your state—will be placed on the public record of this proceeding, including, to the extent practicable, on the https://www.regulations.gov website.

Because of heightened security screening, postal mail addressed to the Commission will be subject to delay. We strongly encourage you to submit your comments online through the https://www.regulations.gov website.

If you prefer to file your comment on paper, write “Epic Games, Inc.; File No. 192 3203” on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), Washington, DC 20580.

Because your comment will be placed on the publicly accessible website at https://www.regulations.gov, you are solely responsible for making sure your comment does not include any sensitive or confidential information. In particular, your comment should not include sensitive personal information, such as your or anyone else's Social Security number; date of birth; driver's license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure your comment does not include sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any “trade secret or any commercial or financial information which . . . is privileged or confidential”—as provided by Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule § 4.10(a)(2), 16 CFR 4.10(a)(2)—including competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.

Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled “Confidential,” and must comply with FTC Rule § 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule § 4.9(c). Your comment will be kept confidential only if the General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted on the https://www.regulations.gov website—as legally required by FTC Rule § 4.9(b)—we cannot redact or remove your comment from that website, unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule § 4.9(c), and the General Counsel grants that request.

Visit the FTC Website at http://www.ftc.gov to read this document and the news release describing the proposed settlement. The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding, as appropriate. The Commission will consider all timely and responsive public comments it receives on or before February 3, 2023. For information on the Commission's privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/​site-information/​privacy-policy.

Analysis of Proposed Consent Order To Aid Public Comment

The Federal Trade Commission (“FTC” or “Commission”) has accepted, subject to final approval, an agreement containing a consent order from Epic Games, Inc. (“Respondent”). The proposed consent order has been placed on the public record for 30 days for receipt of comments written by interested persons. Comments received during this period will become part of the public record. After 30 days, the Commission will again review the agreement and the comments received and will decide whether it should withdraw from the agreement or make final the agreement's proposed order.

Respondent is the developer and distributor of the video game Fortnite. Respondent bills users for the purchase of virtual currency (V-bucks) and also bills users' V-bucks for the purchase of items within Fortnite. This matter concerns Epic's (1) billing for charges without having obtained account holders' express, informed consent and (2) deactivating the accounts of consumers who exercise their right to dispute charges.

The Commission's proposed complaint alleges that Epic saved parental credit card information by default and permitted subsequent unauthorized purchases by children. Specifically, children were permitted to make V-bucks purchases simply by pressing buttons, without parental or card holder action or consent (for example, without entry of a pin, password, or CVV number). Epic has also billed users of all ages for unauthorized V-bucks charges within Fortnite; Epic designed purchase flows within the game so that unwanted charges were easy to incur, as Epic was aware from the more than one million complaints it received about the issue. Finally, Epic has deactivated—in many cases, permanently—the accounts of consumers who disputed unauthorized charges, denying them access to paid-for content.

The proposed consent order contains provisions designed to prevent Respondent from engaging in similar acts or practices in the future. Part I prohibits Respondent from billing consumers for charges without procuring their express, informed consent. Part II bars Respondent from denying consumers access to their accounts based on their exercise of chargeback rights. Part III requires Respondent to pay $245,000,000 in monetary relief. Part IV contains additional requirements regarding monetary relief. Part V requires Respondent to provide sufficient customer information to enable the Commission to administer consumer redress.

Parts VI through X are reporting and compliance provisions. Part VI requires Respondent to acknowledge receipt of the order, to provide a copy of the order to certain current and future principals, officers, directors, and employees, and to obtain an acknowledgement from each such person that he or she has received a copy of the order. Part VII requires Respondent to file a compliance report within one year after the order becomes final and to notify the Commission within 14 days of certain changes that would affect compliance with the order. Part VIII requires Respondent to maintain certain records, including records necessary to demonstrate compliance with the order. Part IX requires Respondent to submit additional compliance reports when requested by the Commission and to permit the Commission or its representatives to interview Respondent's personnel. Finally, Part X is a “sunset” provision, terminating the order after twenty (20) years, with certain exceptions.

