Epic Games, Inc.; Analysis of Proposed Consent Order To Aid Public Comment, 354-356 [2022-28581]

Agencies

• FEDERAL TRADE COMMISSION

[Federal Register Volume 88, Number 2 (Wednesday, January 4, 2023)]
[Notices]
[Pages 354-356]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-28581]



[[Page 354]]

=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

[File No. 192 3203]


Epic Games, Inc.; Analysis of Proposed Consent Order To Aid 
Public Comment

AGENCY: Federal Trade Commission.

ACTION: Proposed consent agreement; request for comment.

-----------------------------------------------------------------------

SUMMARY: The consent agreement in this matter settles alleged 
violations of Federal law prohibiting unfair or deceptive acts or 
practices. The attached Analysis of Proposed Consent Order to Aid 
Public Comment describes both the allegations in the draft complaint 
and the terms of the consent order--embodied in the consent agreement--
that would settle these allegations.

DATES: Comments must be received on or before February 3, 2023.

ADDRESSES: Interested parties may file comments online or on paper by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Please write ``Epic Games, 
Inc.; File No. 192 3203'' on your comment and file your comment online 
at https://www.regulations.gov by following the instructions on the 
web-based form. If you prefer to file your comment on paper, please 
mail your comment to the following address: Federal Trade Commission, 
Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 
(Annex D), Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT: James Doty (202-326-2628), Bureau of 
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 
NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal 
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec.  2.34, 16 CFR 
2.34, notice is hereby given that the above-captioned consent agreement 
containing a consent order to cease and desist, having been filed with 
and accepted, subject to final approval, by the Commission, has been 
placed on the public record for a period of 30 days. The following 
Analysis to Aid Public Comment describes the terms of the consent 
agreement and the allegations in the complaint. An electronic copy of 
the full text of the consent agreement package can be obtained at 
https://www.ftc.gov/news-events/commission-actions.
    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or before February 3, 
2023. Write ``Epic Games, Inc.; File No. 192 3203'' on your comment. 
Your comment--including your name and your state--will be placed on the 
public record of this proceeding, including, to the extent practicable, 
on the https://www.regulations.gov website.
    Because of heightened security screening, postal mail addressed to 
the Commission will be subject to delay. We strongly encourage you to 
submit your comments online through the https://www.regulations.gov 
website.
    If you prefer to file your comment on paper, write ``Epic Games, 
Inc.; File No. 192 3203'' on your comment and on the envelope, and mail 
your comment to the following address: Federal Trade Commission, Office 
of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), 
Washington, DC 20580.
    Because your comment will be placed on the publicly accessible 
website at https://www.regulations.gov, you are solely responsible for 
making sure your comment does not include any sensitive or confidential 
information. In particular, your comment should not include sensitive 
personal information, such as your or anyone else's Social Security 
number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure your comment does not include 
sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.  
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule Sec.  4.9(c). In 
particular, the written request for confidential treatment that 
accompanies the comment must include the factual and legal basis for 
the request, and must identify the specific portions of the comment to 
be withheld from the public record. See FTC Rule Sec.  4.9(c). Your 
comment will be kept confidential only if the General Counsel grants 
your request in accordance with the law and the public interest. Once 
your comment has been posted on the https://www.regulations.gov 
website--as legally required by FTC Rule Sec.  4.9(b)--we cannot redact 
or remove your comment from that website, unless you submit a 
confidentiality request that meets the requirements for such treatment 
under FTC Rule Sec.  4.9(c), and the General Counsel grants that 
request.
    Visit the FTC Website at https://www.ftc.gov to read this document 
and the news release describing the proposed settlement. The FTC Act 
and other laws the Commission administers permit the collection of 
public comments to consider and use in this proceeding, as appropriate. 
The Commission will consider all timely and responsive public comments 
it receives on or before February 3, 2023. For information on the 
Commission's privacy policy, including routine uses permitted by the 
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Analysis of Proposed Consent Order To Aid Public Comment

