Service providers may process children's persistent identifiers under contractual protections
Roblox says it relies on service providers to support the internal operations above, and that in some cases these providers may process persistent identifiers from users under 13. It says their processing is subject to contractual requirements and other measures to protect the security, confidentiality and integrity of the information.
Details
Who
Service providers
Why
Support the internal operations
Supporting quotations
Roblox relies on service providers to support the internal operations described above. In some cases, these entities may process persistent identifiers from users under the age of 13.
subject to contractual requirements and other measures to protect the security, confidentiality, and integrity of the information
Qualifications & exceptions
Providers are used "to support the internal operations described above".
Processing is "in some cases"; which cases is not stated.
Not stated here
Which providers receive the data and which protections apply in each case are not listed.
Sharing & Disclosure · Company practice
Payment processors run transactions under their own policies; Roblox says it lacks full saved billing details
The policy says payment processors (for example PayPal) manage transactions and those are subject to the processors' own terms and privacy policies, which explain what Personal Information they keep and use. As an example, processors might keep your billing information, transaction details and purchase history to sort out billing problems. Roblox receives certain information about purchases to fulfill its legal obligations and support the integrity of the platform, and may also collect your billing address for payment and integrity purposes. If you choose to save billing information with a processor, Roblox says it does not store or have access to your full saved billing information. If you buy Robux for another Roblox user, Roblox collects contact information such as email or phone number in order to communicate with you about the transaction.
Our payment processors (for example, PayPal) manage the transactions, which are subject to their terms and conditions and privacy policies.
Roblox receives certain information about purchases in order to fulfill our legal obligations and support the integrity of our platform. Roblox may also collect your billing address for payment and integrity purposes.
You can choose to save your billing information with one of our payment processors to make future purchases easier, in that case, Roblox does not store or have access to your full saved billing information.
If you purchase Robux on behalf of another Roblox user, we collect contact information, such as email or phone number, in order to communicate with you about the transaction.
Qualifications & exceptions
Processors' own policies govern what they keep.
The statement about not storing full billing information applies to information saved with a processor.
Roblox collects contact information when you buy Robux on behalf of another user.
Not stated here
The processors' policies are not supplied, so what they keep is not established here.
What "certain information about purchases" Roblox receives is not listed.
Sharing & Disclosure · Company practice
Joining a Creator Event shares your username, email and user ID with the hosting company
For users 13 and older, the policy says that if you join a virtual event hosted by a Creator, data such as your username, email and Roblox user ID may be shared with the company that hosts the events, to allow you to log in to the experience. It says your activity during a Creator Event is subject to the third-party platform's privacy policy as well as the Roblox Community Standards, and that Creator events are only available to users 13 or older.
Details
Who
The company that hosts the events
Why
Log in to the experience
Condition
Joining a virtual event hosted by a Creator; 13 or older
Supporting quotations
Creator Events (users 13 and older)
If you join a virtual event hosted by a Creator, data such as your username, email, and Roblox user ID may be shared with the company that hosts the events. This is done to allow you to log in to the experience.
Your activity during a Creator Event is subject to the third party platform’s privacy policy as well as the Roblox Community Standards. Creator events are only available if you are 13 or older.
Qualifications & exceptions
Applies to users 13 and older.
The data listed is introduced by "such as".
The third-party platform's privacy policy governs your activity during the event.
Not stated here
The third-party platform's privacy policy is not supplied, so what that platform does with the data is not established.
Sharing & Disclosure · Company practice
Your username and transaction details may be shared with the creator or later owner of UGC you acquire
The policy lists, among the examples of what Roblox may do, sharing information like your username and transaction details with the UGC creator or subsequent owners if you acquire a limited item, purchase, share, trade or otherwise engage in a transaction involving UGC.
Details
Who
UGC creator or subsequent owners
What it covers
Username and transaction details
Condition
Acquiring a limited item or transacting in UGC
Supporting quotations
share information like your username and transaction details to the UGC creator or subsequent owners, if you acquire a limited item if you purchase, share, trade, or otherwise engage in a transaction involving UGC,
Qualifications & exceptions
Applies when you acquire a limited item or engage in a transaction involving UGC.
Recipients are the UGC creator or subsequent owners.
Not stated here
What "transaction details" include is not defined in this passage.
