United States v. Epic Games, Inc.

TERRENCE W. BOYLE UNITED STATES DISTRICT JUDGE

THE UNITED STATES OF AMERICA

BRIAN M. BOYNTON

Principal Deputy Assistant Attorney General, Civil Division

ARUN G. RAO

Deputy Assistant Attorney General

AMANDA N. LISKAMM

Acting Director, Consumer Protection Branch

LISA K. HSIAO

Assistant Director, Consumer Protection Branch

Michael J. Wadden

Joshua A. Fowkes

Trial Attorneys

Consumer Protection Branch

BENJAMIN WISEMAN

Acting Associate Director

Division of Privacy and Identity Protection

MARK EICHORN

Assistant Director

Division of Privacy and Identity Protection

ANDREW HASTY

JAMES TRILLING

AMANDA KOULOUSIAS

Attorneys

FOR DEFENDANT:

Christopher Olsen /'

Wilson Sonsini Goodrich & Rosati

Libby Weingarten

Wilson Sonsini Goodrich & Rosati

Counsel for Epic Games, Inc.,

DEFENDANT:

Tim Sweeney Title: Chief Executive Officer Epic Games, Inc.

STIPULATED ORDER FOR PERMANENT

INJUNCTION AND CIVIL PENALTY

JUDGMENT

TERRENCE W. BOYLE UNITED STATES DISTRICT JUDGE

Plaintiff, the United States of America, acting upon notification and authorization to the Attorney General by the Federal Trade Commission ("Commission" or "FTC"), filed its Complaint for Civil Penalties, Permanent Injunction, and Other Relief ("Complaint"), for a permanent injunction, civil penalties, and other relief in this matter, pursuant to Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. §§ 53(b), 56(a)(1), and 57(b), the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d), and the Commission's Children's Online Privacy Protection Rule ("COPPA Rule"), 16 C.F.R. Part 312. Defendant has waived service of the summons and the Complaint. Plaintiff and Defendant stipulate to the entry of this Stipulated Order for Permanent Injunction and Civil Penalty Judgment ("Order") to resolve all matters in dispute in this action between them.

THEREFORE, IT IS ORDERED as follows:

FINDINGS

1. This Court has jurisdiction over this matter.

2. The Complaint charges that Defendant violated the COPPA Rule and the FTC Act by developing and operating an Internet-enabled video game with unfair default information sharing settings for Children and Teens; by failing to provide notice on Defendant's website or online service, and direct notice to Parents, of the Personal Information Defendant Collects online from Children, how Defendant uses such information, and Defendant's Disclosure practices; by failing to Obtain Verifiable Parental Consent before any Collection or use of Personal Information from Children; by failing to provide, at the request of Parents, a description of the specific types or categories of Personal Information Collected from Children; and by failing to Delete, at the request of Parents, Personal Information Collected from Children.

3. Defendant neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Order. Only for purposes of this action, Defendant admits the facts necessary to establish jurisdiction.

4. Defendant waives any claim that it may have under the Equal Access to Justice Act, 28 U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, and agree to bear their own costs and attorney fees.

5. Defendant waives all rights to appeal or otherwise challenge or contest the validity of this Order.

DEFINITIONS

For the purpose of this Order, the following definitions apply:

A. "Affirmative Express Consent" means any freely given, specific, informed, and unambiguous indication of an individual's wishes

demonstrating agreement by the individual, such as by a clear affirmative action, following a Clear and Conspicuous disclosure to the individual of: (i) all information required by sub-Provision III.C; (ii) a simple, easily-located means for the individual to withdraw consent; (iii) any limitations on the individual's ability to withdraw such consent; and (iv) all other information material to the provision of consent. The Clear and Conspicuous disclosure must be separate from any "privacy policy," "terms of service," "terms of use," or other similar document. The following do not constitute Affirmative Express Consent:

1. Inferring consent from the hovering over, muting, pausing, or closing of a given piece of content by the consumer; or

2. Obtaining consent through a user interface that has the effect of subverting or impairing user autonomy, decision-making, or choice.