    The Federal Trade Commission (``FTC'' or ``Commission'') has 
accepted, subject to final approval, an agreement containing a consent 
order from Epic Games, Inc. (``Respondent''). The proposed consent 
order has been placed on the public record for 30 days for receipt of 
comments written by interested persons. Comments received during this 
period will become part of the public record. After 30 days, the 
Commission will again review the agreement and the comments received 
and will decide whether it should withdraw from the agreement or make 
final the agreement's proposed order.
    Respondent is the developer and distributor of the video game 
Fortnite. Respondent bills users for the purchase of virtual currency 
(V-bucks) and also bills users' V-bucks for the purchase of items 
within Fortnite. This matter concerns Epic's (1) billing for charges 
without having obtained account holders' express, informed consent and 
(2) deactivating the accounts of consumers who exercise their right to 
dispute charges.
    The Commission's proposed complaint alleges that Epic saved 
parental credit card information by default and permitted subsequent 
unauthorized purchases by children. Specifically, children were 
permitted to make V-bucks purchases simply by pressing buttons, without 
parental or card holder action or consent (for example, without entry 
of a pin, password, or CVV number). Epic has also billed users of all 
ages for unauthorized V-bucks charges within

[[Page 355]]

Fortnite; Epic designed purchase flows within the game so that unwanted 
charges were easy to incur, as Epic was aware from the more than one 
million complaints it received about the issue. Finally, Epic has 
deactivated--in many cases, permanently--the accounts of consumers who 
disputed unauthorized charges, denying them access to paid-for content.
    The proposed consent order contains provisions designed to prevent 
Respondent from engaging in similar acts or practices in the future. 
Part I prohibits Respondent from billing consumers for charges without 
procuring their express, informed consent. Part II bars Respondent from 
denying consumers access to their accounts based on their exercise of 
chargeback rights. Part III requires Respondent to pay $245,000,000 in 
monetary relief. Part IV contains additional requirements regarding 
monetary relief. Part V requires Respondent to provide sufficient 
customer information to enable the Commission to administer consumer 
redress.
    Parts VI through X are reporting and compliance provisions. Part VI 
requires Respondent to acknowledge receipt of the order, to provide a 
copy of the order to certain current and future principals, officers, 
directors, and employees, and to obtain an acknowledgement from each 
such person that he or she has received a copy of the order. Part VII 
requires Respondent to file a compliance report within one year after 
the order becomes final and to notify the Commission within 14 days of 
certain changes that would affect compliance with the order. Part VIII 
requires Respondent to maintain certain records, including records 
necessary to demonstrate compliance with the order. Part IX requires 
Respondent to submit additional compliance reports when requested by 
the Commission and to permit the Commission or its representatives to 
interview Respondent's personnel. Finally, Part X is a ``sunset'' 
provision, terminating the order after twenty (20) years, with certain 
exceptions.
    The purpose of this analysis is to aid public comment on the 
proposed order. It is not intended to constitute an official 
interpretation of the proposed order or to modify its terms in any way.

    By direction of the Commission.
April J. Tabor,
Secretary.

Concurring Statement of Commissioner Christine S. Wilson

    Today, the FTC announced a settlement with Epic Games, the creator 
of the popular online video game Fortnite. I support and applaud this 
enforcement action, which takes important steps to protect the online 
privacy of children, including teens. And I am grateful to our talented 
staff for their excellent work on this case, which incorporates a 
noteworthy unfairness count and novel but fully warranted injunctive 
relief. This case clearly exemplifies the harms of insufficient privacy 
protections, particularly for children. Concerned parents may wish to 
review the FTC's helpful website with resources about protecting kids 
online.\1\
---------------------------------------------------------------------------

    \1\ Protecting Kids Online, Fed. Trade Comm'n, https://consumer.ftc.gov/identity-theft-and-online-security/protecting-kids-online (last visited Dec. 18, 2022).
---------------------------------------------------------------------------

