A Kids’ Privacy Adventure: Exploring the FTC’s Privacy and Lootbox case against Genshin Impact

Photo credit: Kassandra Acuna, ESRB Privacy Certified

“Step into a magical world of adventure” proclaims a recent marketing campaign for the massively popular Genshin Impact video game, which offers players seemingly endless chances to interact with characters, complete missions, and battle fantastical creatures. One adventure that likely wasn’t part of any Genshin Impact story quest  – an enforcement action by the Federal Trade Commission (FTC).

Now, though, Genshin Impact game developer Cognosphere Pte. Ltd. (d/b/a HoYoverse) has faced – and settled – FTC charges that it violated both the Children’s Online Privacy Protection Act (COPPA) and the FTC Act. With a $20 million fine, a data deletion mandate, and game-changing restrictions on virtual currency loot box purchases, this settlement has important implications for how video game companies engage with children and teens. Curious about the details and what it means for the industry? Read on for more details or feel free to skip to our top takeaways, below.

Background

In a five-count complaint filed last week by the Department of Justice on the FTC’s behalf, the agency asserted that HoYoverse violated COPPA by collecting personal information from children under the age of 13 without verifiable parental consent (VPC), as required by law, and violated the FTC Act by enticing kids and teens to buy loot boxes to win mystery prizes using practices that “obscured” the amount of real money that they’re spending and misrepresented the chances of getting desirable prizes, or “5-star heroes.” These 5-star heroes are powerful and otherwise desirable characters that “are not merely cosmetic, but offer direct and immediate advantages to players seeking to advance and excel in the game.” According to the agency, the odds of any given loot box containing a desired 5-star hero are low, so players will typically need to open a substantial number of loot boxes, in the dozens to low hundreds, to obtain a desired 5-star hero.

The groundbreaking settlement agreement requires HoYoverse to pay a $20 million fine and to delete all data of players under the age of 13 that it previously collected unless it obtains VPC. It also bans the company from selling loot boxes to children under the age of 16 without parental consent.  And it prohibits HoYoverse from offering loot boxes for virtual currency unless it also offers players the option to purchase loot boxes directly with fiat money.

COPPA (Count I)

The COPPA allegations in Count I and the remedies are in line with recent FTC actions including TikTok and Epic Games/Fortnite – both of which we’ve written about for this blog. In short, the FTC alleged that Genshin Impact, which is popular with children and teenagers, is directed to children under the age of 13 under COPPA’s “actual knowledge” standard and multi-factor test. For “actual knowledge,” the FTC provided detailed evidence such as internal HoYoverse documents that showed the company paying influencers to display Genshin Impact promotional videos as part of a longer segment in which they engaged in a “different child-directed activity or game, such as Minecraft or Roblox” and encouraging them to “engage in child-oriented activities within the Genshin Impact game itself, such as a “Hide & Seek” event within the game.” It also pointed to social media postings on Genshin Impact’s social media network HoYoLAB (which the company then associated with player accounts) containing photographs, videos, or audio files containing the child’s image or voice from which it was apparent that the user was a child. For the multi-factor test, the agency highlighted Genshin Impact’s “anime-style cartoon graphics, bright and colorful animation, and several heroes who have the speech or appearance of children.”  The FTC also charged that the company extensively promoted the game to children through advertisements and paid influencers that to children.

The FTC faulted HoYoverse for sharing children’s personal information – including user IDs that the FTC characterized as “online contact information” and device-related persistent identifiers – with third-party analytics firms and advertisers without obtaining VPC. It noted that, “Unlike many other popular video games, Genshin Impact does not screen players’ ages by way of an ‘age gate’ or require them to enter a birth year.” Relatedly, later in the complaint, the FTC explained that HoYoverse could have “deployed widely available age-gating technology to screen users’ ages.”

FTC Act Claims (Counts II-V)

The FTC’s claims that HoYoverse engaged in deceptive and unfair practices, which targeted HoYoverse’s gacha monetization system, are more novel. They are, though, still rooted in the FTC’s long-held stance that companies should not allow children to make in-app and in-game purchases without obtaining parental authorization. Indeed, the FTC criticized HoYoverse’s failure to limit in any way young players’ ability to spend money to open loot boxes, noting that the “game interface allows users of all ages to easily and frictionlessly buy and spend hundreds of dollars worth of virtual currency within moments.”

The FTC took particular issue with HoYoverse’s “pay to win” promotions, alleging that the odds of any given loot box, known as a Character Banner, containing the advertised prize hero are very low, and consumers commonly must purchase dozens of loot boxes, at the cost of hundreds of dollars, to obtain a single five-star prize. It detailed the numerous misleading ways in which HoYoverse advertised and promoted its loot box, making the odds of obtaining desired characters seem much higher than they were. The agency contrasted HoYoverse’s marketing claims with the real odds, stating that, “In reality, HoYoverse offers consumers only a 0.3% (three in one thousand) chance of obtaining the specific featured hero when they open loot boxes. To put these low odds into perspective, this means that, even if a consumer opens 50 loot boxes in a row, the consumer has odds of less than 15% to obtain the 5-star prize featured on the banner.”

The FTC also detailed the various ways that players can obtain and spend virtual currency in the game, stating that HoYoverse’s multi-tier monetary system – “abstracted and obscured through multiple tiers of fictitious virtual currency” known as “Primogems” and “Wishes”  – “obscures the true amounts that children and teenagers are spending, and so increases the likelihood that consumers will not understand what they are spending, or the effective cost of loot box prizes awarded based on chance.”

