Epic Games paid a $275M Fine For Violating Child Privacy Laws.

A Billion-Dollar Children’s Platform That Pretended Kids Weren’t There

Fortnite launched in July 2017. Within months, it became the most popular game on the planet, dominated by children and tweens. A 2019 industry survey found that 53% of U.S. children aged 10 to 12 played Fortnite weekly — compared to 33% of teenagers and just 19% of adults aged 18 to 24. Epic received pre-publication copies of this survey. They knew exactly who was playing.

Epic’s own internal player surveys backed this up. Approximately 70% of Fortnite players lived at home with parents or guardians, and of those, roughly 80% identified as students. When pitching brand partnerships, Epic openly used social media data showing that a third of its players were teens aged 13 to 17 — the youngest age bracket available — to attract corporate sponsors.

The game’s design made the target audience obvious to anyone paying attention. Fortnite features cartoonish graphics, no blood or gore, a flying blue school bus called the “Battle Bus,” colorful avatars that hang-glide into locations named “Loot Lake” and “Tilted Towers,” and fort-building mechanics Epic itself described as rooted in “the common childhood experience of fort-building.” Epic’s own internal design guidelines specified that all game content should be relevant to an 8-to-14-year-old as a “litmus test.”

The Merchandise Empire That Sold Out Children

Epic did not just make a game kids loved. Epic built a full consumer products empire around those kids. The company hired a licensing agent who acknowledged that “Youth and Kids are obsessed with Fortnite,” developed a merchandising plan targeting “Kids” and “Youth Universes,” and brokered deals with Hasbro, Jazwares, Moose Toys, and Spirit Halloween to produce Fortnite toys, Nerf guns, Super Soakers, Halloween costumes in children’s sizes, backpacks, and pencil cases.

Spirit Halloween sold hundreds of thousands of child-sized Fortnite costumes between 2018 and 2020. Hasbro launched the “Fortnite X Nerf” line in early 2019 with paid advertisements in media channels explicitly targeting “6-to-11-year-old boys.” Moose Toys ran YouTube and Twitch ads designed to reach “Fortnite fans 8 to 12.” Epic approved every product design, every piece of packaging, and every advertising plan.

By the first half of 2020, Fortnite-branded merchandise had generated more than $1 billion ($1 billion — more than the average American worker earns across 25,000 years of full-time work) in gross sales, bringing Epic and its licensing agent over $130 million ($130 million — enough to pay a year’s rent for roughly 3,500 families) in gross royalties. Nearly 70% of those sales — about $650 million ($650 million — more than the combined annual salaries of 13,000 average American households) — came from toys. All of this happened while Epic’s global privacy policy stated, in a single paragraph buried near the end of the document, that Epic did “not direct its websites, games, game engines, or applications to children.”

The Non-Financial Ledger: What Money Cannot Measure

There is a nine-year-old child in this story. His father wrote an email to Epic Games describing how his son, while playing Fortnite one morning, received a message from someone he had been playing with for months — a stranger his child considered a “friend” — saying that person was going to kill himself that night. The complaint records the father’s words directly: the message “shook him to the core.” That child was nine years old. He did not have the tools to process that. He did not have a warning. He had no way to avoid it. Epic Games had the tools to prevent it and chose not to use them.

That father’s email was one of thousands. Epic’s own player support system logged 834 cases in a single year containing the phrase “kill myself” and 485 cases containing the word “suicide.” These were not edge cases. These were patterns. These numbers were flagged internally by an Epic employee in May 2018, circulated to customer support leads, and documented in the company’s records. The federal government later cited them as evidence in a formal legal complaint. Epic kept the default settings unchanged.

Children were also being sexually victimized through the platform. The federal complaint documents that multiple news reports chronicled predators blackmailing, extorting, and coercing children and teens they met through Fortnite into sharing explicit images or meeting offline for sexual activity. Parents wrote to Epic about this. Player support tickets documented it. Epic’s own UX team flagged it — citing a report with the headline “child charity warns parents about predators in Fortnite” — in a formal internal presentation to leadership in June 2018. Leadership praised the presentation as “very well-researched and thoughtful” and then did nothing.

The phrase “bound to happen” is the corporate vocabulary of accepted harm. It translates, in plain language, to: we knew this would happen to kids, and we decided that was an acceptable cost of doing business. An Epic employee wrote those words in October 2017 — the same month voice chat was enabled by default in Fortnite’s Battle Royale mode, against the explicit recommendation of the company’s own Director of User Experience. The Director had emailed leadership in August 2017, before the feature launched, urging them to “avoid voice chat or have it opt-in at the very least.” The company’s response was silence, followed by enabling the feature anyway.

The harm was compounded by Epic’s design choices around privacy. When the game launched, players’ display names were publicly broadcast by default to everyone in every match. There was no way to hide your name. There was no way to prevent strangers from finding you, friending you, and making contact. The parental controls that would eventually arrive — nearly two full years after launch — required a parent to already know they existed, to have access to their child’s account, and to know where to search within a detailed settings menu to find them. Epic programmed obscurity into the safety features and visibility into the default exposure settings. That was a choice.