Sharing & Disclosure · Company practice
Competitions and promotions may require contact details; gift card providers may receive them; winners may be published
The policy says that taking part in competitions or promotions such as contests, sweepstakes, giveaways or prize draws may require contact information such as name, email or phone number to be eligible for discounts or prizes. If you receive a gift card from a third-party provider, certain contact information may be shared with the provider and used in accordance with this Policy and the terms on the provider's website. In some places the law requires Roblox to publicly share information about winners.
Details
What it covers
Contact information such as name, email or phone number
Who
Third-party gift card provider
Where
Some places in the world require publishing winners
Supporting quotations
Competitions, promotions and research
Taking part in competitions or promotions
those activities may require contact information such as your name, email, or phone number, to be eligible for discounts or prizes
If you receive a gift card provided by a third party provider, certain contact information may be shared with the provider and used in accordance with this Policy and the terms listed on the provider’s website.
In some places in the world, the law requires us to publicly share information about the winners.
Qualifications & exceptions
Applies when you take part in competitions or promotions.
Sharing with a gift card provider applies where you receive a gift card from a third-party provider.
Public sharing of winner information applies in some places where the law requires it.
Not stated here
The third-party provider's terms are not supplied here.
Which places require public sharing of winners, and what is shared, are not stated.
Sharing & Disclosure · Company commitment
Roblox shares information with service providers who may use it only for the assigned tasks, not for selling
The policy says Roblox may share your information, including Personal Information, with other companies (third-party agents, contractors or service providers) that it hires to perform services. It says these companies are only allowed to use the information to complete the relevant tasks and not for any other purpose, including selling Personal Information, and that Roblox makes sure the companies are capable of looking after the information properly. It also says Personal Information collected through the SMS program will not be shared, sold or rented to third parties.
Details
Who
Third-party agents, contractors and service providers
Why
Complete the relevant tasks only; not selling
Condition
Where necessary to provide a service on Roblox's behalf
Supporting quotations
When we share your information
We may share Personal Information where necessary
When other companies need Personal Information to provide a service on our behalf
We may share your information, including Personal Information, with other companies (known as third-party agents, contractors, or service providers). We hire these companies to perform services for us.
These companies are only allowed to use the information we share to complete the relevant tasks. They are not allowed to use the information we share for any other purpose, including selling Personal Information.
Personal Information collected through the SMS program, won’t be shared, sold or rented to third parties.
Qualifications & exceptions
Applies to companies that provide services on Roblox's behalf.
Providers may use the information only to complete the relevant tasks.
The SMS program statement is a separate commitment about information collected through that program.
Not stated here
The "SMS program" is not defined in this passage.
How Roblox checks that providers can look after the information is not described.
Sharing & Disclosure · Company practice
Examples of companies Roblox may share information with include Persona, Google, AppsFlyer and payment providers
The policy gives examples of services it might rely on other companies to provide and examples of the companies it is likely to share information with: account integrity and security (for example Persona), analytics (Google LLC), user acquisition (AppsFlyer), community filtering and moderation, customer support, surveys and promotions (Reach3), billing and payment (Kount, Worldpay, PayPal, Incomm, Blackhawk, Google, Apple, Amazon, Windows Store, Xbox, Playstation, Meta Quest, Xsolla), and hosting and content delivery (AWS, Equinix, CenturyLink, YouTube, Vimeo).
Details
Who
Persona, Google LLC, AppsFlyer, Reach3, payment and hosting companies
What it covers
Services provided by other companies
Supporting quotations
Here are examples of the services that we might rely on other companies to provide, and examples of the companies that we are likely to share information with.
Account integrity and security services (e.g., Persona);
Analytics services (e.g., Google LLC);
User acquisition services (e.g., AppsFlyer);
Community filtering and moderation services;
Customer support services;
Surveys and promotions (e.g., Reach3);
Billing and payment services (e.g., Kount, Worldpay, PayPal, Incomm, Blackhawk, Google, Apple, Amazon, Windows Store, Xbox, Playstation, Meta Quest, Xsolla)
The lists are examples ("might", "likely"), not an exhaustive list of recipients.
Some categories give no named example.
Not stated here
Which providers actually receive which information is not stated.
Sharing & Disclosure · Company practice
Creators of experiences you use can see your names, user ID, game metrics, UGC transaction details and region
The policy says creators of the experiences you use or content you interact with have access to your username, display name, user ID, game metrics, UGC transaction details and your regional location, which Roblox bases on your IP address. It says Roblox does not share your IP address with creators. It says regional location is provided so creators can determine their player base and make sure their experiences meet the legal requirements of the country you live in.