B. "Biometric Information" means data that depicts or describes the physical or biological traits of an identified or identifiable individual, including: (1) identifiable depictions or identifiable information derived therefrom (e.g., extracts, models, or transcripts derived from image or video files); (2) copies of, or identifiable information derived from, an individual's facial features (e.g., faceprints, face embeddings, iris scans, retina scans, etc.), fingerprints, handprints, voice, genetics, or other physical or biological features; or (3) copies of, or identifiable information derived from, an

individual's characteristic movements or gestures (e.g., gait or typing patterns)

C. "Child" or "Children" means an individual or individuals under the age of 13.

D. "Clear(ly) and Conspicuously)" means that a required disclosure is difficult to miss (i.e., easily noticeable) and easily understandable by ordinary consumers, including in all of the following ways:

1. In any communication that is solely visual or solely audible, the disclosure must be made through the same means through which the communication is presented. In any communication made through both visual and audible means, such as a television advertisement, the disclosure must be presented simultaneously in both the visual and audible portions of the communication even if the representation requiring the disclosure is made in only one means.

2. A visual disclosure, by its size, contrast, location, the length of time it appears, and other characteristics, must stand out from any accompanying text or other visual elements so that it is easily noticed, read, and understood.

3. An audible disclosure, including streaming video, must be delivered in a volume, speed, and cadence sufficient for ordinary consumers to easily hear and understand it.

4. In any communication using an interactive electronic medium, such as the Internet or software, the disclosure must be unavoidable.

5. The disclosure must use diction and syntax understandable to ordinary consumers and must appear in each language in which the representation that requires the disclosure appears.

6. The disclosure must comply with these requirements in each medium through which it is received, including all electronic devices and face-to-face communications.

7. The disclosure must not be contradicted or mitigated by, or inconsistent with, anything else in the communication.

8. When the representation or sales practice targets a specific audience, such as Children, Teens, the elderly, or the terminally ill, "ordinary consumers" includes reasonable members of that group.

E. "Collects," "Collected," "Collecting," or "Collection" means, for the purposes of Definitions L, N, P, T, X, Z, AA, and Provision I of this Order only, the gathering of any Personal Information from a Child by any means, including but not limited to:

1. Requesting, prompting, or encouraging a Child to submit Personal Information online;

2. Enabling a Child to make Personal Information publicly available in identifiable form; or

3. Passive tracking of a Child online.

F. "Compliance Date" means thirty (30) days after entry of this Order.

G. "Covered Business" means: (1) Defendant; and (2) any business that Defendant controls, directly or indirectly, that (i) discloses Covered Information collected from one user to another user, (ii) enables the disclosure of Covered Information from one user to another user, or (iii) enables any user to communicate with any other user. For purposes of this Order, to the extent that, after entry of this Order, Defendant obtains direct or indirect control over a business that discloses Covered Information collected from one user to another user, enables the disclosure of Covered Information from one user to another user, or enables any user to communicate with any other user, such business becomes a Covered Business sixty (60) days after the date on which Defendant obtained such control.

H. "Covered Information" means the following information from or about an individual consumer: (1) Personal Information; (2) Biometric Information; (3) the content of any communication from an individual; (4) credit or debit card information; (5) a date of birth; (6) a first and last name; (7) a home or other physical address including street name and name of a city or town; (8) Online Contact Information; (9) a screen or user name where it functions in the same manner as Online Contact Information; (10) a telephone number; (11) a Social Security number; (12) a Persistent Identifier; (13) geolocation information sufficient to identify street name and name of a city or town; or

(14) information concerning an individual collected online and combined with a Persistent Identifier.

I. "Covered Product or Service" means any Internet-enabled product or service controlled or operated, directly or indirectly, by any Covered Business, that: (1) discloses Covered Information collected from one user to another user; (2) enables the disclosure of Covered Information from one user to another user; or (3) enables any user to communicate with any other user.

J. "Defendant" means Epic Games, Inc., a corporation, and its successors and assigns.

K. "Delete" means to remove Personal Information such that it is not maintained in retrievable form and cannot be retrieved in the normal course of business.

L. "Disclose," "Disclosed," "Disclosing," or "Disclosure" means, with respect to Personal Information, for the purposes of Definitions N, X, Z, AA, and Provision I of this Order only:

1. The Release of Personal Information Collected by an Operator from a Child in identifiable form for any purpose, except where an Operator provides such information to a Person who provides Support for the Internal Operations of the Website or Online Service; and

2. Making Personal Information Collected by an Operator from a Child publicly available in identifiable form by any means, including but not

limited to a public posting through the Internet, or through a personal home page or screen posted on a website or online service; a pen pal service; an electronic mail service; a message board; or a chat room.