One of Epic’s own programmers captured exactly how useless the buried settings were. He described watching his ten-year-old nephew play Fortnite at a family gathering and noticing the TV had no sound. His nephew explained: “We turn off the volume because you can hear people talking.” The family had muted the television rather than search through Epic’s settings to disable voice chat. The programmer wrote internally: “People related to me by blood were no sh[**] muting the TV instead of looking for a way to disable voice chat. Not a proud day.” He forwarded the message to Epic’s lead UX researcher. The researcher responded: “Sigh.” The settings stayed buried.

Legal Receipts: They Said the Quiet Part Out Loud

These are verbatim quotations from the federal complaint, drawn directly from Epic’s own internal records and communications. Read them slowly.

Societal Impact: Who Pays When Corporations Break Child Safety Laws

Public Health: A Psychological Harm Factory Running at Scale

The Children’s Online Privacy Protection Act was not invented as a bureaucratic technicality. Congress enacted COPPA in 1998 specifically because lawmakers recognized that children online face unique psychological, developmental, and safety vulnerabilities that adults do not. Epic’s violation of that law was not a paperwork failure. It was a systematic exposure of millions of children to strangers, predators, sexual coercion, and suicide-related content without their parents’ knowledge or consent.

The public health consequences of this are real and lasting. Child psychologists and pediatric health professionals have documented the connection between online predation, harassment, and youth mental health crises. Children exposed to sexual coercion, blackmail, or graphic conversations about self-harm carry those experiences into their development. A nine-year-old who hears a stranger describe plans to die by suicide does not simply log off and forget. The FTC complaint explicitly frames these harms as “dangerous and psychologically traumatizing,” and the source material directly connects them to Epic’s deliberate product choices.

Epic’s own records show the company received reports of bullying, sexual threats, sexual harassment, predators coercing children into sharing explicit images, and children being pressured to meet strangers offline for sexual activity. These reports came through formal player support tickets submitted by distressed parents. They were logged, counted, forwarded internally, and filed away. The company’s response was to instruct its PR team to “stay out of the debate.” The debate, meanwhile, involved real children being harmed in real time.

Economic Inequality: The Price of Privacy Is a Burden Only Some Families Can Carry

Fortnite is free to download. That is by design. Epic built a game specifically accessible to children from all economic backgrounds, then stripped away the privacy protections that would have required adult intervention, digital literacy, and careful platform navigation to maintain. The children most exposed to Epic’s harmful defaults were the children whose parents worked double shifts, lacked broadband access to research parental controls, or simply trusted that a game rated for general audiences had been designed with their child’s safety in mind. It had not been.

Epic made the safety tools inaccessible by design. Parental controls did not arrive until June 2019 — nearly two years after launch. When they did arrive, activating them required: knowing the controls existed, having access to the child’s Fortnite account, locating the controls inside a multi-page settings menu, and setting a PIN. For parents who worked multiple jobs, who were not tech-savvy, or who simply assumed a product marketed to children came with basic child safety protections built in, those controls were effectively invisible.

When parents did contact Epic to request account review or deletion, Epic subjected them to an extraordinary gauntlet of verification requirements: IP addresses used by their child, account creation dates, invoice IDs from previous purchases, city and state of purchases, the last four digits of the first payment card used, the date of the last login, the original display name, any console IDs linked to the account, the name of a specific cosmetic item purchased more than 30 days ago, and in some cases a copy of the parent’s passport, ID card, or a rent or mortgage statement. This was the process for a parent trying to delete their child’s data from a video game. Epic designed this obstacle course. It was not an accident.

The Cost of a Life: What Epic Saved by Doing Nothing

What Now? Your Money, Your Data, Your Move

The federal complaint names Epic Games, Inc. as the defendant. The company’s principal place of business is listed as 620 Crossroads Blvd., Cary, North Carolina 27518. The following regulatory bodies have jurisdiction over the conduct described in this investigation:

• Federal Trade Commission (FTC): Primary enforcer of COPPA. The FTC filed the underlying complaint and negotiated the eventual settlement. You can report ongoing child privacy violations at ftc.gov/complaint.
• U.S. Department of Justice (DOJ): Filed the lawsuit on behalf of the United States. The Consumer Protection Branch of the Civil Division prosecuted this case.
• Your State Attorney General: Most states have consumer protection offices with jurisdiction over children’s data and unfair trade practices. File a complaint with your state AG if you or your child were affected.
• Congress: COPPA was written in 1998. The internet of 2024 bears no resemblance to the internet of 1998. Contact your representatives and demand updated child safety legislation with real teeth, real penalties, and mandatory opt-in defaults for any platform that children use.
• The Platform Accountability Project and Electronic Frontier Foundation (EFF): Advocacy organizations tracking corporate violations of digital privacy rights. Their research and legal support strengthen cases exactly like this one.

If your child plays Fortnite or any other online game with voice chat and stranger-matching, turn off voice chat today, enable parental controls, and do not assume defaults are safe. Corporations design defaults to maximize engagement, not to protect your child. The burden of safety has been placed on families by corporations that profit from removing it.

Organize locally. Parent groups, school boards, and community organizations have real power to demand that schools educate children on digital safety and pressure platforms to change defaults. Mutual aid networks that support families navigating predation, harassment, or mental health crises triggered by online platforms exist in most major cities. Find them. Fund them. The FTC cannot be everywhere. Community can be.