Details
Who
Creators of experiences
What it covers
Username, display name, user ID, game metrics, UGC transaction details, regional location
Why
Determine player base and meet legal requirements
Supporting quotations
When creators need Personal Information to improve your experience
The creators of the experiences you use or content you interact with will have access to your username, display name, user ID, game metrics, UGC transaction details, and your regional location (which we base on your IP address). We do not share your IP address with the creators.
We provide creators with the regional location of players to determine their player base and make sure their experiences meet the legal requirements of the country you live in.
Qualifications & exceptions
Applies to creators of the experiences you use or content you interact with.
Regional location is based on IP address; the IP address itself is not shared.
Not stated here
How creators may use this information beyond the stated purposes is not addressed in this passage.
Sharing & Disclosure · Permission or license
Roblox may share Personal Information for court orders, agency requests, crime prevention or legal rights
The policy says Roblox may share your Personal Information, as permitted or required by law, if it is necessary to comply with a judicial proceeding, court order or other legal process served on Roblox; if law enforcement agencies, regulators or other public agencies (including schools or children's services) request it; if Roblox believes disclosure may prevent a crime; if Roblox believes it is necessary to protect its legal rights or the legal rights of others; or if a law requires it to share the information.
Details
Who
Law enforcement agencies, regulators and other public agencies including schools or children's services; courts
Condition
As permitted or required by law; Roblox's belief where stated
Supporting quotations
For legal reasons or to help prevent a crime
We may share your Personal Information, as permitted or required by law, if:
necessary to comply with a judicial proceeding, court order, or other legal process served on Roblox
law enforcement agencies, regulators, or other public agencies (including schools or children's services) request that we share it
we believe that disclosing the information may prevent a crime
we believe it is necessary to protect our legal rights or the legal rights of others
a law requires us to share it
Qualifications & exceptions
Stated as "as permitted or required by law".
Several grounds depend on Roblox's own belief (crime prevention, protecting legal rights).
Requests can come from public agencies including schools or children's services.
Not stated here
The policy does not say whether Roblox notifies the user before sharing on these grounds.
Sharing & Disclosure · Permission or license
Roblox may share the contents of your communications with authorities for threats to life and under online safety laws
The policy says Roblox may also share the contents of your communications, as permitted or required by law: to law enforcement or judicial authorities to address a threat to the life or safety of a person, including (but not limited to) where consistent with its obligations under the Digital Services Act, Article 18; when required by law in response to governmental regulatory requests, such as information notices issued under the UK Online Safety Act; and when required by laws governing online safety, such as the Australian Online Safety Act. The policy names these laws but does not set out their content.
Details
What it covers
Contents of your communications
Who
Law enforcement, judicial authorities and regulators
Where
EU Digital Services Act, UK Online Safety Act, Australian Online Safety Act
Supporting quotations
We may also share the contents of your communications as permitted or required by law:
to law enforcement or judicial authorities to address a threat to life or safety of a person, including (but not limited to) where consistent with Roblox's obligations under the Digital Services Act, Article 18
when required by law in response to governmental regulatory requests, such as Information notices issued under the UK Online Safety Act
when required by laws governing online safety, such as the Australian Online Safety Act
Qualifications & exceptions
Stated as "as permitted or required by law".
The Digital Services Act reference is "including (but not limited to)", so the list is not complete.
The UK and Australian laws are given as examples ("such as").
Not stated here
What the named laws require is not supplied here and is not described by this card.
Sharing & Disclosure · Permission or license
Roblox may share Personal Information or communication contents if it believes sharing would support safety or security
The policy says Roblox may share your Personal Information or the contents of your communications if it believes that sharing would help an investigation into public safety or a violation of its Terms of Use, protect the safety of Roblox users or others, reduce risk to user safety or security (or if collaborating with others is necessary to protect users), or help protect the security or integrity of its Services.
Details
What it covers
Personal Information and contents of communications
Why
Investigations, user safety, security and integrity
Condition
Roblox believes sharing would achieve the aim
Supporting quotations
To support safety and security
We may share your Personal Information or the contents of your communications if we believe that sharing would:
help an investigation into public safety or a violation of our Terms of Use
protect the safety of Roblox users or others
reduce risk to user safety or security, or if collaborating with others is necessary to protect users
help to protect the security or integrity of our Services
Qualifications & exceptions
Sharing depends on Roblox's belief that it would achieve the listed aim.