    I write separately to explain my support both for the unfairness 
count and the groundbreaking injunctive relief. Section 5 of the FTC 
Act provides the necessary flexibility to address emerging threats to 
consumers from new industries and evolving technologies.\2\ But the 
Commission's unfairness authority is not unbounded. As I have 
previously noted, the FTC must observe the boundaries of its statutory 
authority and operate within the jurisdictional limits set by 
Congress.\3\ Here, however, the elements of the unfairness test are 
clearly satisfied--because Epic Games allegedly opted children into 
voice and text communications with players around the world, children 
were exposed to bullying, threats, and harassment, and were enticed or 
coerced into sharing sexually explicit images and meeting offline for 
sexual activity.\4\ And the novel injunctive mechanisms, which require 
Epic Games to implement heightened privacy default settings, directly 
address the privacy harms fostered by the company's alleged business 
practices.
---------------------------------------------------------------------------

    \2\ The Agency has used this flexible standard to address online 
harms like digital stalking (Compl., Retina-X Studios, LLC, No. 172-
3118 (filed Oct. 22, 2019), https://www.ftc.gov/system/files/documents/cases/172_3118_retina-x_studios_complaint_0.pdf), revenge 
porn (Compl., Emp Media, Inc., No. 162-3052 (filed July 9, 2018), 
https://www.ftc.gov/system/files/documents/cases/1623052_myex_complaint_1-9-18.pdf), and invasions of people's homes 
through web cameras (Compl., TRENDnet, Inc., No. 122-3090 (filed 
Feb. 7, 2014), https://www.ftc.gov/enforcement/casesproceedings/122-3090/trendnet-inc-matter). See also Daniel J. Solove & Woodrow 
Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L. 
Rev. 583 (2014) (describing the FTC's role since the late 1990s in 
enforcing privacy statutes and companies' privacy practices).
    \3\ Dissenting Statement of Commissioner Christine S. Wilson, 
Policy Statement on Breaches by Health Apps and Other Connected 
Devices (Sept. 15, 2021), https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_dissent_combined_final.pdf; 
Dissenting Statement of Commissioner Christine S. Wilson, Final Rule 
related to Made in U.S.A. Claims (July 1, 2021), https://www.ftc.gov/system/files/documents/public_statements/1591494/2021-07-01_commissioner_wilson_statement_musa_final_rule.pdf; Statement 
of Commissioner Christine S. Wilson Concurring in Part, Dissenting 
in Part, Notice of Proposed Rulemaking related to Made in U.S.A. 
claims (June 22, 2020), https://www.ftc.gov/system/files/documents/public_statements/1577099/p074204musawilsonstatementrev.pdf.
    \4\ See Compl., Epic Games, Inc., No. 222-3087 (filed Dec. 19, 
2022).
---------------------------------------------------------------------------

    I also write separately to underscore the dangers of insufficient 
privacy protections, particularly for children, including teens. As I 
write, close to three million gamers around the globe are playing 
Fortnite.\5\ In the Battle Royale mode, players are matched with up to 
99 other gamers in a format that allows combatants to communicate with 
each other via voice and text. Despite knowing that adults and children 
play the video game concurrently, Epic Games allegedly failed to 
prioritize the safety of its young players when the company implemented 
default settlings that allowed strangers to communicate with children 
and teens. The complaint details how Epic Games chose to opt children 
into conversations with unknown adults despite repeated warnings from 
game designers, users, parents, and others that this approach violated 
industry norms and carried significant risks.
---------------------------------------------------------------------------

    \5\ Fortnite Live Player Count, Player Counter, https://playercounter.com/fortnite/ (last visited Dec. 18, 2022).
---------------------------------------------------------------------------