The purpose of this analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed order or to modify its terms in any way.

By direction of the Commission.

April J. Tabor,

Secretary.

Concurring Statement of Commissioner Christine S. Wilson

Today, the FTC announced a settlement with Epic Games, the creator of the popular online video game Fortnite. I support and applaud this enforcement action, which takes important steps to protect the online privacy of children, including teens. And I am grateful to our talented staff for their excellent work on this case, which incorporates a noteworthy unfairness count and novel but fully warranted injunctive relief. This case clearly exemplifies the harms of insufficient privacy protections, particularly for children. Concerned parents may wish to review the FTC's helpful website with resources about protecting kids online.^[1]

I write separately to explain my support both for the unfairness count and the groundbreaking injunctive relief. Section 5 of the FTC Act provides the necessary flexibility to address emerging threats to consumers from new industries and evolving technologies.^[2] But the Commission's unfairness authority is not unbounded. As I have previously noted, the FTC must observe the boundaries of its statutory authority and operate within the jurisdictional limits set by Congress.^[3] Here, however, the elements of the unfairness test are clearly satisfied—because Epic Games allegedly opted children into voice and text communications with players around the world, children were exposed to bullying, threats, and harassment, and were enticed or coerced into sharing sexually explicit images and meeting offline for sexual activity.^[4] And the novel injunctive mechanisms, which require Epic Games to implement heightened privacy default settings, directly address the privacy harms fostered by the company's alleged business practices.

I also write separately to underscore the dangers of insufficient privacy protections, particularly for children, including teens. As I write, close to three million gamers around the globe are playing Fortnite.^[5] In the Battle Royale mode, players are matched with up to 99 other gamers in a format that allows combatants to communicate with each other via voice and text. Despite knowing that adults and children play the video game concurrently, Epic Games allegedly failed to prioritize the safety of its young players when the company implemented default settlings that allowed strangers to communicate with children and teens. The complaint details how Epic Games chose to opt children into conversations with unknown adults despite repeated warnings from game designers, users, parents, and others that this approach violated industry norms and carried significant risks.

The results? I offer three examples:

In 2018, a 13-year-old boy (called MV#1 in court pleadings) told his doctor he was stressed because an adult male named “Gavin” whom he met while playing Fortnite planned to travel from “Gavin's” home in Pennsylvania to MV#1's home in Georgia for a visit. MV#1 wrote down a list of things “Gavin” wanted him to do, including “blow job, making out, kissing, cuddling, and fingering.” “Gavin,” later identified as Gregory Mancini, flew to Georgia in November 2018 and proposed to meet MV#1 at a Waffle House, where Mancini was arrested. A subsequent search of Mancini's computer “uncovered . . . child sexual abuse material depicting very young minors, including images involving adult males engaged in sexual abuse of boys appearing to be about two years of age.” ^[6]

Also in 2018, Sergeant Christopher S. Gilbert met “Miss MN” online playing Fortnite. Using the voice chat feature in the game, “Miss MN” told Gilbert she was 13 years old, and Gilbert told her he was 22. The two traded Instagram account names and began exchanging private messages through the Instagram text messaging feature. A court subsequently concluded that Gilbert sexually abused “Miss MN” by sending her digital pictures and videos of his penis, engaged in inappropriate sexual conversations with her, and attempted to guilt her into sending nude images of herself. A subsequent search of Gilbert's phone revealed child pornography. Gilbert was convicted of sexual abuse of a child and possession of child pornography.^[7]

And in 2019, Juan Carlos Sandoval-Guerrero, using Fortnite, coerced a young child (called Victim B in court pleadings) into sending images that portray Victim B “displaying his penis, masturbating his penis with his hand and penetrating his anus with his finger. In some videos, Victim B can be seen wearing a wireless headset of the type . . . typically associated with video game systems like Xbox. During one of the videos, Victim B can be heard talking about the points he got on a game while he is masturbating his penis.” In 2021, Sandoval-Guerrero pled guilty to the production and attempted production of child pornography in violation of 18 U.S.C. 2251(a), (e).^[8]

These examples should concern any parent whose kids enjoy playing online video games. And they should serve as a wake-up call to skeptics who believe that invasions of privacy lead merely to targeted advertising.

