HoYoverse has agreed to pay $20 million and ban children under 16 from making in-game purchases in Genshin Impact without parental consent to resolve claims by the US Federal Trade Commission (FTC). The company was accused of violating the Children's Privacy Act and deceiving users, including children, about the real costs of purchases and chances to win rare prizes.
"Genshin Impact deceived children, teens, and other players into spending hundreds of dollars on prizes they stood little chance of winning. Companies that deploy these dark-pattern tactics will be held accountable if they deceive players, particularly kids and teens, about the true costs of in-game transactions," said Samuel Levine, Director of the FTC's Bureau of Consumer Protection.
The complaint against HoYoverse alleged that the company actively promoted Genshin Impact to children and collected their personal information in violation of the Children's Online Privacy Protection Act (COPPA). In addition, the complaint stated that HoYoverse misled players about the chances of receiving "five-star" prizes from loot boxes, such as characters, weapons, and other in-game items.
The developer of Genshin Impact also failed to comply with COPPA rules that require online services and websites targeting children under 13 to notify parents of the personal information they collect and obtain parental consent before collecting and using this information. In particular, the company shared with third parties, such as analytical or advertising companies, data about player IDs, devices, purchases, preferences, friend list, etc.
In addition to the $20 million fine, HoYoverse is obliged to make changes in accordance with the complaints. The company must prohibit children under 16 from purchasing loot boxes in Genshin Impact and other games without parental permission, provide an opportunity to purchase loot boxes for real currency, and clearly inform about the chances of getting different items from loot boxes, their prices, and features. In addition, the company must delete all personal information collected about children under 13 years of age unless parental consent is obtained to store such data.