    The results? I offer three examples:
    In 2018, a 13-year-old boy (called MV#1 in court pleadings) told 
his doctor he was stressed because an adult male named ``Gavin'' whom 
he met while playing Fortnite planned to travel from ``Gavin's'' home 
in Pennsylvania to MV#1's home in Georgia for a visit. MV#1 wrote down 
a list of things ``Gavin'' wanted him to do, including ``blow job, 
making out, kissing, cuddling, and fingering.'' ``Gavin,'' later 
identified as Gregory Mancini, flew to Georgia in November 2018 and 
proposed to meet MV#1 at a Waffle House, where Mancini was arrested. A 
subsequent search of Mancini's computer ``uncovered . . . child sexual 
abuse material depicting very young minors, including images involving 
adult males engaged in sexual abuse of

[[Page 356]]

boys appearing to be about two years of age.'' \6\
---------------------------------------------------------------------------

    \6\ Sentencing Mem. of the U.S., United States v. Mancini, No. 
1:20-cr-00031-SPB (W.D. Pa. Apr. 25, 2022).
---------------------------------------------------------------------------

    Also in 2018, Sergeant Christopher S. Gilbert met ``Miss MN'' 
online playing Fortnite. Using the voice chat feature in the game, 
``Miss MN'' told Gilbert she was 13 years old, and Gilbert told her he 
was 22. The two traded Instagram account names and began exchanging 
private messages through the Instagram text messaging feature. A court 
subsequently concluded that Gilbert sexually abused ``Miss MN'' by 
sending her digital pictures and videos of his penis, engaged in 
inappropriate sexual conversations with her, and attempted to guilt her 
into sending nude images of herself. A subsequent search of Gilbert's 
phone revealed child pornography. Gilbert was convicted of sexual abuse 
of a child and possession of child pornography.\7\
---------------------------------------------------------------------------

    \7\ United States v. Gilbert, ARMY 20190766, 2020 WL 4458493 
(Army Ct. Crim. App. July 31, 2020).
---------------------------------------------------------------------------

    And in 2019, Juan Carlos Sandoval-Guerrero, using Fortnite, coerced 
a young child (called Victim B in court pleadings) into sending images 
that portray Victim B ``displaying his penis, masturbating his penis 
with his hand and penetrating his anus with his finger. In some videos, 
Victim B can be seen wearing a wireless headset of the type . . . 
typically associated with video game systems like Xbox. During one of 
the videos, Victim B can be heard talking about the points he got on a 
game while he is masturbating his penis.'' In 2021, Sandoval-Guerrero 
pled guilty to the production and attempted production of child 
pornography in violation of 18 U.S.C. 2251(a), (e).\8\
---------------------------------------------------------------------------

    \8\ Plea Agreement, United States v. Sandoval-Guerrero, No. 
4:20-CR-06009-SMJ-1 (E.D. Wash. Apr. 1, 2021).
---------------------------------------------------------------------------

    These examples should concern any parent whose kids enjoy playing 
online video games. And they should serve as a wake-up call to skeptics 
who believe that invasions of privacy lead merely to targeted 
advertising.
    Numerous news articles have reported that Fortnite and other online 
games foster a target-rich hunting ground for sexual predators.\9\ The 
National Center for Missing & Exploited Children, the nation's 
centralized reporting system for suspected child sexual exploitation, 
received more than 29.3 million reports of suspected child sexual 
exploitation in 2021, including over 44,000 reported incidents of 
online enticement of children for sexual acts.\10\ And the organization 
noted that the reports of online enticement have been growing more 
numerous each year. During my tenure as a Commissioner, I have been an 
ardent advocate for federal privacy legislation,\11\ in part because of 
the pernicious risks threatening children's safety online.\12\
---------------------------------------------------------------------------

