FTC: Cognosphere (Genshin Impact), loot boxes and COPPA privacy case

Decision

Regulator

FTFederal Trade Commission

acted against

Against

Cognosphere, LLC (HoYoverse)

The FTC alleged the Genshin Impact developer violated COPPA and deceived players about the odds and real cost of loot box prizes.

Related cases

PrivacySettledApr 19, 2027 · in 5moUUnited States sued v. Cerebral (health data for ads)The FTC alleged the telehealth firm shared sensitive health data with third parties for advertising, failed to secure it and made cancellation difficult.$7 millionJury trialS.D. Fla.filed Apr 2024PrivacyActiveUnverifiedfiled Sep 2026Irish Data Protection Commission: GoogleThe Irish Data Protection Commission fines Google 403 000 000 EUR following Inquiry into Google’s processing of location dataIrish DPCPrivacyActivefiled Aug 2026IIsbell sued v. SunoRecording artists including Jason Isbell and David Lowery allege Suno's generator reproduces their voices, names and likenesses without consent, pleading BIPA and state right-of-publicity claims.D. Mass.PrivacyDecidedfiled Aug 2026Dutch DPA fine: Uber, automated driver deactivationThe Dutch DPA, working with the CNIL on a French drivers' complaint, found Uber used fully automated decisions to temporarily or permanently deactivate drivers over suspected fraud or low ratings and did not properly inform them.EUR 824,990,000Dutch Data Protection Authority (Autoriteit Persoonsgegevens)PrivacyActivefiled May 2026TTexas AG acted against v. Meta and WhatsApp: encryption claimsTexas sued Meta and WhatsApp alleging they misled users about end-to-end encryption and the privacy of WhatsApp messages.Texas Attorney GeneralPrivacyActivefiled May 2026FFlowers sued v. MicrosoftAlleges Microsoft's Copilot and other voice products captured users' biometric voiceprints without BIPA consent.N.D. Ill.PrivacyActivefiled May 2026AAmer sued v. ElevenLabsIllinois plaintiffs allege ElevenLabs captured biometric voiceprints from real voices to build its voice AI without BIPA consent.N.D. Ill.PrivacyDecidedfiled May 2026Dutch DPA fine: Yango (MLU B.V.), transfers to RussiaJoint investigation with the Norwegian and Finnish authorities found the company behind the European Yango taxi app transferred driver and customer data to Russia without adequate protection.EUR 100 millionDutch Data Protection Authority (Autoriteit Persoonsgegevens)