Minecraft

Is Minecraft safe for kids?

Minecraft is one of the safer big games a child can play, as long as a parent decides when multiplayer is switched on. Played alone, it is a building game with cartoon monsters, no blood and no loot boxes. Online, it can be as open as the internet: thousands of public servers are run by companies, clubs and individuals, each with its own rules, and children meet adult strangers there in chat.

We score Minecraft 69/100, well above Roblox (55) and Fortnite (57). Its data collection is light and its child accounts start from closed. Its weak spot is that the riskiest part of the game happens on servers Mojang does not run.

What data Minecraft collects

Apple's privacy label for Minecraft is short. The only data listed as used to track you across other companies' apps is purchases. Purchase history, user and device IDs, product interaction and performance data are linked to your account, mostly for analytics, personalisation and Mojang's own marketing. Crash data is collected without being linked. There are no ads in the game.

The game is not free: it costs $6.99 on the US App Store, which is one reason it does not need ads or aggressive tracking. Play does need a Microsoft account (Java Edition, Bedrock and Minecraft Realms all require one), so your child's data sits under Microsoft's general privacy statement, which covers many products and is far longer than the label.

Child accounts and what parents control

Microsoft treats anyone under 16 in the US and EU, and under 19 in South Korea, as a child. A child account cannot exist without an adult Microsoft account linked to it, and only the adult can change its settings. According to Mojang's parental controls guide, the settings live at account.xbox.com and cover:

• whether the child can join multiplayer games, clubs and private servers
• whether the child can add friends
• who can contact them with voice, text or invites: everyone, friends or nobody

Spending and screen time are handled through the same Microsoft family group or the phone's own controls. Mojang says it does not provide parental controls for versions older than 1.16.4 or for modded games, so keep the game updated and be careful with modded copies.

The real risk: servers you do not control

Most of the risk comes from multiplayer. Minecraft Realms, Mojang's own paid private servers, are open only to invited players. Public servers are different: anyone can run one, and many host hundreds or thousands of players, with chat and private messages. Moderation depends on the server's own staff.

Mojang added a player reporting tool to Java Edition in version 1.19.1 in 2022. Players can select abusive chat messages and send them, with surrounding context, to Mojang's moderators, and the tool works on private servers too. Mojang's community standards ban bullying, harassment and sexual solicitation, and it runs a "Report a concern" form. These are reporting tools, though, and they rely on a child noticing and pressing the button.

The second risk is mods. Java Edition players often download mods and modded launchers from outside sites, which Mojang does not check. Fake mods and "free Minecoins" offers are a common way to steal accounts or install malware.

Security and the regulatory record

Minecraft accounts are Microsoft accounts, so two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary is available, and we found no breach of Mojang's own account systems in the last ten years. The biggest security event was Log4j in December 2021: a flaw in a common Java logging library affected Minecraft: Java Edition, and Mojang told players and server owners to update to 1.18.1 or apply a fix. Microsoft's Xbox bug bounty pays up to $20,000 for the Xbox network but excludes its game studios, and Minecraft is not listed in it.

We found no fine or order that names Minecraft. In June 2023 Microsoft agreed to pay $20 million to settle FTC charges that it collected children's data when they signed up for Xbox without parental consent, and kept some of it for years. Minecraft uses those Xbox accounts, and the order requires Microsoft to tell game publishers when a user is a child, but the complaint never mentions Minecraft. Under our rules a parent-company case that does not name the app is context, not a deduction.

The EU case is different because it names the game. On 30 September 2026 the EU's Consumer Protection Cooperation network opened coordinated actions against nine game companies, including Mojang AB, after a market check flagged Minecraft for further assessment. The authorities are examining how virtual currencies such as Minecoins are sold, whether real-money prices are clear, whether players are pushed to buy more currency than they need, the 14-day right of withdrawal and safeguards for children. An opened action is not a finding and Mojang has not been fined, so we start from 85, as for any app with no finished regulator review, and take three points off, as we do for Candy Crush. We will update the page when the authorities report.

How to set Minecraft up for a child

1. Create the child's Microsoft account from your own adult account so it joins your family group.
2. At account.xbox.com, leave "join multiplayer games" blocked at first. Allow it later for a Minecraft Realm shared with friends you know.
3. Set "Others can communicate with voice, text, or invites" to Friends, not Everyone.
4. Turn on purchase approval in the family group or on the phone, so Minecoins and server subscriptions need your OK.
5. If your child plays on public servers, pick well-known ones with visible rules, and show them how to hide and report players from the pause menu.
6. Download mods only from sources you trust, never from links in chat or videos.

How we scored it

Regulatory record (82) is Minecraft's strongest factor: no fine or order names the game, with three points off for the EU consumer action opened in 2026. Transparency and control (74) reflects child accounts that start closed and settings parents can manage. Privacy (70) benefits from a short label and no ads. Scams and harmful content (60) is the weakest, because public servers put children in chat with strangers under rules Mojang does not set.