Epic Games and the Federal Trade Commission reached a $520 million settlement over claims the Fortnite developer broke online privacy protection laws for kids and tricked players into buying in-game items (via The Wall Street Journal). The settlement includes a record $275 million penalty to settle alleged violations of the Children’s Online Privacy Protection Rule (COPPA) and $245 million over a purchasing setup that could trick players and allow them to buy things by accident.

Fortnite made over $9 billion during its first two years in existence.

In its complaint, the FTC alleges Epic collected personal information from Fortnite players under the age of 13 without their parent’s knowledge or consent. The agency also claims Epic harmed young users by switching on text and voice chat in games by default, citing that “children and teens have been bullied, threatened, harassed, and exposed to dangerous and psychologically traumatizing issues such as suicide while on Fortnite.”

Epic has already addressed some of these concerns. Earlier this month, Epic Games rolled out new “Cabined Accounts” in Fortnite, Rocket League, and Fall Guys for kids under 13, which disables certain features, such as text and voice chat, in-game purchases, and the ability to download games that aren’t made by Epic without their parent’s consent. It also introduced parental controls in 2019 and made parent verification services free for all developers on the platform last year.

As part of the FTC’s proposed court order, Epic will need to obtain parents’ permission before enabling voice and text chat for underage players. Epic will also have to delete any personal information it previously collected from Fortnite players “unless the company obtains parental consent to retain such data or the user identifies as 13 or older through a neutral age gate.”

Epic is also paying $245 million to reimburse customers for its alleged use of dark patterns that dupe players into “making unwanted purchases and let children rack up unauthorized charges without any parental involvement.” A dark pattern is a user interface designed to trick users into selecting certain options that aren’t in the consumer’s interest.

In Epic’s case, the FTC claims Fortnite’s “counterintuitive, inconsistent, and confusing button configuration” resulted in players making hundreds of millions of dollars in unintended in-game purchases “based on the press of a single button.”

The FTC cites some examples of this issue, noting that users could “be charged while attempting to wake the game from sleep, while the game was in a loading screen, or by pressing an adjacent button while attempting simply to preview an item.”

The FTC additionally accuses Epic Games of charging account holders without their authorization. Until 2018, the agency says Epic let children purchase Fortnite’s in-game currency, V-Bucks, without the consent of their parents or the credit card holder. It also alleges that Epic “locked the accounts of customers” who attempted to dispute the unauthorized charges and threatened to ban them “for life” if they tried to fight future charges.

The FTC says it will use the settlement to refund parents whose kids made unauthorized credit card purchases between January 2017 and November 2018, players who were charged for unwanted purchases, and players whose accounts were locked after disputing charges.

The FTC plans to make refunds available to:

Parents whose children made an unauthorized credit card purchase in the Epic Games Store between January 2017 and November 2018

Fortnite players who were charged in-game currency (V-Bucks) for unwanted in-game items (such as cosmetics, llamas, or battle passes) between January 2017 and September 2022

Fortnite players whose accounts were locked between January 2017 and September 2022 after disputing unauthorized charges with their credit card companies.

Epic responded to the FTC’s claims in a post on its site, noting that it accepted the agreement because it wants to “be at the forefront of consumer protection and provide the best experience” for players.

The developer describes the various changes it has already made, such as adding an “undo purchase” and refund token system to Fortnite in 2018. It also says it did away with single-press purchases and requires players to hold down the button to confirm that they want to buy an item.

“As our complaints note, Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children,” FTC Chair Lina Khan says in a statement. “Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”

Correction, 11:11AM ET: A previous version of the article incorrectly stated that Epic Games would refund players when the FTC will use Epic’s settlement to distribute refunds. We regret the error.