The federal consumer watchdog said Microsoft violated the Children's Online Privacy Protection Act (COPPA), the federal law that governs the online privacy protections for children under the age of 13, which requires companies to notify parents about the data they collect, obtain parental consent, and delete the data when it's no longer necessary.

The FTC said children signing up to the Xbox gaming service were asked to provide their personal information -- including their name, email address, phone number and date of birth – which, until 2019 included a pre-filled check box allowing Microsoft to share user information with advertisers.

The FTC said Vole collected this data before asking the parent to complete the account setup but held onto the children's data even if the parent abandoned the sign-up process.

Writing in the FTC bog Lesley Fair said that after Vole gathered that raft of personal data from children, Microsoft thought about getting parents involved in the process.

As a result, the FTC will require Microsoft to notify parents and obtain consent for accounts created before May 2021. Microsoft will also have to establish new systems to delete children's personal information if it hasn't obtained parental consent and to ensure the data is deleted when it's no longer needed.