Epic Games agreed to a record $520 million FTC settlement to resolve charges that Fortnite utilized deceptive user interfaces (dark patterns) to trick players into unwanted purchases and violated COPPA by collecting minors' data without consent.
Case overview
The Federal Trade Commission (FTC) penalized Epic Games over two major violations. First, Epic deployed counter-intuitive, inconsistent, and deceptive interface designs (dark patterns) in Fortnite. This confusing button configuration led to millions of dollars in accidental charges—for instance, players frequently unlocked premium items while trying to wake the game from sleep mode or during loading screens. Epic also deliberately obscured cancellation and refund options. To prevent chargebacks, Epic threatened to permanently ban the accounts of users who disputed unauthorized spendings through their banks. Second, the FTC charged Epic with violating children's privacy under COPPA by harvesting personal data from children under 13 without obtaining verifiable parental consent, and by enabling live voice and text chat by default in matches, exposing children to bullying and adult threats.
Sanctions & remedies
$520,000,000 settlement total ($245 million for consumer refunds due to dark patterns + $275 million COPPA penalty), mandatory UI/UX overhaul, and privacy configuration changes.
Legal basis
FTC Act Section 5 (Unfair or Deceptive Acts or Practices); Children's Online Privacy Protection Act (COPPA).
Compliance takeaway
The $520M FTC settlement serves as the definitive global blueprint for designing fair free-to-play monetization loops and minor-facing privacy frameworks. Explicit Confirmation Flow: Financial transactions must require a deliberate, separate confirmation action. Never map a purchase trigger to buttons commonly used for navigation, skipping cinematics, or exiting sleep mode. Zero-Friction Cancellations: Games must feature a prominent, "one-click" immediate cancel-and-refund mechanism for a reasonable time window after any digital purchase. Chargeback Retaliation Ban: Publishers must not lock or ban user accounts when parents initiate a bank chargeback for unauthorized or accidental transactions made by minors. Privacy by Default for Children: If your game has a significant child audience, real-time voice and text communication channels must be turned OFF by default. Activating them requires explicit, verifiable parental consent.