close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Enforcement · Settlement / consent order

FTC fines Epic Games $520M for COPPA violations and dark patterns

COPPAFTC Act Section 5 Federal Children & minorsDark patterns

In December 2022, the FTC announced two settlements with Epic Games, maker of Fortnite, totaling $520 million: $275 million for COPPA violations, the largest penalty the FTC had obtained for a rule violation at the time, and $245 million to refund consumers, the agency's largest gaming-related refund. The FTC said Epic collected personal information from children under 13 without notifying parents or getting verifiable consent, and enabled voice and text chat by default, exposing children and teens to bullying and harassment. Separately, the agency alleged Epic used dark patterns, including confusing and inconsistent purchase-button layouts, to trick players of all ages into making unwanted purchases, then locked the accounts of consumers who disputed the resulting charges, cutting them off from content they had already bought.

Why it matters Default settings and confusing purchase flows are enforcement risk, not just UX debt. Defaulting a kids' product to voice chat or in-game messaging can itself be a COPPA violation, and a button layout that causes unintended charges is treated the same as a false claim.
Read the primary source
Federal Trade Commission
Open source

Published by Editorial on Sep 23, 2026. Not independently re-checked against the primary source — read it via the link above.

Related actions

Settlement / consent order Pending

DOJ’s $400M TikTok privacy settlement hits a snag: a judge may reject part of it

TikTok Inc. and ByteDance Ltd.

COPPA Federal

$400,000,000Pending

A $400M privacy settlement isn't final just because the government announced it: a judge can still send both sides back to the table.

Primary source
Class-action lawsuit

Flagstar Bank reaches $31.5M settlement over 2021 data breaches affecting 2.2M people

Flagstar Bank, N.A.

Federal

$31,500,000Settled

A bank paid hackers a ransom to delete stolen data, then still had to pay $31.5 million to the customers whose data was stolen in the first place.

Primary source
Regulator enforcement

FTC orders Illuminate Education to fix security after breach exposed 10.1M students’ data

Illuminate Education, Inc.

FTC Act Section 5 Federal

DecidedNo monetary penalty

There was no fine, but a company that ignores a two-year-old security warning can still be forced into a binding security overhaul.

Primary source

Summaries are DataGrail’s wording, not statutory text; amounts and outcomes come from the linked primary source.

This summary is DataGrail's own plain-language account, written for privacy practitioners. It is not legal advice. For the authoritative text, follow the primary-source link above.