M. "Internet" means collectively the myriad of computer and telecommunication facilities, including equipment and operating software, which comprises the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other methods of transmission.

N. "Obtain, Obtained, or Obtaining Verifiable Parental Consent" means making any reasonable effort (taking into consideration available technology) to ensure that before Personal Information is Collected from a Child, a Parent of the Child:

1. Receives notice of the Operator's Personal Information Collection, use, and Disclosure practices; and

2. Authorizes any Collection, use, or Disclosure of the Personal Information.

O. "Online Contact Information" means an email address or any other substantially similar identifier that permits direct contact with a Person online, including but not limited to, an instant messaging user identifier, a voice over internet protocol (VOIP) identifier, or a video chat identifier.

P. "Operator" means any Person who operates a website located on the Internet or W online service and who Collects or maintains Personal Information from or about the users of or visitors to such website or online service, or on whose behalf such information is Collected and maintained, or offers products or services for sale through the website or online service, where such website or online service is operated for commercial purposes involving commerce among the several States, or with one or more foreign nations; in any territory of the United States or in the District of Columbia, or between any such territory and another such territory or any State or nation; or between the District of Columbia and any State, territory, or foreign nation.

Q. "Parent" includes a legal guardian.

R. "Persistent Identifier" means an identifier that can be used to recognize a user over time and across different websites or online services. Such Persistent Identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier.

S. "Person" means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity.

T. "Personal Information" means individually identifiable information about an individual Collected online, including: 1. A first and last name;

2. A home or other physical address including street name and name of a city or town;

3. Online Contact Information;

4. A screen or user name where it functions in the same manner as Online Contact Information;

5. A telephone number;

6. A Social Security number;

7. A Persistent Identifier;

8. A photograph, video, or audio file where such file contains a Child's image or voice;

9. Geolocation information sufficient to identify street name and name of a city or town; or

10. Information concerning the Child or the Parents of that Child that the Operator Collects online from the Child and combines with a Persistent Identifier.

U. "Principal Executive Officer" means Timothy Sweeney for so long as he serves as Chief Executive Officer of Defendant, or such other officer (regardless of title) that is designated in Defendant's bylaws or by resolution of Defendant's board of directors as being the most senior executive officer of Defendant, acting solely in his official capacity on behalf of Defendant; or if Timothy Sweeney no longer serves in such a position, then such other individual serving as the Chief Executive Officer

of Defendant, or such other officer (regardless of title) that is designated in Defendant's bylaws or by resolution of Defendant's board of directors as being the most senior executive officer of Defendant, acting solely in their official capacity on behalf of Defendant. In the event that Timothy Sweeney is not the Principal Executive Officer and such position is jointly held by two or more individuals, then each of such individuals must be deemed to be a Principal Executive Officer.

V. "Privacy Setting" means any control or setting that allows a user of a Covered Product or Service, or their Parent, to enable, and subsequently disable, restrict, or otherwise control, any disclosure of the user's Covered Information to, or ability of the user to communicate with or receive communications from, any other user of the Covered Product or Service.

W. "Release of Personal Information" means the sharing, selling, renting, or transfer of Personal Information to any Third Party.

X. "Support for the Internal Operations of the Website or Online Service" means:

1. Those activities necessary to:

a. Maintain or analyze the functioning of the website or online service;

b. Perform network communications;

c. Authenticate users of, or personalize the content on, the website or online service;

d. Serve contextual advertising on the website or online service or cap the frequency of advertising;

e. Protect the security or integrity of the user, website, or online service;

f. Ensure legal or regulatory compliance; or

g. Fulfill a request of a Child as permitted by 16 C.F.R. §§ 312.5(c)(3) and (4);

2. So long as the information Collected for the activities listed in paragraphs (1)(a)-(g) of this definition is not used or Disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose.