    \9\ Paige Gross, Predators are using Fortnite to Lure kids. Cops 
say parents need to worry, NJ.com (Sept. 21, 2018 12:30 p.m.), 
https://www.nj.com/news/2018/09/fortnite_mindcraft_join_other_platforms_where_pred.html (warning the 
public about popular apps being used by people to abuse and exploit 
teens and children); Nellie Bowles and Michael H. Keller, Video 
Games and Online Chats Are `Hunting Grounds' for Sexual Predators, 
N.Y. Times, Dec. 7, 2019, https://www.nytimes.com/interactive/2019/12/07/us/video-games-child-sex-abuse.html (detailing the efforts of 
criminals to make virtual connections in order to exploit and abuse 
children, including teens, through gaming and social media 
platforms); Dustin Racioppi, `People don't want to talk about it,' 
but reports of kids being exploited online have spiked amid 
coronavirus pandemic, USA Today, Oct. 22, 2020, https://www.usatoday.com/story/news/nation/2020/10/22/coronavirus-child-abuse-nj-online-child-exploitation-reports-increase/6004205002/ 
(discussing the epidemic of online child exploitation during the 
coronavirus pandemic).
    \10\ CyberTipline 2021 Report, Nat'l Ctr. for Missing and 
Exploited Child., https://www.missingkids.org/gethelpnow/cybertipline/cybertiplinedata#overview.
    \11\ Oral Statement of Commissioner Christine S. Wilson, FTC, 
Before the U.S. House Committee on Energy and Commerce Subcommittee 
on Consumer Protection and Commerce (July 28, 2021), https://www.ftc.gov/system/files/documents/public_statements/1592954/2021-07-28_commr_wilson_house_ec_opening_statement_final.pdf; Christine 
Wilson, Op-Ed, Coronavirus Demands a Privacy Law, WALL ST. J., May 
13 2020, available at https://www.wsj.com/articles/congress-needs-to-pass-a-coronavirus-privacy-law-11589410686; Oral Statement of 
Commissioner Christine S. Wilson, FTC, Before the U.S. Senate 
Committee on Commerce, Science, and Transportation (April 20, 2021), 
https://www.ftc.gov/system/files/documents/public_statements/1589180/opening_statement_final_for_postingrevd.pdf; Christine 
Wilson, Privacy in the Time of Covid-19, TRUTH ON THE MARKET (Apr. 
15, 2020), https://truthonthemarket.com/author/christinewilsonicle/; 
Christine S. Wilson, A Defining Moment for Privacy: The Time is Ripe 
for Federal Privacy Legislation, Remarks at the Future of Privacy 
Forum, Feb. 6, 2020, https://www.ftc.gov/system/files/documents/public_statements/1566337/commissioner_wilson_privacy_forum_speech_02-06-2020.pdf; Oral 
Statement of Commissioner Christine S. Wilson Before the U.S. House 
Committee on Energy and Commerce Subcommittee on Consumer Protection 
and Commerce (May 8, 2019), https://www.ftc.gov/system/files/documents/public_statements/1592954/2021-07-28_commr_wilson_house_ec_opening_statement_final.pdf; Oral Statement 
of Commissioner Christine S. Wilson, FTC, Before the U.S. Senate 
Committee on Commerce, Science, and Transportation Subcommittee on 
Consumer Protection, Product Safety, Insurance, and Data Security 
(Nov. 27, 2018), https://www.ftc.gov/system/files/documents/public_statements/1423979/commissioner_wilson_nov_2018_testimony.pdf.
    \12\ Christine S. Wilson, The FTC's Role in Supporting Online 
Safety, Remarks at the Family Online Safety Institute, Nov. 21, 
2019, https://www.ftc.gov/system/files/documents/public_statements/1557684/commissioner_wilson_remarks_at_the_family_online_safety_institute_11-21-19.pdf.
---------------------------------------------------------------------------

    I am not a Luddite. I recognize that children's lives can be 
enriched through social media, gaming, and other online resources. But 
online activity comes with risks, especially when internet products 
have flawed or non-existent safeguards. The FTC's Section 5 authority 
does not reach, and cannot prevent, every danger facing teens and 
children on the internet today. Here, however, I am comfortable with 
this use of our unfairness authority, and I am supportive of the 
groundbreaking injunctive relief requiring privacy-protective settings 
for children and teens, because I have reason to believe that Epic 
Games knew that its products and/or services presented a substantial 
risk of harm and did not take simple steps to address that risk.

[FR Doc. 2022-28581 Filed 1-3-23; 8:45 am]
BILLING CODE 6750-01-P