Microsoft will pay a fine of $20 million to settle Federal Trade Commission charges that it illegally collected and retained the data of children who signed up to use its Xbox video game console.

The agency charged that Microsoft gathered the data without notifying parents or obtaining their consent, and that it also illegally held onto the data. Those actions violated the Children’s Online Privacy Protection Act, the FTC stated.

In a blog post, Microsoft corporate vice president for Xbox, Dave McCarthy, outlined additional steps the company is now taking to improve its age verification systems and to ensure that parents are involved in the creation of child accounts for the service.

These mostly concern efforts to improve age verification technology and to educate children and parents about privacy issues.

McCarthy also said the company had identified and fixed a technical glitch that failed to delete child accounts in cases where the account creation process never finished.

Microsoft policy was to hold that data no longer than 14 days in order to allow players to pick up account creation where they left off if they were interrupted.

The settlement must be approved by a federal court before it can go into effect, the FTC said.

READ MORE: Ireland investigates how Facebook handles children's data on Instagram

A Microsoft spokesperson said the company was committed to complying with the order. The spokesperson added the account creation process will be updated and a data retention glitch found in the company's system will be resolved.

"Our proposed order makes it easier for parents to protect their children's privacy on Xbox, and limits what information Microsoft can collect and retain about kids," said Samuel Levine, director of the FTC's Bureau of Consumer Protection.

"This action should also make it abundantly clear that kids' avatars, biometric data, and health information are not exempt from COPPA," Levine added.

The law requires online services and websites directed to children under 13 to notify parents about the personal information they collect and to obtain verifiable parental consent before collecting and using any personal information of the children.

From 2015 to 2020, Microsoft retained the data that it collected from children during the account creation process, even when a parent failed to complete the process, according to the complaint.