Y. "Teen" means an individual aged 13, 14, 15, 16, or 17.

Z. "Third Party" means, for the purpose of Definition W only, any Person who is not:

1. An Operator with respect to the Collection or maintenance of Personal Information on the Web site or online service; or

2. A Person who provides Support for the Internal Operations of the Web site or Online Service and who does not use or Disclose information protected under the COPPA Rule (attached as Appendix A) for any other purpose.

AA. "Website or Online Service Directed to Children" means a commercial website or online service, or portion thereof, that is targeted to Children.

1. In determining whether a website or online service, or a portion thereof, is directed to Children, the Commission will consider its subject matter, visual content, use of animated characters or Child-oriented activities and incentives, music or other audio content, age of models, presence of Child celebrities who appeal to Children, language or other characteristics of the website or online service, as well as whether advertising promoting or appearing on the website or online service is directed to Children. The Commission will also consider competent and reliable empirical evidence regarding audience composition, and evidence regarding the intended audience.

2. A website or online service shall be deemed directed to Children when it has actual knowledge that it is Collecting Personal Information directly from users of another website or online service directed to Children.

3. A website or online service that is directed to Children under the criteria set forth in paragraph (1) of this definition, but that does not target Children as its primary audience, shall not be deemed directed to Children if it:

a. Does not Collect Personal Information from any visitor prior to Collecting age information; and

b. Prevents the Collection, use, or Disclosure of Personal Information from visitors who identify themselves as under age 13 without first complying with the notice and parental consent provisions of the COPPA Rule (attached as Appendix A).

4. A website or online service shall not be deemed directed to Children solely because it refers or links to a commercial website or online service directed to Children by using information location tools, including a directory, index, reference, pointer, or hypertext link.

ORDER

I. INJUNCTION CONCERNING THE COLLECTION OF PERSONAL INFORMATION FROM CHILDREN

IT IS FURTHER ORDERED that, no later than the Compliance Date, Defendant and Defendant's officers, agents, employees, and attorneys, and all other Persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with being an Operator of any Website or Online Service Directed to Children or of any website or online service with actual knowledge that it is Collecting or maintaining Personal Information from a Child, are hereby permanently restrained and enjoined from:

A. Failing to make reasonable efforts, taking into account available technology, to ensure that a Parent of a Child receives direct notice of the Operator's practices with regard to the Collection, use, or Disclosure of Personal Information from Children, including notice of any material

change in the Collection, use, or Disclosure practices to which the Parent has previously consented, unless the COPPA Rule (attached as Appendix A), provides an exception to providing such notice;

B. Failing to post a prominent and clearly labeled link to an online notice of the Operator's information practices with regard to Children, if any, on the home or landing page or screen of its website or online service, and at each area of the website or online service where Personal Information is Collected from Children, unless the COPPA Rule (attached as Appendix A), provides an exception to providing such notice;

C. Failing to Obtain Verifiable Parental Consent before any Collection, use, or Disclosure of Personal Information from Children, including consent to any material change in the Collection, use, or Disclosure practices to which the Parent has previously consented, unless the COPPA Rule (attached as Appendix A), provides an exception to Obtaining Verifiable Parental Consent;

D. Failing to Delete a Child's Personal Information at the request of a Parent;

E. Retaining a Child's Personal Information for longer than is reasonably necessary to fulfill the purpose for which the information was Collected; and

F. Violating the COPPA Rule (attached as Appendix A).

II. INJUNCTION CONCERNING CHILDREN'S PERSONAL INFORMATION PREVIOUSLY COLLECTED

IT IS FURTHER ORDERED that Defendant, Defendant's officers, agents, employees, and attorneys, and all other Persons in active concert or participation with any of them, who receive actual notice of this Order, must:

A. Within sixty (60) days of the Compliance Date, Delete all Personal Information that is associated, at the time of the Compliance Date, with any Fortnite user, unless:

1. the user has provided age information through a neutral age gate identifying the user as age 13 or older; or

2. Defendant has provided direct notice and Obtained Verifiable Parental Consent; and

B. Within ninety (90) days of the Compliance Date, provide a written statement to the Commission, sworn under penalty of perjury, that:

1. Describes all processes through which Defendant provided direct notice and sought to Obtain Verifiable Parental consent for any accounts covered by this Provision II;

2. Identifies the total number of accounts for which (i) direct notice was provided; (ii) Defendant Obtained Verifiable Parental Consent; (iii) verifiable parental consent was affirmatively declined; and (iv) no response was provided;