Chair Ferguson’s Statement 

Of note, Andrew Ferguson, who took over as FTC Chair on Monday, issued a separate statement concurring in part and dissenting in part with the action. Chair Ferguson voted in favor of the COPPA count explaining that, “For these numerous failures to obey the requirements of COPPA, I support this count in full. These alleged violations of COPPA are severe enough to justify my voting to file the complaint and settlement even though I dissent from three of the remaining four counts.” Chair Ferguson also supported Count II, which charges HoYoverse with misrepresenting the odds of winning the “5-star” prizes, stating that the company’s “claims served to mislead and confuse consumers as to their odds of winning the featured character in a loot box.”

He dissented, however, from the other loot box and virtual currency-related claims, dismissing the FTC’s statements that Genshin Impact’s virtual currency system is complex and confusing. He wrote: “This system required no more of consumers than the simple math operations they perform on a regular basis when they compare prices for different sized jars of peanut butter, when they determine the true price of a buy-one-get-one-half-off deal, and so forth.” (Of course, some of us rely on the unit price tag on the grocery shelf, which helps math-challenged consumers compare the cost of an item per unit of weight or volume.)

Chair Ferguson also suggested that any substantial financial injury was the result of parents’ failures, not the company’s practices. He stated: “[P]arents could easily avoid the injury by simply declining to give children access to a credit card, or by using the parental control systems widely available on mobile platforms like iOS and Android. . . . The COPPA Rule reflects the entirely reasonable judgment of the Commission that children are not expected to be able to make payments without the kind of parental supervision that would prevent them from spending too much money on loot boxes.”  Ferguson’s statement represents a 180 degree change from the FTC’s attempts, over the past few years, to “shift the burden from parents to providers to ensure that digital services are safe and secure for children.”

Chair Ferguson also rejected Count V, indicating that that it was unclear whether the Commission was simply repeating other theories he’d already rejected.  Still, he did not dismiss the possibility of finding that loot boxes could be deemed an unfair practice under the FTC Act in a different context.  He stated, “I do not foreclose the possibility that targeting certain kinds of addictive activities to children and teenagers—such as virtual slot machines in the form of loot boxes—could violate Section 5’s prohibition of unfair acts and practices. But demonstrating such a violation would require us to assemble strong evidence of substantial injury, unavoidability, and the absence of countervailing benefits to consumers or competition. We have not done that here.”

Top Takeaways

Although the FTC’s enforcement action only binds HoYoverse, it offers important lessons for the video game industry.  Here are three, based on the FTC’s business guidance blog containing their top tips for businesses from the Genshin Impact action:

• COPPA applies, even if you don’t direct your product specifically to children.
  This is one of the FTC’s top tips. Here, HoYoverse allegedly added a “Children’s Notice” to its privacy policy, disavowing that it marketed its services to children or intentionally collected personal information from children, once it became aware of the FTC’s investigation.  But, as we’ve said before, you can’t disclaim or avoid COPPA simply by stating that your game is not intended for children. Although many companies make this claim in their privacy policies, it won’t help you if the facts – as evaluated under the FTC’s multi-factor test – show that your product is, in fact, child directed.  And don’t ignore communications or evidence that children under the age of 13 are playing your game. That provides you with “actual knowledge” under COPPA.This takeaway is especially important given the likelihood of aggressive COPPA enforcement ahead. The Genshin Impact enforcement action provides yet another clear signal – on top of the final COPPA Rule announced last week – that the FTC will continue to enforce COPPA vigorously. Remember, even though Chair Ferguson did not agree with all of the FTC’s allegations, he made clear that he fully supported the agency’s COPPA count.
• Beware of “dark pattern,” especially when dealing with children and teenagers.
  This is based on another top tip from the FTC’s business guidance. Manipulative digital design tactics, often called “dark patterns,” can be especially dicey for young players. The FTC honed in on the impact of HoYoverse’s marketing tactics on children and teenagers, explaining that their executive function skills are not yet fully developed. In particular, the agency said that children were particularly susceptible to HoYoverse’s use of “urgency,” “suspenseful and exciting animations and sound effects,” and other “interface and design elements” to steer players toward loot box purchase opportunities.And while Chair Ferguson’s statement raises questions about whether these tactics, in fact, violate the FTC Act, he nevertheless characterized HoYoverse’s use of “ambiguous” text about the odds of winning characters featured in the advertising and that fact that players would have to sort through several paragraphs, “not visible without scrolling down in some cases” as misleading and confusing.  Video game companies should pay attention to manipulative design practices given the interest in “dark patterns” – and their effect on children and teenagers – from not only the FTC, but from state and international consumer protection and privacy regulators as well.
• Adhere to basic truth-in-advertising principles for loot boxes and other game features.
  Although there’s some uncertainty about how the FTC will view loot box practices in games going forward, it’s clear that the FTC expects video game companies to adhere to truth-in-advertising principles.  We can only quote the FTC: “It may be dressed up in the language of videogames, but this is just another variation on basic FTC compliance: don’t make claims for your products or services unless they’re true and you have a reasonable basis for them.”

These takeaways underscore the need for video game companies to prioritize compliance with COPPA and other consumer protection laws. If you’d like to learn more about the Genshin Impact enforcement action or the FTC’s new COPPA Rule, please get in touch. ESRB Privacy Certified is an FTC-authorized COPPA Safe Harbor program that provides privacy certification and compliance support for companies in the video game and toy industries.

• • •

As senior vice president of ESRB Privacy Certified (EPC), Stacy Feuer ensures that member companies in the video game and toy industries adopt and maintain lawful, transparent, and responsible data collection and privacy policies and practices for their websites, mobile apps, and online services. She oversees compliance with ESRB’s privacy certifications, including its “Kids Certified” seal, which is an approved Safe Harbor program under the Federal Trade Commission’s Children’s Online Privacy Protection Act (COPPA) Rule. She holds CIPP/US and CIPP/E certifications from the International Association of Privacy Professionals.