FTC vs. Epic Games: Illegal Dark Patterns?

Background to the Settlement

The subject oft he dispute was the FTC’s allegations that Epic violated the Children’s Online Privacy Protection Act (COPPA) and used design tricks (so-called “dark patterns”) to trick millions of players into making unwanted purchases.

Violations of COPPA

Overall, the FTC found two gross violations of COPPA in Epic’s conduct and design of the Fortnite game.

First, the FTC alleged that Epic was aware that many children were playing Fortnite, as shown by, among other things, surveys of Fortnite users, licensing and marketing of Fortnite toys and merchandise primarily targeted to children, player support and other internal company communications. Despite this knowledge, Epic collected personal data from children without obtaining the necessary parental consent. Epic had also placed unreasonable hurdles in the way of deletion requests from parents and had, in some cases, not honored deletion requests.

Second, the default settings of the game had already harmed children and young people. In Fortnite, Epic had enabled text and voice communication for players by default. This lead to the game matching children and teenagers with strangers who then bullied, threatened, harassed, and exposed them to dangerous and psychologically traumatizing topics, such as suicide. As early as 2017, Epic employees had unsuccessfully pointed out the need for an opt-in option for voice chat, particularly in light of the dangers to children and teens.

Illegal Dark Patterns

The FTC further alleged that Epic used so-called Dark Patterns in Fortnite to entice players to make accidental purchases.

Dark Patterns is a term coined by Harry Brignull. According to Brignull, dark patterns are essentially desigs deliberately “crafted with great attention to detail, and a solid understanding of human psychology, to trick users into do things they wouldn’t otherwise have done”.

For one thing, the FTC says that the deliberately chosen counterintuitive, inconsistent and confusing placement of buttons, as well as the fact that players could make purchases with a single click without confirmation, led to purchases worth hundreds of millions. This also includes the fact that purchases could sometimes be made when waking the game from sleep mode as well as during loading screens.

For another, Epic had designed Fortnite in such a way that, until 2018, children were able to purchase the in-game currency V-Bucks by simply pressing buttons, without requiring parental or card holders consent.

In addition, Epic had locked accounts when the account holders disputed unauthorized purchases with their credit card companies. For players, this account lockout meant that they lost access to all of their previously purchased content, even if they had only disputed a single unauthorized purchase.

Legal Classification of Dark Patterns in Germany and the EU

In the EU and Germany there is currently no uniform legal definition of dark patterns that encompasses all of the practices objected to by the FTC. The new EU Digital Services Act (DSA, Regulation (EU) 2022/2065) explicitly refers to dark patterns in Recital (67) and defines them as “practices that materially distort or impair, either on purpose or in effect, the ability of recipients of the service to make autonomous and informed choices or decisions”. Art. 25 DSA prohibits such practices. Pursuant to this provision, online platform providers may not “design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions”.

The Digital Service Act applies (with the exception of individual provisions that apply earlier) as of Feb. 17, 2024, and is directly applicable without further implementation by German lawmakers. It is still unclear whether computer games constitute an “online platform” within the meaning of the DSA. In view of the definition of online platform in Art. 3 i) DSA, cases are conceivable in which this would be the case.

Even if a large number of games do not fall under the definition of online platforms, this does not mean that there are no legal limits to dark patterns. Limits are set primarily by competition and consumer protection. Depending on the specific design, dark patterns may constitute unfair business practices within the meaning of Section 3 (1) and (2) of the German Unfair Competition Act (UWG) or fulfill the unfairness requirements of Sections 5 et sec. UWG.

Certain regulations and principles of law, such as Art. 25 DSA itself as well as the Privacy by Design principle in Art. 25 GDPR, according to which data protection should already be considered in the conception and development of products, services and processes indicate a paradigm shift in the perception of consumers and consumer behavior by legislation. This in itself reflects the increase in importance of the behavioral economics perspective and necessity of ethical design approaches in lawmaking. Especially if cases like FTC vs. Epic continue to be discussed in a high-profile way, a further alignment of legislation with actual reality is to be expected.

Conclusion

Especially the protection of consumers and minors has always been of substantial importance in the gaming sector and gains yet another facet through Dark Patterns. If the DSA does not apply to most games, legislators could take appropriate action to combat dark paterns outside of the competition law. The importance of the gaming industry is constantly increasing. Thus, the need for clear and consumer-protective regulations that are at the same time not far removed from reality and the legitimate interests of game manufacturers is also increasing.