On March 14, 2023, the United States Federal Trade Commission confirmed and finalized an order arising out of one of two settlements released late December 2022 concerning Epic Games, the developer of the popular video game Fortnite. Under the order and settlements, Epic has agreed to pay a combined US$520 million for violating FTC Rules, the largest payment ever required for a FTC Rules violation. The settlements relate to two complaints regarding in-game micro-transactions (the subject of a previous blog post) and Fortnite’s user interface, as well as privacy concerns.
In the first complaint, the FTC alleged Fortnite’s in-game micro-transactions, which prosecutors termed “Dark Patterns,” tricked or otherwise unfairly induced users to make impulse or unwanted purchases, while making it unnecessarily difficult to find the refund request screen to undo those same purchases. In other words, the FTC alleged that the way in which Epic designed Fortnite’s game menu tricked players into making purchases.
However, despite the FTC’s strongly worded complaint, the settlement with Epic regarding the first complaint seemed to fall short of clear regulatory intervention. For example, the resulting consent order did not even specifically mention the so called Dark Patterns alleged in the complaint itself. Although, notwithstanding the lack of clear enforcement provisions constraining future deployment of the so-called Dark Patterns, the resulting consent order did give FTC staff the tools to monitor and enforce against the behaviours complained of, including by requiring Epic to maintain and disclose certain records in the future.
In the second complaint, the FTC claimed the game improperly collected children’s personal information, and the default settings, which enabled real-time voice and text chat communication, violated certain privacy and FTC Acts.
This blog post focuses on the “Dark Patterns” complaint and resulting Order.
The Complaint
Broadly, across two counts of violations of the FTC Act, the Complaint alleged Epic engaged in numerous unfair practices:
- “Free to Play Status” and charges without informed consent: Fortnite is labeled on the Epic Games Store as “free” or “free to play” obscuring, the Complaint alleges, that many features such as cosmetics and the Battle Pass are available as in-game purchases for real money. For more than a year after Epic began offering in-game purchases, children were able to complete purchases without the consent or authorization of a parental guardian or the card holder. Upon making a purchase in-game, the credit card information used was then stored and would be used automatically for future purchases. Consumers were not informed that their information was being saved nor that it would be used for automatic billing. Although a feature was eventually added which allowed card holders to choose not save their credit card information upon purchase, it failed to notify users that if this option was not selected, the card would be automatically saved and billed in the future.
- Dark Patterns: The bulk of the Complaint concerned Epic’s use of “Dark Patterns,” which the FTC called “myriad design tricks.” Identified examples of Dark Patterns included design choices of excluding a button to confirm purchases and changing which button was used to purchase items on different screens. For example, console players might on one screen use the “cross” button to confirm a selection, and use the “circle” button to cancel or back out of the selection; but on a separate screen for purchasing in-game items, the buttons would be switched so that “cross” would cancel and “circle” would confirm. This, coupled with the lack of purchase confirmation requirement, meant that a single wrong button press could lead to an accidental purchase. Epic eventually added in a feature to undo certain accidental purchases, but after seeing initial success at reducing accidental purchases, this feature’s name was changed, its size was reduced, its location was moved, and players were required to hold a button to complete the action. Notably, and in contrast, players did not have to hold down a button to make the purchase. Further, Epic limited the amount of refunds to three per user account, made refunds available only for specific items, hid the refund request option, and included several steps intended to discourage customers from completing their refund request.
- Banning users who challenged unauthorized charges: The FTC alleged that since at least February 2018, Epic deactivated users’ accounts if they disputed unauthorized charges with their credit card company, regardless of the reason for the dispute. Further, the Complaint stated that so many users went to Visa and Mastercard to challenge these unauthorized purchases that both credit card companies threatened Epic’s ability to process future payments.
The Order
The Order issued pursuant to the Complaint provides that Epic must pay US$245,000,000 to the FTC and in return Epic would neither deny nor admit any of the allegations contained within the Complaint, except as stated in the Order and accompanying decision.
The FTC has reported that it will use this money to “provide refunds to Fortnite gamers in the United States” affected by Epic’s billing and refund practices. The Order also provides that Epic is restrained from billing account holders for any charge without obtaining account holders’ express and informed consent. Additionally, if Epic obtains consent for potential future charges, there must be a simple mechanism provided to revoke the consent at any time. The mechanism must also not be difficult, costly, confusing or time consuming, and must be at least as simple as the mechanism the consumer used to initiate the charge. Further, Epic is restrained from denying a consumer access to their account for disputing a charge.
However, the Order notably lacks any prohibition against the continued use of Dark Patterns and does not otherwise define or even mention Dark Patterns. While the Order defines express and informed consent to include “disclosure of all material information related to the billing”, and provides that such disclosure be difficult to miss and easily understandable by ordinary consumers, the Order does not explicitly mention or otherwise require Epic to avoid any Dark Patterns or deceptive design tricks in its game design.
This is especially surprising given that these Dark Patterns made up the majority of FTC’s argument in the Complaint. While the FTC press release states that the Order prohibits Epic from charging customers through the use of Dark Patterns, the Order itself does not explicitly state that nor does it contain the term Dark Patterns. For example, there is no reference to the allegation that Epic switched which buttons were used to purchase items on different screens.
That said, the Order does contain some future-looking regulatory control. In Section 8, “Recordkeeping”, Epic is required to create certain records for 10 years and retain those records for an additional five years. These records include those of any market, behavioural, or psychological research performed by or at the direction of Epic. Examples are provided which include eye or mouse tracking studies, heat maps, or session replays or recordings. The inclusion of such a provision indicates that the FTC is aware that game developers are likely already collecting this information, perhaps in connection with designing user interfaces and testing the effectiveness of certain Dark Patterns.
Takeaways
The Complaint, the resulting settlement, the Order, and the sizeable fine are an odd group. The fine aside, the Order does not appear to directly flow from the Complaint. The FTC identified many areas of concern in its Complaint, most notably the Dark Patterns, but then largely omits referencing these concerns in its enforcement Order.
It’s possible that in an attempt to capture all possible (and unforeseeable) misbehaviour in the future, the FTC chose to word its Order vaguely and broadly, placing a heavier reliance on the compliance reporting and monitoring provisions of the Order, rather than attempting to name specific Dark Pattern behaviors that could be modified or adapted in the future to avoid non-compliance with the terms of the Order.
What is clear is that video game developers should take careful note that regulatory agencies appear to be (finally) monitoring gaming, and government prosecutors may be alive to the industry’s intricacies.
Of particular note is the Order’s Recordkeeping section. In our view this shows the FTC has reason to believe game developers hire psychologists to opine on design elements. Simply put: regulatory bodies will be watching for unscrupulous use of market, behavioural, and/or psychological data. In an environment where allegations of addictiveness and worries of “screen time” abound, the watchful eye of regulatory bodies will likely only widen.
To stay on top of the latest legal developments in the video game industry, please reach out to the authors Josh Dial, Changhai Zhu, Riley Bender, Tina Shaygan and Brenden Roberts.