3. Describes in detail any Personal Information Defendant retains in accordance with sub-Provisions II.C or II.D, the basis for such retention, and, as applicable, the specific government agency, law, regulation, or court order that requires such retention; and

4. Confirms that all Personal Information required to be Deleted by this Provision II has been Deleted.

Provided, however, that:

C. Persistent Identifiers that Defendant is otherwise required to Delete by this Provision II need not be Deleted to the extent they are used solely for Support for the Internal Operations of the Website or Online Service; and

D. Personal Information that Defendant is otherwise required to Delete by this Provision II may be retained, and may be disclosed, as requested by a government agency or required by law, regulation, or court order. Within thirty (30) days after the obligation to retain any such Personal Information has ended, Defendant shall Delete such Personal Information and provide an additional written statement to the Commission, sworn under penalty of perjury, confirming that Defendant has Deleted such Personal Information.

III. DEFAULT PRIVACY SETTINGS FOR CHILDREN

AND TEENS

IT IS FURTHER ORDERED that, within thirty (30) days of the Compliance Date, Defendant, Defendant's officers, agents, employees, and attorneys, and all other Persons in active concert or participation with any of them, who receive actual notice of this Order, in connection with any Covered Product or Service, are permanently restrained and enjoined from disclosing a Child's or Teen's Covered Information to, enabling a Child or Teen to disclose their Covered Information to, or enabling a Child or Teen to converse with or be party to conversations between or among, any other user of the Covered Product or Service, unless:

A. For a Child user, the Child's Parent has provided, and not withdrawn, their Affirmative Express Consent through an easily-located Privacy Setting; and

B. For a Teen user, the Teen (or the Teen's Parent) has provided, and not withdrawn, their Affirmative Express Consent through an easily-located Privacy Setting.

C. Each Clear and Conspicuous disclosure required pursuant to sub-Provisions III.A. and III.B. must identify: (1) each type of Covered Information that will be disclosed; (2) each category of Persons to which each type of Covered Information will be disclosed; (3) each type of communication the Child or Teen will be able to make or receive; and (4) each category of Persons to, or from which, the Child or Teen will be able to make, or receive, each type of communication.

D. For the purposes of this Provision III:

1. Any user of any Covered Product or Service that is a Website or Online Service Directed to Children must be deemed a Child, provided, however, that for any such Covered Product or Service that does not target Children as its primary audience, Defendant may collect age

information from users before collecting any other Covered Information' and treat each user accordingly unless and until Defendant has actual knowledge that the user is a Child or Teen;

2. Any user of any Covered Product or Service that is not a Website or Online Service Directed to Children may be treated as neither a Child nor a Teen unless and until Defendant has actual knowledge that the user is a Child or Teen; and

3. To the extent that a display name of a Child or Teen is disclosed in a multiuser game or other interactive multiuser experience to identify participating users, such display name will not be considered Covered Information. Provided, however, Defendant must describe: (i) in a direct notice to parents, any such disclosure of a Child's display name; and (ii) in Defendant's privacy policy, any such disclosure of a Child's or Teen's display name.

IV. MANDATED PRIVACY PROGRAM

IT IS FURTHER ORDERED that each Covered Business, in connection with the collection, maintenance, use, or disclosure of, or provision of access to, Covered Information, must, within thirty (30) days of the Compliance Date, establish and implement, and thereafter maintain, a comprehensive privacy program (the "Privacy Program") that protects the privacy of such Covered Information. To satisfy this requirement, each Covered Business must, at a minimum:

A. Document in writing the content, implementation, and maintenance of the "Privacy Program;

B. Provide the written program and any evaluations thereof or updates thereto to its board of directors or governing body, or if no such board or equivalent governing body exists, to a senior officer responsible for the Privacy Program at least once every twelve (12) months;

C. Designate a qualified employee or employees to coordinate and be responsible for the Privacy Program;

D. Assess and document, at least once every twelve (12) months, internal and external risks to the privacy of Covered Information that could result in the unauthorized collection, maintenance, use, or disclosure of, or provision of access to, Covered Information;