Numerous news articles have reported that Fortnite and other online games foster a target-rich hunting ground for sexual predators.^[9] The National Center for Missing & Exploited Children, the nation's centralized reporting system for suspected child sexual exploitation, received more than 29.3 million reports of suspected child sexual exploitation in 2021, including over 44,000 reported incidents of online enticement of children for sexual acts.^[10] And the organization noted that the reports of online enticement have been growing more numerous each year. During my tenure as a Commissioner, I have been an ardent advocate for federal privacy legislation,^[11] in part because of the pernicious risks threatening children's safety online.^[12]

I am not a Luddite. I recognize that children's lives can be enriched through social media, gaming, and other online resources. But online activity comes with risks, especially when internet products have flawed or non-existent safeguards. The FTC's Section 5 authority does not reach, and cannot prevent, every danger facing teens and children on the internet today. Here, however, I am comfortable with this use of our unfairness authority, and I am supportive of the groundbreaking injunctive relief requiring privacy-protective settings for children and teens, because I have reason to believe that Epic Games knew that its products and/or services presented a substantial risk of harm and did not take simple steps to address that risk.

Footnotes

1.   Protecting Kids Online, Fed. Trade Comm'n, https://consumer.ftc.gov/​identity-theft-and-online-security/​protecting-kids-online (last visited Dec. 18, 2022).

2.  The Agency has used this flexible standard to address online harms like digital stalking (Compl., Retina-X Studios, LLC, No. 172-3118 (filed Oct. 22, 2019), https://www.ftc.gov/​system/​files/​documents/​cases/​172_​3118_​retina-x_​studios_​complaint_​0.pdf), revenge porn (Compl., Emp Media, Inc., No. 162-3052 (filed July 9, 2018), https://www.ftc.gov/​system/​files/​documents/​cases/​1623052_​myex_​complaint_​1-9-18.pdf), and invasions of people's homes through web cameras (Compl., TRENDnet, Inc., No. 122-3090 (filed Feb. 7, 2014), https://www.ftc.gov/​enforcement/​casesproceedings/​122-3090/​trendnet-inc-matter). See also Daniel J. Solove & Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L. Rev. 583 (2014) (describing the FTC's role since the late 1990s in enforcing privacy statutes and companies' privacy practices).

3.  Dissenting Statement of Commissioner Christine S. Wilson, Policy Statement on Breaches by Health Apps and Other Connected Devices (Sept. 15, 2021), https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1596356/​wilson_​health_​apps_​policy_​statement_​dissent_​combined_​final.pdf; Dissenting Statement of Commissioner Christine S. Wilson, Final Rule related to Made in U.S.A. Claims (July 1, 2021), https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1591494/​2021-07-01_​commissioner_​wilson_​statement_​musa_​final_​rule.pdf; Statement of Commissioner Christine S. Wilson Concurring in Part, Dissenting in Part, Notice of Proposed Rulemaking related to Made in U.S.A. claims (June 22, 2020), https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1577099/​p074204musawilsonstatementrev.pdf.

