Suit Seeks Damages for Fornite's 'Unlawful Collection and Use' of Personal Data

Seven minors, through their guardians, sued Epic Games over its alleged collection of their personal information for financial gain, said a privacy class action Monday (docket 3:24-cv-00517) in U.S. District Court for Southern California in San Diego.

Though free to download, Epic's Fortnite generates “billions of dollars” through in-game purchases, advertising and merchandising contracts that depend on “the exploitation of children” and their personal information, said the complaint. The Children’s Online Privacy Protection Act (COPPA) protects children under 13 from having their personal information collected without a parent’s verifiable consent, it said.

Epic routinely collects personal information, including name, screen name, persistent identifiers, geolocation and biometric data, to facilitate in-game purchases, target advertising, and sell merchandise, the complaint said. Since 2013, COPPA has barred operators of websites and online services from collecting persistent identifiers from children under 13 without parental consent, it said. Persistent identifiers include cookies that track a child’s activity online, geolocation information, photos, videos and audio recordings, it said.

Despite knowing that kids under 13 were playing Fortnite, Epic collected personal information from all Fortnite players, including those under 13, said the complaint. The company had actual knowledge that a “substantial proportion” of its user base is made up of children under 13, it said. Plaintiffs in the case are S.B.G., S.T.G., S.J.G., living in San Diego; I.H. and E.H., of Buellton, California; and M.A. and E.V.A., of Onalaska, Washington. All of the plaintiffs were under 13 during the class period, July 21, 2017-Feb. 20, 2023.

During the class period, Epic used children’s personal information to track the activity of children under the age of 13 playing Fortnite and “exploited it for commercial purposes,” including to develop merchandise and clothing targeting children under 13; to develop and promote thematic in-game items available to purchase such as skins and dance moves to enhance play; and to serve children with targeted, behavior-based advertising and in-game product placements, it said. Epic generated “tens of millions, if not hundreds of millions of dollars” or more in revenue as a result, it said.

Fortnite matched children with strangers during interactive play and permitted them to “chat via voice and text without parental notice or consent,” said the complaint. Fortnite’s default setting permitted real-time communication via voice and text chat, and players’ account names were publicly broadcast to other players, which “facilitated dangerous interactions that exposed children to bullying, threats, and harassment, including sexual harassment,” the complaint said.

Fortnite is “technically rated for teenagers,” but Epic “purposefully designed the look and feel of Fortnite to appeal to younger children,” said the complaint, noting colorful graphics “with a cartoonish style.” Players can create structures that add a “playful, imaginative element to the game that can be particularly engaging for children,” it said. The game also offers young kids the chance to interact with friends online, making it appealing to play with classmates, friends or siblings, it said.

The FTC charged Epic with COPPA violations for collection of personal information without obtaining parental consent “and the exposure of children to dangerous interactions with unknown adults,” the complaint noted. DOJ issued an injunction in December 2022 preventing Epic from collecting data from kids under 13 without verifiable parental consent; it also mandates privacy default settings, the deletion of information previously collected, imposes reporting and assessment requirements under COPPA, and imposed a civil penalty of $275 million, it said.

Separately, the FTC entered an order in March 2023 requiring Epic to pay $245 million to settle claims that it “deployed a variety of design tricks known as dark patterns” to get consumers of all ages to make “unintended” in-game purchases, the complaint said. Under the order, Epic paid $245 million to refund customers who purchased unwanted items with in-game currency, or who purchased items without parental consent, it said. Consumers were able to apply for refunds under that settlement through the FTC website until Feb. 29.

But the settlement fund didn’t compensate kids for the “unlawful collection and use” of their personal information for the purpose of targeting them with “behavioral advertising and merchandising partnerships,” the complaint said. The plaintiffs bring the case for themselves and class members who suffered a “violation of their reasonable expectation of privacy as a result of Epic’s unlawful conduct” in collecting the personal information of children without verifiable parental consent “in violation of COPPA, common law, and state unfair and deceptive trade practices,” it said.

By failing to obtain verifiable parental consent, disclose to parents the nature of their data collection practices, and take other steps to "preclude the capture of children’s personal information," Epic breached the privacy rights and “reasonable expectations of privacy” of plaintiffs S.B.G., S.T.G., S.J.G., all under 13 years old, “and the other millions of minors who have played Fortnite, in contravention of privacy norms,” the complaint said.

The plaintiffs' claims for relief are intrusion upon seclusion, violation of California’s Unfair Competition Law and privacy laws; the Washington Consumer Protection Act; and unjust enrichment. Plaintiffs seek actual, punitive, compensatory and/or statutory damages; injunctive relief including orders of disgorgement of Epic’s “unlawful gains”; attorneys’ fees and costs; and pre- and post-judgment interest.