E. Design, implement, maintain, and document safeguards that control for the material internal and external risks the Covered Business identifies to the privacy of Covered Information identified in response to sub-Provision IV.D. Each safeguard must be based on the volume and sensitivity of the Covered Information that is at risk, and the likelihood that the risk could be realized and result in the unauthorized collection, maintenance, use, or disclosure of, or provision of access to, Covered Information. Such safeguards must include:

1. Policies, procedures, and technical measures to comply with COPPA and the COPPA Rule;

2. Policies, procedures, and technical measures to comply with Provision III;

3. Regular COPPA Rule training on at least an annual basis for all employees and contractors providing services to the Covered Business whose responsibilities include any of the following: (a) access to Covered Information; (b) Covered Products or Services design, engineering, or implementation; or (c) Privacy Settings design, engineering, or implementation; and

4. Regular privacy training programs for all employees and contractors providing services to the Covered Business, updated on at least an annual basis to address any identified material internal or external risks and safeguards implemented pursuant to this Order;

F. Assess, at least once every twelve (12) months, the sufficiency of any safeguards in place to address the internal and external risks to the privacy of Covered Information, and modify the Privacy Program as needed based on the results;

G. Test and monitor the effectiveness of the safeguards at least once every twelve (12) months, and modify the Privacy Program as needed based on the results;

H. Select and retain service providers capable of safeguarding Covered Information they access through or receive from the Covered Business, and contractually require service providers to implement and maintain

safeguards sufficient to address the internal and external risks to the privacy of Covered Information; and

I. Evaluate and adjust the Privacy Program in light of any changes to the Covered Business's operations or business arrangements, new or more efficient technological or operational methods to control for the risks identified in sub-Provision IV.D of this Order, or any other circumstances that the Covered Business knows or has reason to know may have an impact on the effectiveness of the Privacy Program or any of its individual safeguards. At a minimum, the Covered Business must evaluate the Privacy Program at least once every twelve (12) months and modify the Privacy Program as needed based on the results.

V. PRIVACY ASSESSMENTS BY A THIRD PARTY

IT IS FURTHER ORDERED that, in connection with Provision IV of this Order titled Mandated Privacy Program, Defendant must obtain initial and biennial assessments ("Assessments"):

A. The Assessment must be obtained from a qualified, objective, independent third-party professional ("Assessor"), who: (1) uses procedures and standards generally accepted in the profession; (2) conducts an independent review of the Privacy Program; (3) retains all documents relevant to each Assessment for five (5) years after completion of such Assessment; and (4) will provide such documents to the Commission within ten (10) days of receipt of a written request from a representative of the Commission. The

Assessor may not withhold any documents from the Commission on the basis of a claim of confidentiality, proprietary or trade secrets, work product protection, attorney-client privilege, statutory exemption, or any similar claim.

B. For each Assessment, Defendant must provide the Associate Director for Enforcement for the Bureau of Consumer Protection at the Federal Trade Commission with the name, affiliation, and qualifications of the proposed Assessor, whom the Associate Director shall have the authority to approve in their sole discretion.

C. Within ten (10) days of receiving notice that the Associate Director for Enforcement has approved a proposed Assessor, Defendant must file a joint notice of the selection of the Assessor with the Court.

D. The reporting period for the Assessments must cover: (1) the first 180 days after the Privacy Program has been put in place for the initial Assessment; and (2) each two-year period thereafter for twenty (20) years after the entry date of the Order for the biennial Assessments.

E. Each Assessment must, for the entire assessment period:

1. Determine whether each Covered Business has implemented and maintained the Privacy Program required by Provision IV of this Order, titled Mandated Privacy Program;

2. Assess the effectiveness of each Covered Business's implementation and maintenance of sub-Provisions IV.A-I;

3. Identify any gaps or weaknesses in, or instances of material noncompliance with, the Privacy Program;

4. Address the status of gaps or weaknesses in, or instances of material non-compliance with, the Privacy Program that were identified in any prior Assessment required by this Order; and

