The FTC Goes After Microsoft – and Everyone Else

Writer Charles Bukowski once said he was a series of small victories and large defeats. That’s a great quote for gritty poets but not so great for the Federal Trade Commission. The Commission recently won a small victory against Microsoft but missed out on a far bigger one.

In early June, the FTC got Microsoft to settle a case accusing the hardware and gaming giant of violating the Children’s Online Privacy Protection Act (COPPA). According to the FTC’s complaint, Microsoft asked kids for personal information when setting up their Xbox Live accounts before asking for parental consent.

Microsoft also didn’t correctly describe what data it was collecting or what it would do with that information in its direct privacy notice. This data potentially included real names from gamer tags, photos from avatars, and voice from video messages. Microsoft then created a unique user ID that it could use to combine information that it had collected before handing it off to third-party game developers.

Microsoft retained children’s information for longer than reasonable, adding the complaint, often keeping it for years.

The company must pay $20m to settle the complaint while also letting parents know in future that a separate account for children will give them additional privacy protections by default. The company must allow up to two weeks for parents to delete any information their child provides before getting their consent. It must rein in its retention times for kids’ data and reveal that data belongs to a child when giving it to third parties.

Small Victory, Big Message

Settlements like these are pretty standard at the FTC as first strikes against companies. Their financial impact is often minimal (Microsoft currently makes around $10m in net profits per hour), but they do send a message to the market. In this case, the FTC explained precisely what message it was sending in the blog post accompanying the settlement announcement. It warned that COPPA applies to online services like the Xbox Network rather than just websites and apps.

Companies should also take this as a signal that ‘personal information’ means more than just a name or address, the Commission said. It also includes everything from vital signs and health data through to anything (like a child’s photo) that can be gleaned from an online avatar.

The FTC added that any company receiving information should also check whether it comes from a child. “Whether your company collected the information or you received the data knowing that someone else collected it from a kid under 13, the COPPA buck stops with you,” it said. And finally, companies wanting to stay inside COPPA’s regulatory lines should define their processes to do so by default.

Bigger Fish to Fry

Cases like this are important for an FTC trying to set the tone, but the Commission has bigger things in mind. It has been on an aggressive footing since the appointment of chair Lina Khan in 2021.

Khan, formerly an associate professor at Columbia Law School, published a paper in the Yale Law Journal, Amazon’s Antitrust Paradox, calling for antitrust reform. She argued that current antitrust frameworks can no longer compete with Amazon on the basis of antitrust law in the Yale Law Journal.

In that paper, she recalled sixties-era antitrust frameworks, which focused on company structures as a critical factor in antitrust (put simply, large companies that integrate vertically are too powerful). She lamented the Chicago School interpretation of antitrust, which rose to prominence in the 1980s and focused instead on the importance of lower prices to consumers.

In doing so, Khan set out her stall as an antitrust hawk, eager to rein in the large online platforms which didn’t exist when the Chicago School first developed. As chair of the FTC, she’s intent on pushing this reform agenda, much to the chagrin of the platforms. Meta unsuccessfully called for her recusal twice on the grounds that she had already shown bias against the company in her prior work. This includes her tenure as director of legal policy at anti-monopoly nonprofit the Open Markets Institute, which has called to break up the social media giant.

Meta was trying to exclude Khan from two FTC cases against it. The first, a late Trump-era case filed in December 2020 before she took office, sought to break up the company because its acquisitions of companies like WhatsApp and Instagram were a land grab against the market. The second involved its proposed acquisition of the virtual reality company Within Unlimited.

A court dismissed the FTC’s case for breaking up Meta as inadequate in June 2021 but allowed it to proceed in January 2022 after a Khan-led FTC refiled. It seemed as though things were looking up for the FTC; in April, the case ran into new headwinds. A court dismissed a similar class action suit, throwing the FTC’s claim into question.

That bad news followed a big blow in Kahn’s attempt to prevent the acquisition of Within Unlimited. A federal court ruled in Meta’s favour on the Within Unlimited case in February 2023, allowing the acquisition to proceed.

From Bad News to Worse

Now, in its second major loss against big tech with Khan at the helm, a court has denied the FTC a preliminary injunction to stop Microsoft’s acquisition of Activision-Blizzard. That deals a severe blow to the Commission’s antitrust case against the deal, which can now go ahead, pending an agreement with regulators in the UK. A UK deal is now looking more likely, as the country’s Competition and Markets Authority has softened its decision to block the merger and now says it is open to a conversation.

Perhaps the FTC will have more luck with another case in the works. It is suing Amazon for allegedly enrolling its customers in Amazon Prime and making it difficult for them to cancel.

Let’s hope for Khan’s sake that one of these cases bucks the trend. Otherwise, her attempt to force a rethinking of policy around antitrust in an era of big tech might fall far short of success. To misquote another famous writer, to lose one case may be regarded as a misfortune; to lose both looks like carelessness.

To find out how ISMS.online can help your data privacy and management initiatives, speak to one of our experts today.

Update:

It’s been a busy week for Khan. After we filed this story, the judge in the Microsoft-Activision case refused a request by the FTC to pause the acquisition while it appeals the decision. Meanwhile, Khan her position against House Republicans who questioned her over her strategy accusing her of harassing Twitter following a March investigation of the company’s Twitter practices. Nevertheless, the FTC is doubling down in its assault on big tech. Just after its defeat in the Microsoft-Activision case, it announced an investigation into OpenAI, the creator of ChatGPT, for potentially engaging in deceptive privacy practices or harming consumers with inaccurate information generated by ChatGPT.