4.   See Compl., Epic Games, Inc., No. 222-3087 (filed Dec. 19, 2022).

5.   Fortnite Live Player Count, Player Counter, https://playercounter.com/​fortnite/​ (last visited Dec. 18, 2022).

6.  Sentencing Mem. of the U.S., United States v. Mancini, No. 1:20-cr-00031-SPB (W.D. Pa. Apr. 25, 2022).

7.   United States v. Gilbert, ARMY 20190766, 2020 WL 4458493 (Army Ct. Crim. App. July 31, 2020).

8.  Plea Agreement, United States v. Sandoval-Guerrero, No. 4:20-CR-06009-SMJ-1 (E.D. Wash. Apr. 1, 2021).

9.  Paige Gross, Predators are using Fortnite to Lure kids. Cops say parents need to worry, NJ.com (Sept. 21, 2018 12:30 p.m.), https://www.nj.com/​news/​2018/​09/​fortnite_​mindcraft_​join_​other_​platforms_​where_​pred.html (warning the public about popular apps being used by people to abuse and exploit teens and children); Nellie Bowles and Michael H. Keller, Video Games and Online Chats Are `Hunting Grounds' for Sexual Predators, N.Y. Times, Dec. 7, 2019, https://www.nytimes.com/​interactive/​2019/​12/​07/​us/​video-games-child-sex-abuse.html (detailing the efforts of criminals to make virtual connections in order to exploit and abuse children, including teens, through gaming and social media platforms); Dustin Racioppi, `People don't want to talk about it,' but reports of kids being exploited online have spiked amid coronavirus pandemic, USA Today, Oct. 22, 2020, https://www.usatoday.com/​story/​news/​nation/​2020/​10/​22/​coronavirus-child-abuse-nj-online-child-exploitation-reports-increase/​6004205002/​ (discussing the epidemic of online child exploitation during the coronavirus pandemic).

10.   CyberTipline 2021 Report, Nat'l Ctr. for Missing and Exploited Child., https://www.missingkids.org/​gethelpnow/​cybertipline/​cybertiplinedata#overview.

11.  Oral Statement of Commissioner Christine S. Wilson, FTC, Before the U.S. House Committee on Energy and Commerce Subcommittee on Consumer Protection and Commerce (July 28, 2021), https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1592954/​2021-07-28_​commr_​wilson_​house_​ec_​opening_​statement_​final.pdf; Christine Wilson, Op-Ed, Coronavirus Demands a Privacy Law, WALL ST. J., May 13 2020, available at https://www.wsj.com/​articles/​congress-needs-to-pass-a-coronavirus-privacy-law-11589410686; Oral Statement of Commissioner Christine S. Wilson, FTC, Before the U.S. Senate Committee on Commerce, Science, and Transportation (April 20, 2021), https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1589180/​opening_​statement_​final_​for_​postingrevd.pdf; Christine Wilson, Privacy in the Time of Covid-19, TRUTH ON THE MARKET (Apr. 15, 2020), https://truthonthemarket.com/​author/​christinewilsonicle/​; Christine S. Wilson, A Defining Moment for Privacy: The Time is Ripe for Federal Privacy Legislation, Remarks at the Future of Privacy Forum, Feb. 6, 2020, https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1566337/​commissioner_​wilson_​privacy_​forum_​speech_​02-06-2020.pdf; Oral Statement of Commissioner Christine S. Wilson Before the U.S. House Committee on Energy and Commerce Subcommittee on Consumer Protection and Commerce (May 8, 2019), https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1592954/​2021-07-28_​commr_​wilson_​house_​ec_​opening_​statement_​final.pdf; Oral Statement of Commissioner Christine S. Wilson, FTC, Before the U.S. Senate Committee on Commerce, Science, and Transportation Subcommittee on Consumer Protection, Product Safety, Insurance, and Data Security (Nov. 27, 2018), https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1423979/​commissioner_​wilson_​nov_​2018_​testimony.pdf.

12.  Christine S. Wilson, The FTC's Role in Supporting Online Safety, Remarks at the Family Online Safety Institute, Nov. 21, 2019, https://www.ftc.gov/​system/​files/​documents/​public_​statements/​1557684/​commissioner_​wilson_​remarks_​at_​the_​family_​online_​safety_​institute_​11-21-19.pdf.