5. Identify specific evidence (including but not limited to documents reviewed, sampling and testing performed, and interviews conducted) examined to make such determinations, assessments, and identifications, and explain why the evidence that the Assessor examined is: (a) appropriate for assessing an enterprise of the Covered Business's size, complexity, and risk profile; and (b) sufficient to justify the Assessor's findings. No finding of any Assessment shall rely primarily on assertions or attestations by a Covered Business's management. The Assessment must be signed by the Assessor, state that the Assessor conducted an independent review of the Privacy Program and did not rely primarily on assertions or attestations by a Covered Business's management, and state the number of hours that each member of the assessment team worked on the Assessment. To the extent that a Covered Business adds, materially revises, or materially updates one or more safeguards required under Provision IV of this Order during an Assessment period, the Assessment must assess the effectiveness of the added, materially revised, or materially updated

safeguard(s) for the time period in which it was in effect, and provide a separate statement detailing the basis for each additional, materially revised, or materially updated safeguard.

F. Each Assessment must be completed within sixty (60) days after the end of the reporting period to which the Assessment applies. Unless otherwise directed by a Commission representative in writing, Defendant must submit an unredacted copy of the initial Assessment and a proposed redacted copy suitable for public disclosure of the initial Assessment to the Commission within ten (10) days after the Assessment has been completed via email to DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: "United States v. Epic Games, Inc., FTC File No. 2223087." Defendant must retain an unredacted copy of each subsequent biennial Assessment as well as a proposed redacted copy suitable for public disclosure of each subsequent biennial Assessment until the Order is terminated and provide it to the Associate Director for Enforcement within ten (10) days of request. The initial Assessment and any subsequent biennial Assessment provided to the Commission must be marked, in the upper right-hand corner of each page, with the words "DPIP Assessment" in red lettering.

G. Within ten (10) days after the completion of each Assessment, Defendant must file an unredacted copy of the Assessment with the Court. The Pannes acknowledge that the Assessments may contain confidential business information, personal or financial information, trade secrets, or otherwise competitively sensitive information. Any Assessment containing such information shall be filed under seal and accompanied by a submission demonstrating good cause for sealing the Assessment.

VI. COOPERATION WITH THIRD-PARTY PRIVACY ASSESSOR

IT IS FURTHER ORDERED that Defendant, whether acting directly or indirectly, in connection with any Assessment required by Provision V of this Order titled Privacy Assessments by a Third Party, must:

A. Provide or otherwise make available to the Assessor all information and material in its possession, custody, or control that is relevant to the Assessment for which there is no reasonable claim of privilege;

B. Provide or otherwise make available to the Assessor information about each Covered Business's network(s), and all of each Covered Business's IT assets so that the Assessor can determine the scope of the Assessment, and visibility to those portions of the network(s) and IT assets deemed in scope; and

C. Disclose all material facts to the Assessor, and not misrepresent in any manner, expressly or by implication, any fact material to the Assessor's:

(1) determination of whether Defendant has implemented and maintained the Privacy Program required by Provision IV of this Order, titled Mandated Privacy Program; (2) assessment of the effectiveness of the implementation and maintenance of sub-Provisions IV.A-I; or (3) identification of any gaps or weaknesses in, or instances of material noncompliance with, the Privacy Program.

VII. ANNUAL CERTIFICATION

IT IS FURTHER ORDERED that, one year after the Compliance Date, and each year thereafter for ten (10) years after the Compliance Dated:

A. Defendant must provide the Commission with a certification from the Principal Executive Officer that: (1) Defendant has established, implemented, and maintained the requirements of this Order; and (2) Defendant is not aware of any material noncompliance that has not been (a) corrected or (b) disclosed to the Commission. The certification must be based on the personal knowledge of the Principal Executive Officer or subject matter experts upon whom the Principal Executive Officer reasonably relies in making the certification.

B. Defendant must provide the Commission with a certification from a senior officer of each Covered Business other than Defendant responsible for each such Covered Business's Privacy Program that: (1) each Covered Business other than Defendant has established, implemented, and maintained the requirements of this Order; and (2) each Covered Business other than

Defendant is not aware of any material noncompliance that has not been (a) corrected or (b) disclosed to the Commission. The certification must be based on the personal knowledge of the senior corporate manager, senior officer, or subject matter experts upon whom the senior corporate manager or senior officer reasonably relies in making the certification.

C. Unless otherwise directed by a Commission representative in writing, submit all annual certifications to the Commission pursuant to this Order via email to DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: "United States v. Epic Games, Inc., FTC File No. 2223087."

