The US Federal Trade Commission (FTC) has fined Microsoft $20 million for violating the U.S. Children’s Online Privacy Protection Act (COPPA).  In a press release, the FTC said that Microsoft illegally collected personal information from kids on Xbox consoles without consent from their parents.

The FTC also accused Microsoft of retaining the data it collected from children during the Xbox account creation process, even when parents didn’t complete the process. The FTC said that Microsoft sometimes kept this data “for years” between 2015 and 2020.

In addition to the $20 million fine, the FTC will require Microsoft to implement new systems to improve the privacy of children using Xbox consoles. “For example, the order will extend COPPA protections to third-party gaming publishers with whom Microsoft shares children’s data. In addition, the order makes clear that avatars generated from a child’s image, and biometric and health information, are covered by the COPPA Rule when collected with other personal data,” the FTC explained.

In a press release posted on Xbox Wire, Microsoft acknowledged that a “technical glitch” caused Microsoft’s systems to not delete account creation data for child accounts when the process wasn’t entirely completed after 14 days. Microsoft said that it has fixed the glitch and deleted that data that was “never used, shared, or monetized.”

The company also said that it has already updated its account creation process to better identify potential child accounts and make parents and caregivers aware of what they need to do to protect their children’s data. In the coming months, Microsoft will also require kids under the age of 13 who created an account before May 2021 to reverify their account with a parent. “We are working hard to ensure that when parents are prompted to reconsent, they will have the information needed to proceed without disruptions to their child’s access,” the company explained.

While Microsoft agreed to make some changes to verify child accounts on Xbox consoles, the company wasn’t the only one to receive a fine for illegally collecting personal data from children this year. Last month, the FTC also fined Amazon $25 million for illegally keeping kid’s Alexa voice recordings.