Epic Games, Inc. is a privately held video game and software company headquartered in Cary, North Carolina, best known for Fortnite, the Epic Games Store, and Unreal Engine; Tencent has held roughly a 40% minority stake since a 2012 investment. Epic's own Privacy Policy states it collects a broad range of information -- including voice chat, images, and IP-derived geolocation -- and discloses data to marketing/advertising partners, payment processors, and large language model providers, while separately asserting it does not 'sell or share' personal information under CCPA's technical definition. Its App Store privacy label declares data linked to a user's identity across financial, location, contact, user-content, identifier, usage, and diagnostic categories, though it does not declare data used to track users across other companies' apps/sites. In December 2022 the FTC announced Epic would pay $275 million for violating COPPA and $245 million to refund consumers deceived by dark-pattern billing -- a combined $520 million, among the largest privacy and consumer-protection settlements in FTC history -- after which Epic committed to child/teen privacy defaults including voice and text communications off by default. No confirmed data breach was found in fetched sources.
TRACK RECORD
1 BREACH · 1 ENFORCEMENT ACTION
BREACH LEDGER
[2016-08-11] · BREACH
Have I Been Pwned lists a breach record for Epic Games: "Epic Games".
Approximately 251,661 accounts affected, per HIBP.
The FTC's December 19, 2022 press release states the FTC secured agreements requiring Epic Games to pay a total of $520 million: a $275 million monetary penalty for violating the COPPA Rule ('the largest penalty ever obtained for violating an FTC rule'), plus a separate $245 million in refunds to consumers over 'dark patterns' that tricked players, including children, into making unintended in-game purchases via Fortnite's billing interface.
As assessed by PrivacySpy on 2023-07-31 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes, but for critical data only.
Epic's Privacy Policy (last updated April 22, 2026) lists audio/visual information such as voice chat or images, and geolocation data derived from IP address or payment information, among the categories of personal information it collects; the same policy states that when a user indicates they are a child, they are placed in a 'Cabined Account' with voice chat and real-money purchases disabled until a parent/guardian provides additional privacy permissions -- a design constraint tied to COPPA compliance following Epic's 2022 FTC settlement.
A PC Gamer retrospective on Tencent's game-industry investments states Tencent's $330 million investment in Epic Games in June 2012 'triggered one of the most dramatic shifts in PC gaming of the last decade, ushering in a new era of free-to-play games as a service,' and identifies the resulting stake (per Tencent's own financial disclosures) at roughly 40%.
As assessed by PrivacySpy on 2023-07-31 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Epic's Privacy Policy states 'Epic Games, Inc. is headquartered in Cary, North Carolina,' with subsidiaries and operations located around the world, but the policy does not disclose a shareholder or ownership structure -- consistent with Epic's status as a privately held company with no SEC filing obligation.
As assessed by PrivacySpy on 2023-07-31 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.
Epic's Privacy Policy lists categories of third parties it discloses personal information to, including 'marketing and advertising partners,' 'large language model providers to enable AI-powered features,' payment processors, and publishers of games sold through the Epic Games Store; the same policy states elsewhere that 'Epic also does not sell or share the personal information it collects,' framed against the CCPA's technical sale/share definitions.
Have I Been Pwned's breach catalog lists the "Epic Games" incident (epicgames.com), breach date 2016-08-11, affecting approximately 251,661 accounts. Data classes exposed per HIBP: Email addresses, Passwords, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
The FTC's December 19, 2022 press release states the FTC secured agreements requiring Epic Games to pay a total of $520 million: a $275 million monetary penalty for violating the COPPA Rule ('the largest penalty ever obtained for violating an FTC rule'), plus a separate $245 million in refunds to consumers over 'dark patterns' that tricked players, including children, into making unintended in-game purchases via Fortnite's billing interface.
Fortnite's iOS App Store privacy label (self-declared by seller Epic Games Sweden AB) states data 'linked to your identity' includes Financial Info (Payment Info), Location (Coarse Location), Contact Info (Email Address), User Content (Audio Data, Gameplay Content), Identifiers (User ID, Device ID), Usage Data (Product Interaction), and Diagnostics (Crash Data); no 'Data Used to Track You' category is declared on the label.
The Privacy Policy states the Epic Services 'use technologies such as cookies, log files, and web beacons to automatically collect the types of information listed above,' and that some of these technologies create small files or record-keeping tools stored on the user's device to recognize the device and collect information.