VIII. MONETARY JUDGMENT FOR CIVIL PENALTY

IT IS FURTHER ORDERED that:

A. Judgment in the amount of two hundred seventy five million dollars ($275,000,000) is entered in favor of Plaintiff against Defendant as a civil penalty.

B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the United States, two hundred seventy five million dollars ($275,000,000), which, as Defendant stipulates, its undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. Such payment must be made within seven (7) days of entry of this Order by

electronic fund transfer in accordance with instructions previously provided by'a representative of plaintiff's

C. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all assets transferred pursuant to this Order and may not seek the return of any assets.

D. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent civil litigation by or on behalf of the Commission in a proceeding to enforce its rights to any payment or monetary judgment pursuant to this Order.

E. Defendant acknowledges that its Taxpayer Identification Numbers (Social Security Numbers or Employer Identification Numbers), which Defendant must submit to the Commission, may be used for collecting and reporting on any delinquent amount arising out of this Order, in accordance with 31 U.S.C. §7701.

IX. ORDER ACKNOWLEDGMENTS

IT IS FURTHER ORDERED that Defendant obtain acknowledgments of receipt of this Order:

A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.

B. For five (5) years after entry of this Order, Defendant must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers

and members; (2) all employees, agents, and representatives having managerial responsibilities for conduct related to the subject matter of the' Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Reporting. Delivery must occur within seven (7) days of entry of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.

C. From each individual or entity to which Defendant delivered a copy of this Order, Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.

X. COMPLIANCE REPORTING

IT IS FURTHER ORDERED that Defendant make timely submissions to the Commission:

A. One (1) year after entry of this Order, Defendant must submit a compliance report, sworn under penalty of perjury:

1. Defendant must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission and Plaintiff may use to communicate with Defendant; (b) identify all of Defendant's businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (c) describe the activities of each business, including the goods and services offered, the means of advertising, marketing, and sales; (d) describe in detail whether and how Defendant

is in compliance with each provision of this Order; and (e) provide a copy of each Order Acknowledgment obtained pursuant to this Order unless previously submitted to the Commission.

B. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in the following:

1. Defendant must report any change in: (a) any designated point of contact; or (b) the structure of Defendant or any entity that Defendant has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.

C. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against Defendant within fourteen (14) days of its filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: "I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on:" and supplying the date, signatory's full name, title (if applicable), and signature.

Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: "United States v. Epic Games, Inc., FTC File No. 2223087."

XI. RECORDKEEPING

IT IS FURTHER ORDERED that Defendant must create certain records for ten (10) years after entry of the Order, and retain each such record for five (5) years. Specifically, Defendant must create and retain the following records:

A. Accounting records showing the revenues from all goods or services sold in connection to any Covered Product or Service;

B. Personnel records showing, for each Person providing services in connection to any Covered Product or Service, whether as an employee or otherwise, that Person's: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;

C. Copies or records of all consumer complaints and refund requests concerning the subject matter of the Order, whether received directly or through any domestic government regulatory authority; and

D. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission.

XII. COMPLIANCE MONITORING

IT IS FURTHER ORDERED that, for the purpose of monitoring Defendant's compliance with this Order:

A. Within fourteen (14) days of receipt of a written request from a representative of the Commission or Plaintiff, Defendant must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury; appear for depositions; and produce documents for inspection and copying. The Commission and Plaintiff are also authorized to obtain discovery, without further leave of court, using any of the procedures prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36,45, and 69, provided that Defendant, after attempting to resolve a dispute without court action and for good cause shown, may file a motion with this Court seeking an order for one or more of the protections set forth in Rule 26(c).

B. For matters concerning this Order, the Commission and Plaintiff are authorized to communicate directly with Defendant. Defendant must permit representatives of the Commission and Plaintiff to interview any employee or other Person affiliated with Defendant who has agreed to such an interview. The Person interviewed may have counsel present.

C. The Commission and Plaintiff may use all other lawful means, including posing, through its representatives as consumers, suppliers, or other individuals or entities, to Defendant or any individual or entity affiliated

with Defendant, without the necessity of identification or prior notice. Nothing in this Order limits the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-l.

XIII.

RETENTION OF JURISDICTION IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order. SO ORDERED.

SO STIPULATED AND AGREED: