Roblox Privacy and Cookie Policy

Data Access & Collection · Company practice

An under-13 account needs a username, password and birth date; gender is optional

The policy says that when a user under 13 creates an account, Roblox asks for a username, password and date of birth (all required) and a gender (optional). The stated uses are: the username to create the account and run the Service, and not to identify the user outside Roblox; the password to log in; the date of birth to give the account default settings intended for the age; and gender to customize the experience. The policy calls this "non-personal information, as defined by COPPA", without explaining that term in this passage.

Supporting quotations

If you’re under 13 years old and create an account, we ask for some information (which is non-personal information, as defined by COPPA) to let you use Roblox.

We’ll collect:

your username (required). We need this to create your account and run the Roblox Service. We don’t use your username to identify you outside of Roblox

your password (required). We need this to log you in to your account and to run the Roblox Service

your date of birth (required). We’ll use this information to make sure your account has certain default settings intended for your age

your gender (optional). We will use this information to customize your experience

Qualifications & exceptions

• Applies when a user under 13 creates an account.
• Username, password and date of birth are required; gender is optional.
• The "non-personal information" label is Roblox's statement and is tied to COPPA.

Not stated here

• What COPPA's definition covers is not explained in this source.
• How this label fits with the policy's own definition of Personal Information is not explained.

Data Access & Collection · Company practice

A parent's email address is optional for a child account, but Roblox may use it to log in and to contact the parent

The policy says a child can provide a parent's or guardian's email address in account settings or at logout, for additional account security and parental controls. Children are encouraged, but not required, to provide it. Roblox says parent email addresses are collected for the security and integrity of the account and the platform, that it may use the address to log the child in, and that it may use it to communicate with the parent about the account, such as asking them to review it.

Supporting quotations

you have the option to provide a parent’s or guardian’s email address in account settings or during logout

Children are encouraged to provide a parent’s email address, but are not required to do so to create an account.

Parent email addresses are collected for the security and integrity of your account and the Roblox platform.

We may use your parent’s email address to log you in. We may also use your parent’s email address to communicate with them about your account, like asking them to review your account.

Qualifications & exceptions

• Providing a parent email is optional.
• Roblox says it "may" use the address for login and to communicate with the parent.

Not stated here

• How often Roblox contacts the parent is not stated.

Data Access & Collection · Company practice

Roblox collects persistent identifiers from children for six internal operations, including contextual ads

The policy says that when children sign up, Roblox also collects persistent identifiers such as IP address and unique device identifiers, which can recognize the child, the device or a household device. It says Roblox collects these and the information requested at sign-up for six internal operations: maintaining or analyzing how Roblox functions, network communications, authenticating users or personalizing content, serving contextual advertising including frequency capping, protecting security or integrity, and legal or regulatory compliance. Roblox says it implements technical, contractual and other measures so the identifiers are not used for other purposes.

Supporting quotations

When children sign up for Roblox, we also collect certain types of personal information called persistent identifiers for internal operations and to provide you and other users with Services.

Persistent identifiers are data like IP Address and unique device identifiers

Persistent identifiers can be used to recognize you, your device, or your household device.

Maintaining or analyzing the functioning of Roblox;

Performing network communications;

Authenticating users of, or personalizing the content on, Roblox;

Serving contextual advertising, including capping the frequency of ads;

Protecting the security or integrity of Roblox;

Ensuring legal or regulatory compliance.

Roblox implements technical, contractual, and other measures to ensure that persistent identifiers are not used for purposes other than those listed above.

Qualifications & exceptions

• Applies when children sign up for Roblox.
• Use is limited to the six listed internal operations.
• The policy lists "contextual advertising" among them, which is separate from the personalized advertising disabled for under-13s.

Not stated here

• The specific technical and contractual measures are not described.

Data Access & Collection · Company practice

To assess age Roblox may collect images such as a selfie, deleted when the age check ends

The policy says Roblox may collect information about you, including images such as a selfie, to perform age assurance. It says information collected to assess ages, such as images taken for facial age estimation, is deleted once the age assurance process is complete. For more it points to the Roblox Facial Media Capture Policy, a linked document.

Supporting quotations

Age Assurance

To assess user ages, Roblox may collect information about you, including images such as a selfie, to perform age assurance.

Information collected to assess user ages, such as images taken to perform facial age estimation, is deleted once the age assurance process is complete.

Qualifications & exceptions

• Roblox "may" collect the information; it does not say when age assurance is required.
• Deletion is stated to happen once the age assurance process is complete.

Not stated here

• The Facial Media Capture Policy is linked but its text is not supplied here, so the card cannot say what it provides.
• The source does not say when the process is complete or what results of the check Roblox keeps.

Data Access & Collection · Company practice

Sign-up asks for username, password, birthday, optional gender; eligible users may put certain data in display names

The policy says that to join, a user sets up an account with a unique username and password, and is also asked for a birthday and gender (gender is optional) so Roblox can customize the experience. It adds that eligible users may set their account's display name to contain certain Personal Information. It says Roblox does not use the username to identify the user outside their activity on Roblox. It gives three signing-up rules: do not use your own name or other Personal Information in your username, do not pick an easy-to-guess password, and you may share your password with a parent or guardian but not with others.

Supporting quotations

Setting up a Roblox account

We’ll ask you to create a unique username and password so you can log into your account and access features on Roblox. We also ask you for your birthday and gender (gender is optional) so we can customize your experience on Roblox.

Eligible users may set their account's display name to contain certain Personal Information.

Three key rules for signing up:

Do not use your own name or other Personal Information in your username.

Do not pick a password that’s easy to guess.

You may share your password with your parent or guardian, but do not share it with others.

We don’t use your username to identify you outside of your activity on Roblox.

Qualifications & exceptions

• "Eligible users" may put certain Personal Information in the display name; who is eligible and what is permitted is not stated here.
• Gender is optional.
• The three rules are directions to the user.

Not stated here

• Which users are "eligible" and which Personal Information a display name may contain are not stated.

Data Access & Collection · Company practice

Roblox asks for an email address mainly for security; a hash is saved if a 13+ account changes its birthday to under 13

The policy says that once you have an account you can add an email address (a parent's or guardian's if you are under 13) in case you need to reset your password. Roblox may ask for your email to verify your identity or enable additional features, and says its main reason is security, to check that accounts are authentic. You can change the email address at any time, and if it is changed Roblox sends a notification email to the previous address. If a 13+ account changes its birthday to indicate an age under 13, Roblox saves a hash of that email address and any email addresses previously collected from the user; it says the hash cannot be reconstructed into the address or used to contact the user and will only be used to authenticate the user in the future.

Supporting quotations

Why we ask you for an email address:

Once you have an account, you can add your email address (or your parents’ or guardians’ email address if you are under 13) in case you need to reset your password.

We might ask for your email to verify your identity or enable additional features. The main reason we need an email address is for security because it is how we check to make sure accounts are authentic.

You can change your email address anytime you want – if an email address is changed, we’ll send a notification email to the address that you used before.

If you have a 13+ account and change your birthday to indicate you are under age 13, Roblox will save a hash of your email address and any email addresses previously collected from you. This hash cannot be reconstructed back into your email address or used to contact you, and will only be used to authenticate you in the future.

Qualifications & exceptions

• For users under 13 the address is a parent's or guardian's.
• The hash rule applies where a 13+ account changes its birthday to indicate under 13.
• Roblox says it "might" ask for email to verify identity or enable additional features.

Not stated here

• Which additional features may require an email address are not listed.

Data Access & Collection · Company practice

A phone number you give is texted to confirm, used for security and access; you authorize your carrier to share data

The policy says that if you choose to give a phone number, Roblox sends a text message asking you to confirm it before you can log in, and uses the number for security and account access, including to recover a lost or forgotten password, access a feature, or log in via mobile. It also says you authorize your wireless carrier to use or disclose information about your account and your wireless device, if available, to Roblox or its service provider for the duration of your business relationship, solely to help them identify you or your device and to prevent fraud.

Supporting quotations

Sharing your phone number

If you choose to give a phone number, we’ll send you a text message asking you to confirm your number before you can log in.

We will use your phone number for security and account access, including to recover a lost or forgotten password, access a feature, or log in via mobile.

You authorize your wireless carrier to use or disclose information about your account and your wireless device, if available, to Roblox or its service provider for the duration of your business relationship, solely to help them identify you or your wireless device and to prevent fraud.

Qualifications & exceptions

• Providing a phone number is a choice.
• The carrier authorization is limited to identifying you or your device and preventing fraud, for the duration of your business relationship.

Not stated here

• What information a carrier holds and may disclose is not described in this passage.

Data Access & Collection · Company practice

Contacting support collects your email (a parent's if under 13) and username; records are kept for a limited time

The policy says that when you contact customer support, report a problem, ask for technical support or ask questions or give comments, Roblox collects your email address (or a parent's or guardian's if you are under 13), your username and any other details you give. It uses this to answer questions and give the support asked for; for users under 13 it communicates with the parent or guardian when sending responses. It retains records of technical support questions for a limited time for internal use only, such as answering additional questions about your account.

Supporting quotations

We collect your email address (or your parents’ or guardians’ email address if you are under 13), username, and any other details you give when you:

contact customer support

report a problem

ask for technical support

ask us questions or give us comments

We use this information to answer your questions and to give you the support or help you ask for. For users under 13, we communicate with your parent or guardian when sending our responses.

We retain records of technical support questions for a limited time for internal use only, such as to answer additional questions about your account.

Qualifications & exceptions

• For users under 13, responses go to the parent or guardian.
• Records are retained for a "limited time" and used internally only.

Not stated here

• The length of the limited retention time is not stated.

Data Access & Collection · User right or choice

Users 13 and older who agree may have their geolocation collected and tracked, using a device or browser identifier

For location-based Services, available to users 13 or older, the policy says that if you agree Roblox may collect and track geolocation information so it can offer Services that depend on knowing where you are. It says this is done using an identifier on your device or browser so Roblox can recognize you each time you return. To stop location collection you can update your device settings, stop using the Service, or uninstall the mobile apps.

Supporting quotations

Location-based Services (users 13 and older)

You can choose to use location-based Services if you’re 13 or older. If you agree, we may collect and track geolocation information so that we can offer Services that depend on us knowing where you are.

We collect this information by using an identifier on your device or browser so that we can recognize you each time you return.

To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.

Qualifications & exceptions

• Applies to users 13 and older.
• Collection depends on your agreement.
• The ways to stop collection are device settings, stopping use of the Service, or uninstalling the apps.

Not stated here

• Which Services depend on location is not listed in this passage.

Data Access & Collection · Company commitment

On a VR platform Roblox collects your physical movement information and says it does not store it

The policy says that if you join its experiences on a VR platform, Roblox collects your physical movement information so it can use it in the experience. It says the information is only used to provide the experience and that Roblox does not store it.

Supporting quotations

Joining on a VR platform

If you join our experiences on a VR platform, we collect your physical movement information so that we can use it in the experience. This information is only used to provide the experience.We do not store this information.

Qualifications & exceptions

• Applies when you join experiences on a VR platform.
• Use is stated to be only to provide the experience; no storage.

Not stated here

• Whether the VR platform provider keeps this information is not addressed.

Data Access & Collection · Company practice

Camera features and uploads (13+) are collected, processed and stored, including for safety checks

For users 13 and older, the policy says that if you use features that require your camera or let you upload content containing your Personal Information, including photos, Roblox will collect, process and store that content to accomplish the purpose of the feature, including processing the content for safety purposes. It says video used to generate animation key frames is processed on your device and is not shared with Roblox or any third parties. It refers to a Roblox Facial Animation Privacy Notice and a Roblox Facial Media Capture Privacy Notice for more, including ID Verification.

Supporting quotations

Camera-enabled features and uploads (users 13 and older)

we will collect, process, and store that content to accomplish the purpose of the feature, including processing the content for safety purposes

Video used to generate animation key frames is processed on your device and is not shared with Roblox or any third parties.

For information about how Roblox uses ID Verification, please refer to the Roblox Facial Media Capture Privacy Notice

Qualifications & exceptions

• Applies to users 13 and older.
• Storage is to accomplish the purpose of the feature, including safety processing.
• Animation key-frame video is processed on the device and not shared with Roblox or third parties.

Not stated here

• The two linked privacy notices are not supplied here, so the card cannot say what they provide, including for ID Verification.
• How long the content is stored is not stated in this passage.

Data Access & Collection · Company practice

If you opt in to Contact Importer, Roblox collects your contacts' names and phone numbers and keeps only matches

For users 13 and older, the policy says that if you opt in to the Contact Importer feature you share the first and last names and phone numbers of the contacts in your mobile phone address book with Roblox, to help connect with friends. If you use it, Roblox automatically accesses and collects address book information from time to time to sync contacts. It says such information is only retained in case of matches with existing Roblox users, and that the feature is only available to users 13 or older and may not be available in certain locations.

Supporting quotations

Contact Importer (users 13 and older)

If you opt-in to the Contact Importer feature, you will share the first and last names and phone numbers of your contacts in your address book on your mobile phone with Roblox.

we will automatically access and collect information in your address book from time to time in order to sync your contacts. Such information will only be retained in case of matches with existing Roblox users.

Our Contact Importer feature is only available if you are 13 or older and may not be available in certain locations.

Qualifications & exceptions

• Opt-in.
• Applies to users 13 and older and may not be available in certain locations.
• Address book information is retained only where it matches existing Roblox users.

Not stated here

• What happens to non-matching information beyond "not retained" is not described; the passage says collection recurs "from time to time".
• Which locations lack the feature is not stated.

Data Access & Collection · Company commitment

For other features for users 13 and older, Roblox says it will set out what is collected when it collects it

The policy says that when you subscribe to other features or activities available to users 13 or older, Roblox will set out what information is collected and how it intends to use it at the time the information is collected. The policy itself does not list those features.

Supporting quotations

Subscribing to other features (users 13 and older)

we’ll set out what information is collected and how we intend to use it when the information is collected

Qualifications & exceptions

• Applies to features or activities available to users 13 or older.
• The details are given when the information is collected, not in this policy.

Not stated here

• Which features this covers and what they collect are not stated in this policy.

Data Access & Collection · Company practice

Research or surveys you join may collect your interests, habits and lifestyle information

The policy says that if you choose to participate in research or surveys, these may collect information about your likes and dislikes, experience interests and habits, general hobbies and interests, and other lifestyle information or preferences, and may ask for Personal Information.

Supporting quotations

Taking part in research

If you choose to participate in research or surveys, these surveys may collect information about your likes and dislikes, experience interests and habits, general hobbies and interests, and other lifestyle information or preferences. These surveys may ask for Personal Information.

Qualifications & exceptions

• Participation is your choice.
• The examples of information are not stated to be complete.

Not stated here

• Who runs the surveys and how the answers are used are not stated in this passage.

Data Access & Collection · Context

The policy explains cookies, pixel tags, session and persistent cookies, and first- and third-party cookies

Roblox says it uses cookies and other standard internet technologies, like most websites, to make its services better. It explains a cookie as a text file put on your computer or device when you visit a website that lets the site remember what you do and your settings, such as login information, language and font size. Session cookies are deleted when you close the browser; persistent cookies stay on the device for a defined period. A cookie set by the owner of the web server you visit is a first-party cookie, and one set by owners of other domains is a third-party cookie. A pixel tag or web beacon is a piece of code that tells its owner what you do on a web page, such as which pages you visited or which ads you clicked.

Supporting quotations

Cookies and similar technologies

Like most websites, we use cookies and other standard internet technologies to help us make our services better.

A cookie is a text file that’s put on your computer or device when you visit a website. It lets the website remember what you do and any settings you choose

Session cookies are deleted each time you close the browser

Persistent cookies stay on the device for a defined period of time.

A cookie set by the owner of the web server you are visiting is called a first-party cookie and cookies set by owners of other domains are called third-party cookies.

A pixel tag or web beacon is a piece of code that tells its owner what you do on a web page. Pixel tags provide information like which web pages you visited or which ads you clicked on.

Qualifications & exceptions

• Descriptive explanation of the technologies, not a statement of which are used.

Not stated here

• The "defined period" for persistent cookies is not given in this passage.

Data Access & Collection · Company practice

Roblox collects device and software information, including IP address and device identifiers

The policy says Roblox collects information about the devices and software you use, for example the type of browser or device, the website or source that referred you, your IP address, device ID or other identifier that identifies your computer or mobile device (it says this cookie is not deleted when you close your browser), and the operating system of your computer or device.

Supporting quotations

We collect information about the devices and software you use, for example:

the type of browser or device

the website or source that linked or referred you to our services

your IP address, device ID or other identifier that identifies your computer or mobile device – this cookie is not deleted when you close your browser

the operating system of your computer or device

Qualifications & exceptions

• The list is introduced by "for example", so it is not stated to be complete.
• The IP address and identifier cookie is stated not to be deleted when you close the browser.

Not stated here

• How long the identifier cookie lasts is not stated.

Data Access & Collection · Company practice

These technologies let Roblox remember settings, measure use, spot fraud and collect demographic information

The policy says these technologies allow Roblox to: record and keep your preferences, account settings and certain login information (for convenience and security); collect information about how you use the Services, such as how or where you downloaded the app; collect information on how software is used on your mobile device; collect information about what features you use and how well its services work; identify suspicious activities so it can try to protect users from payment fraud and other inappropriate activities; collect demographic information (the policy gives age and location as examples); and perform similar functions.

Supporting quotations

These technologies allow us to:

record and keep your preferences, account settings, and certain login information (for your convenience, e.g. to prevent you from needing to choose settings every time you visit, and security)

collect information about how you use the Services, for example, how you downloaded our app or where you downloaded it from

collect information on how software is used on your mobile device

collect information about what features you use and how well our services work

identify any suspicious activities so we can try to protect users from payment fraud and other inappropriate activities

collect demographic information (eg, age, location, etc)

perform similar functions.

Qualifications & exceptions

• The list ends with "perform similar functions", so it is not stated to be complete.
• Demographic information is given with the examples age and location.

Not stated here

• What "similar functions" covers is not stated.

Data Access & Collection · Company practice

Job inquiries may give Roblox your name, email and employment details, and immersive career spaces may be recorded

The policy says that if you contact Roblox about job opportunities it may ask for your name, email address and employment details, or you may send a CV or job application with this information. Roblox says it has the right to use this information to send corporate-related information or respond to the application. If you engage with Roblox in an immersive space for prospective employees, such as the Roblox Career Center, the space may be recorded in order to provide the experience.

Supporting quotations

If you contact us about job opportunities, we may ask for your name, email address and employment details.

We have the right to use this information to send you corporate-related information to you or respond to your job application.

such a space may be recorded in order to provide the experience

Qualifications & exceptions

• Applies to people who contact Roblox about job opportunities.
• Recording applies to immersive spaces for prospective employees and is stated "may".

Not stated here

• How long job application information is kept is not stated in this passage.

Data Access & Collection · Company practice

EEA/UK/Swiss list: location tracking for users 13+ rests on contract; personalized ads and content are examples

In the list for the EEA, UK and Switzerland, the policy says that when you request or agree to location-based services (users 13 and older), Roblox may collect and track geolocation information to offer services that depend on knowing where you are, with examples of personalizing content or personalized advertising for users 18 and older. It collects this using an identifier on your device or browser so it can recognize you when you return. To stop collection you can update device settings, stop using the service, or uninstall the mobile apps. The stated basis is Article 6 sec. 1 sent. 1 lit. b ("performance of a contract").

Supporting quotations

When you request or agree to location-based services (users 13 years old and older), we may collect and track geolocation information so that we can offer services that depend on us knowing where you are. Examples are personalizing content or personalized advertising for users 18 years old and older.

We collect this information by using an identifier on your device or browser so that we can recognize you each time you return. To stop us collecting your location information, you can update your device settings, stop using the service, or uninstall our mobile apps.

The basis for processing this Personal Information is Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”).

Qualifications & exceptions

• Applies when you request or agree to location-based services; users 13 and older.
• Personalized advertising is given as an example for users 18 and older.

Not stated here

• The passage does not say how an EEA, UK or Swiss user's consent is recorded for location services.

Data Access & Collection · Company commitment

EEA/UK/Swiss list: VR movement information is collected to replicate your movement, not stored, on a contract basis

The list says that if you join experiences on a VR platform, Roblox collects your physical movement information in order to replicate your movement in the experience. It says the information is only used to provide the Service and is not stored. The basis is Article 6 sec. 1 sent. 1 lit. b ("performance of a contract").

Supporting quotations

If you join our experiences on a VR platform, we will collect your physical movement information in order to replicate your movement in the experience. This information is only used to provide the Service and is not stored.

Qualifications & exceptions

• Applies when you join experiences on a VR platform.
• Use is stated to be only to provide the Service; no storage.

Not stated here

• Whether the VR platform provider keeps this information is not addressed.

Data Access & Collection · Company practice

EEA/UK/Swiss list: camera and upload content is kept only as long as needed; ID verification rests on consent

The list says that for features that require your camera or let you upload content containing your Personal Information, including photos or video, Roblox will collect, process and store that content only for as long as needed to accomplish the purpose of the feature, on the basis Article 6 sec. 1 sent. 1 lit. b ("performance of a contract"). For certain uploads, such as ID verification, it says it processes the data you upload on the basis of consent, Article 6 sec. 1 sent. 1 lit. a or Article 9 sec. 2 lit. a ("consent"). It refers to a Roblox Facial Animation Privacy Notice and a Roblox Facial Media Capture Privacy Notice.

Supporting quotations

we will collect, process, and store that content only for as long as needed to accomplish the purpose of the feature

For certain uploads, such as ID verification, Roblox processes data you upload on the basis of consent, Article 6 sec. 1 sent. 1 lit. a or Article 9 sec. 2 lit. a (“consent”).

Qualifications & exceptions

• Content is kept only for as long as needed for the feature's purpose.
• ID verification and similar certain uploads rest on consent.

Not stated here

• The two privacy notices are linked but their text is not supplied here.
• Which uploads other than ID verification count as "certain uploads" is not listed.

Data Access & Collection · Company commitment

EEA/UK/Swiss list: other features for users who are not children will show what is collected at the time of collection

The list says information required for other features or activities, which may be available to users other than children, may be offered from time to time, and you may be able to submit or upload Personal Information with them. It says the data collected and its intended uses will be evident at the time of data collection, on the basis Article 6 sec. 1 sent. 1 lit. b ("performance of a contract").

Supporting quotations

Information required for other features or activities, which may be available to our users other than children. We may offer other features or activities on our Services from time to time, and you may be able to submit or upload Personal Information in connection with such features. The data being collected for such features and their intended uses will be evident at the time of data collection.

Qualifications & exceptions

• Applies to features or activities available to users other than children.

Not stated here

• The features and the data they collect are not listed in the policy.

Data Access & Collection · Company practice

EEA/UK/Swiss list: Contact Importer shares your contacts' names and numbers with Roblox, on a contract basis

The list says that if you opt in to the Contact Importer feature you consent to sharing with Roblox the first and last names and phone numbers of the contacts in your address book on your mobile phone, either when you register for the Service or otherwise, to help you connect with friends. The stated legal basis is Article 6 sec. 1 sent. 1 lit. b GDPR ("performance of a contract").

Supporting quotations

If you opt-in to the Contact Importer feature, you consent to sharing with Roblox the first and last names and phone numbers of your contacts in your address book on your mobile phone, either at the time you register for our Service or otherwise. We do so to help you connect with your friends on our Service.

Qualifications & exceptions

• Opt-in.
• Sharing may happen at registration or at another time.

Not stated here

• This passage does not repeat the age limit or retention statement given in the general Contact Importer description.

Data Access & Collection · Company practice

EEA/UK/Swiss list: voluntary research and surveys rest on consent

The list says that when you respond to or take part in voluntary research, surveys or studies, these may collect information about your likes and dislikes, experience interests and habits, general hobbies and interests, and other lifestyle information or preferences, and may ask for Personal Information. The stated legal basis is Article 6 sec. 1 sent. 1 lit. a GDPR ("consent").

Supporting quotations

Competitions, promotions, and research

When you respond to or participate in voluntary research or surveys or studies. These surveys may collect information about your likes and dislikes, experience interests and habits, general hobbies and interests, and other lifestyle information or preferences. These surveys may ask for Personal Information. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. a GDPR (“consent”).

Qualifications & exceptions

• Applies to voluntary research, surveys or studies.
• The basis is consent.

Not stated here

• Who runs the research is not stated in this passage.

Data Access & Collection · Company practice

EEA/UK/Swiss list: contest and promotion contact details are processed for prize fulfillment on a contract basis

The list says that for contests, competitions, sweepstakes, giveaways, prize draws or other promotions it runs or sponsors, Roblox may process certain contact information (such as your name, email address and/or phone number) for prize fulfillment, as well as other information or content needed for the specific promotion. The stated legal basis is Article 6 sec. 1 sent. 1 lit. b GDPR ("performance of a contract").

Supporting quotations

We may process certain contact information (such as your name, email address, and/or phone number) for prize fulfillment purposes, as well as other information or content needed for the specific promotion.

Qualifications & exceptions

• Applies to promotions Roblox runs on its Service or sponsors.
• Contact details are listed "such as".

Not stated here

• The passage does not mention sharing with gift card providers or publishing winners, which the general description covers.

Data Access & Collection · Company practice

EEA/UK/Swiss list: job application data is processed to respond to the application; career spaces may be recorded

The list says information relating to a job application, like your name, email address, employment details, CV, resume or other employment history details, is processed to process and respond to the application. If you engage with Roblox in an immersive space for prospective employees, such as the Roblox Career Center, the space may be recorded to provide the experience. The stated legal basis is Article 6 sec. 1 sent. 1 lit. b GDPR ("necessary for entering into an employment contract with us").

Supporting quotations

On our corporate websites or in job applications

Information relating to a job application made by you, like your name, email address, employment details, CV, resume or other details of your employment history sent by you. We will process this information to process and respond to your job application.

such a space may be recorded in order to provide the experience

Qualifications & exceptions

• Applies to people who apply for jobs.
• Recording applies to immersive spaces for prospective employees and is stated "may".

Not stated here

• How long job application information is kept is not stated in this passage.

Data Access & Collection · Company practice

EEA/UK/Swiss list: child account data gives access and contacts the parent; birth date sets features

The list says that when a child creates an account Roblox may process a username, password, birthdate and gender (gender is optional), and that separately users may optionally provide a parent email address. It processes this information to give the user access to the Service and to communicate with the parent about the child's account, for example by emailing a notification and an invitation for the parent to review the account and update settings. It may use the birthdate to decide which features the child should have access to and to determine when the child turns 13 and can be given broader access. The stated basis is Article 6 sec. 1 sent. 1 lit. b GDPR ("performance of a contract").

Supporting quotations

When a child creates an account on Roblox, we may process a username, password, birthdate, and gender (gender is optional). Separate from account creation, users may optionally provide a parent email address.

We process this information to give the user access to the Service and to communicate with the parent about the child’s account (if a parent email was provided).

We may use the birthdate the child provides when signing up for the Service to determine which features on Roblox the child should have access to and to determine when the child will turn 13 years old and can be given broader access to features on our Service. This processing activity is based on Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”).

Qualifications & exceptions

• Applies when a child under 13 creates an account.
• Gender and the parent email address are optional.
• Parent communication applies only if a parent email was provided.

Not stated here

• Which features are tied to the birthdate is not listed.

Data Access & Collection · Company practice

Brazil list: username, password and verification email are processed to set up and secure your account

The list for Brazil says Roblox processes a username and password to create your account, and email addresses and other information you provided for added verification and/or to enable certain features. It states that Roblox has a legitimate interest in providing a safe and secure Service, especially to protect children. Unlike the EEA list, this passage does not cite Article 6 bases.

Supporting quotations

Setting up a Roblox account

Username and password to create your account.

Email addresses and other information you provided us with for added verification and/or to enable certain features. Roblox has a legitimate interest in providing a safe and secure Service, especially to protect children.

Qualifications & exceptions

• Applies to people living in Brazil.

Not stated here

• This passage names no legal basis other than Roblox's stated legitimate interest.

Data Access & Collection · Company practice

Brazil list: phone numbers are used for security and login; friend recommendations need explicit and informed consent

The list for Brazil says that if you choose to provide a phone number, Roblox uses it for security and account access, to log in via mobile and recover a lost or forgotten password. You authorize your wireless carrier to use or disclose information about your account and device to Roblox or its service provider for the duration of your business relationship, solely to help identify you or your device and to prevent fraud. Roblox states a legitimate interest in enabling mobile use, ensuring security and preventing fraud. With your explicit and informed consent it may use your phone number to recommend you as a friend to others on Roblox.

Supporting quotations

If you choose to provide a phone number, we will use the phone number for security and account access purposes, which will allow you to log in via mobile and recover a lost or forgotten password.

We have a legitimate interest in enabling you to use our Services via your mobile device, ensuring security, and preventing fraud.

Additionally, with your explicit and informed consent, we may use your phone number to recommend you as a friend to others using Roblox.

Qualifications & exceptions

• Providing a phone number is a choice.
• Friend recommendations require explicit and informed consent.
• Carrier authorization is limited to identifying you or your device and preventing fraud.

Not stated here

• Whether the Discoverability feature is unavailable in some locations is not stated in this passage.

Data Access & Collection · Company practice

Brazil list: customer service contact details are processed to respond and support you

The list for Brazil says Roblox processes information about contacting customer service, for example when you report a problem or submit questions, concerns or comments: your email address, your name and information about your inquiry, in order to respond, fulfill requests or provide other customer support.

Supporting quotations

Asking questions or getting technical support

We may process your email address, your name and information relating to your inquiry or concern in order to respond to your communications, fulfill your requests, or provide other customer support.

Qualifications & exceptions

• Applies to people living in Brazil.

Not stated here

• This passage does not say how long the records are kept.

Data Access & Collection · User right or choice

Brazil list: geolocation is collected for location services for users 13 and older, using a device or browser identifier

The list for Brazil says that when you request or agree to location-based services (users 13 and older), Roblox may collect and track geolocation information so it can offer services that depend on knowing where you are, with examples of personalizing content or personalized advertising for users 18 and older. It collects this using an identifier on your device or browser so it can recognize you when you return. To stop collection you can update device settings, stop using the service, or uninstall the mobile apps.

Supporting quotations

When you request or agree to location-based services (users 13 years old and older), we may collect and track geolocation information so that we can offer services that depend on us knowing where you are.

To stop us collecting your location information, you can update your device settings, stop using the service, or uninstall our mobile apps.

Qualifications & exceptions

• Applies when you request or agree to location-based services; users 13 and older.

Not stated here

• Which services depend on location is not listed.

Data Access & Collection · Company commitment

Brazil list: VR movement information is collected to replicate your movement and is not stored

The list for Brazil says that if you join experiences on a VR platform, Roblox collects your physical movement information in order to replicate your movement in the experience. It says the information is only used to provide the Service and is not stored.

Supporting quotations

If you join our experiences on a VR platform, we will collect your physical movement information in order to replicate your movement in the experience. This information is only used to provide the Service and is not stored.

Qualifications & exceptions

• Applies when you join experiences on a VR platform.

Not stated here

• Whether the VR platform provider keeps this information is not addressed.

Data Access & Collection · Company practice

Brazil list: camera and upload content is collected, processed and stored for the feature's purpose

The list for Brazil says that for features that require your camera or let you upload content containing your Personal Information, including photos or videos, Roblox will collect, process and store that content to accomplish the purpose of the feature. It refers to a Roblox Facial Animation Privacy Notice and a Roblox Facial Media Capture Privacy Notice for more.

Supporting quotations

If you decide to use these features and upload content, we will collect, process, and store that content to accomplish the purpose of the feature.

Qualifications & exceptions

• Applies to people living in Brazil.

Not stated here

• The two privacy notices are not supplied here.
• This passage does not state a storage time limit.

Data Access & Collection · Company commitment

Brazil list: other features for users who are not children will show what is collected at the time of collection

The list for Brazil says information required for other features or activities, which may be available to users other than children, may be offered from time to time, and you may be able to submit or upload Personal Information with them. It says the data collected and its intended uses will be evident at the time of data collection.

Supporting quotations

We may offer other features or activities on our Services from time to time, and you may be able to submit or upload Personal Information in connection with such features. The data being collected for such features and their intended uses will be evident at the time of data collection.

Qualifications & exceptions

• Applies to features or activities available to users other than children.

Not stated here

• The features and the data they collect are not listed.

Data Access & Collection · Company practice

Brazil list: Contact Importer shares your contacts' names and phone numbers with Roblox

The list for Brazil says that if you opt in to the Contact Importer feature you consent to sharing with Roblox the first and last names and phone numbers of the contacts in your address book on your mobile phone, either at registration or otherwise, to help you connect with friends.

Supporting quotations

If you opt-in to the Contact Importer feature, you consent to sharing with Roblox the first and last names and phone numbers of your contacts in your address book on your mobile phone, either at the time you register for our Service or otherwise. We do so to help you connect with your friends on our Service.

Qualifications & exceptions

• Opt-in.

Not stated here

• This passage does not repeat the age limit or retention statement from the general Contact Importer description.

Data Access & Collection · Company practice

Brazil list: voluntary research and surveys may collect interests, habits and lifestyle information

The list for Brazil says that when you respond to or take part in voluntary research, surveys or studies, these may collect information about your likes and dislikes, experience interests and habits, general hobbies and interests, and other lifestyle information or preferences, and may ask for Personal Information.

Supporting quotations

Competitions, promotions, and research

When you respond to or participate in voluntary research or surveys or studies. These surveys may collect information about your likes and dislikes, experience interests and habits, general hobbies and interests, and other lifestyle information or preferences. These surveys may ask for Personal Information.

Qualifications & exceptions

• Applies to voluntary research, surveys or studies.

Not stated here

• This passage names no legal basis.

Data Access & Collection · Company practice

Brazil list: contest and promotion contact details are processed for prize fulfillment

The list for Brazil says that for contests, competitions, sweepstakes, giveaways, prize draws or other promotions that Roblox runs or sponsors, it may process certain contact information (such as name, email address and/or phone number) for prize fulfillment, as well as other information or content needed for the specific promotion.

Supporting quotations

We may process certain contact information (such as your name, email address, and/or phone number) for prize fulfillment purposes, as well as other information or content needed for the specific promotion.

Qualifications & exceptions

• Contact details are listed "such as".

Not stated here

• The passage does not mention gift card providers or publishing winners, which the general description covers.

Data Access & Collection · Company practice

Brazil list: login information includes IP address, device and browser details, MAC addresses and user ID

The list for Brazil says login information may include your IP address, device type, username, password, date and time of your visit, browser version, operating system information including language settings, MAC addresses and User ID. Roblox says it processes this information to provide the Service, and that it is in its legitimate interest to guarantee the Services' stability and security.

Supporting quotations

Other purposes for collecting your information

Login information, which may include your IP address, device type, username, password, date and time of your visit, information on your browser version, information on your operating system, including language settings, MAC addresses, and User ID. We will process this information to provide you with our Service. It is in our legitimate interest to guarantee the Services’ stability and security.

Qualifications & exceptions

• The items are introduced by "may include".

Not stated here

• This passage does not state how long login information is kept.

Data Access & Collection · Company practice

Brazil list: account information, including login, location and user content, is processed to provide the Services

The list for Brazil says account information, for example your name, username, login and password details, regional location information, user-generated content, contact details you choose to provide and other Personal Information used for participating in the Service, is processed to provide the Services to you.

Supporting quotations

Account information, e.g. information such as your name, username, login and password details, regional location information, user-generated content, contact details that you choose to provide to us, and other Personal Information that are used for participating in the Service we are offering. We process this information to provide our Services to you.

Qualifications & exceptions

• The items are introduced by "e.g." and "such as".
• Contact details are those you choose to provide.

Not stated here

• The passage does not say whether account information is used for other purposes.

Data Access & Collection · Company practice

Brazil list: job application data is processed to respond; career spaces may be recorded

The list for Brazil says information relating to a job application, like name, email address, employment details, CV, resume or other employment history details, is processed to process and respond to the application. If you engage with Roblox in an immersive space for prospective employees, such as the Roblox Career Center, the space may be recorded to provide the experience.

Supporting quotations

On our corporate websites or in job applications

Information relating to a job application made by you, like your name, email address, employment details, CV, resume or other details of your employment history sent by you.

such a space may be recorded in order to provide the experience

Qualifications & exceptions

• Applies to people who apply for jobs.
• Recording is stated "may".

Not stated here

• How long job application information is kept is not stated.

Data Access & Collection · Company practice

Brazil list: child account data is used for access and parent contact; birth date sets features (source wording garbled)

The list for Brazil says that when a child creates an account Roblox may process a username, password, birthdate and gender (gender is optional). It says it may use the parent's email to send a notification about the child's account and an invitation for the parent to review the account and update settings, and may use the birthdate to decide which features the child should have access to and when the child turns 13 and can be given broader access. One sentence in the source reads "Separate from account creation, users may optionally provide the user access to the Service and to communicate with the parent about the child’s account (if a parent email was provided)", which does not read as a complete sentence; it is quoted as written and not repaired. Its parenthetical suggests a parent email is provided in some cases.

Supporting quotations

When a child creates an account on Roblox, we may process a username, password, birthdate, and gender (gender is optional).

Separate from account creation, users may optionally provide the user access to the Service and to communicate with the parent about the child’s account (if a parent email was provided).

For example, we may use the parent’s email to send an email notification about the child’s account and an invitation for the parent to review their child's account and update settings.

We may use the birthdate the child provides when signing up for the Service to determine which features on Roblox the child should have access to and to determine when the child will turn 13 years old and can be given broader access to features on our Service.

Qualifications & exceptions

• Applies to children who create an account.
• Parent communication applies "if a parent email was provided".

Not stated here

• The garbled sentence leaves unclear exactly what users may optionally provide and the stated purpose; the parallel passage for the EEA, UK and Switzerland is not used to fill the gap.