Covers both Personal Information and contents of communications.
Not stated here
Who the information may be shared with under this passage is not stated.
Sharing & Disclosure · Permission or license
Roblox may share information to take precautions against legal responsibility or protect its rights
The policy says Roblox may share your information if it believes that disclosing the information will allow it to take precautions against taking legal responsibility (liability) or to protect its rights.
Details
Why
Take precautions against legal responsibility; protect Roblox's rights
Supporting quotations
If we need to protect ourselves against legal responsibility
We may share your information if we believe that disclosing the information will allow us to take precautions against taking legal responsibility (liability) or to protect our rights.
Qualifications & exceptions
Depends on Roblox's belief.
Not stated here
Who receives the information is not stated.
Sharing & Disclosure · Permission or license
Your information may pass to a buyer or in an insolvency; where law requires, Roblox will notify you and ask consent
The policy says Roblox may hand over rights to access your information, including Personal Information, as part of a merger, acquisition, sale of assets or similar transaction, or if information is handed over as a business asset in an insolvency, bankruptcy or receivership. It says that where required by law, Roblox will notify you and ask you to consent to such sharing.
Details
Condition
Merger, acquisition, asset sale or insolvency
Exception
Notice and consent where required by law
Supporting quotations
If there is a transfer of rights in our business e.g., if we sell our business
We may hand over rights to access your information, including Personal Information:
as part of a merger, acquisition, sale of assets, or similar transaction
if information is handed over as a business asset in an insolvency, bankruptcy, or receivership
Where required by law, we will notify you and ask you to consent to such sharing.
Qualifications & exceptions
Notice and consent apply only "where required by law".
Not stated here
In which places the law requires notice and consent is not stated in this passage.
Sharing & Disclosure · Company practice
Roblox may disclose contact identifiers, demographics and device IDs to advertising and measurement companies
The policy says Roblox may disclose information collected from or about you to third-party advertising companies and/or advertising measurement companies to select and display ads on Roblox, or to measure and improve advertising effectiveness. It says that, in accordance with applicable law, it provides choices about whether data is disclosed for this purpose. The data disclosed includes contact identifiers, characteristics or demographics, and device identifiers.
Details
Who
Third-party advertising and advertising measurement companies
What it covers
Contact identifiers, characteristics or demographics, device identifiers
Why
Select and display ads; measure and improve advertising effectiveness
Supporting quotations
We may disclose Personal Information to third parties
For Advertising Purposes
Roblox may disclose information collected from or about you with third-party advertising companies and/or advertising measurement companies to select and display advertisements to you on Roblox, or measure and improve advertising effectiveness.
In accordance with applicable law, we provide our users with choices about whether data is disclosed for this purpose.
Contact identifiers
Characteristics or demographics
Device identifiers
Qualifications & exceptions
Choices are provided "in accordance with applicable law".
The data list says "includes", so it is not stated to be complete.
Not stated here
The passage does not say whether this list applies to users under 18 in the same way; a later sentence limits disclosure for personalized advertising for those users.
Advertising companies may receive device identifiers such as IP address or device ID when you reach Roblox through an ad
The policy says Roblox partners with third-party advertising companies such as ad server companies and ad networks to advertise Roblox on other websites and services. If you interact with content or reach Roblox through a link in an advertisement, Roblox or its service providers may give these advertising companies identifiers from your device, such as an IP address or device ID.
Details
Condition
You interact with content or reach Roblox through an advertisement
What it covers
Device identifiers such as IP address or device ID
Supporting quotations
We also partner with third-party advertising companies such as ad server companies and ad networks to advertise Roblox on other websites and services. If you interact with content or reach Roblox through a link in an advertisement, we or our service providers may give these third-party advertising companies identifiers from your device, such as an IP address or device ID.
Qualifications & exceptions
Applies when you interact with content or reach Roblox through a link in an advertisement.
Identifiers are given as examples ("such as").
Not stated here
Whether other data is given to these companies is not stated in this passage.
Sharing & Disclosure · User right or choice
Ad data choices are in privacy settings; under-18s' Personal Information is not disclosed to direct personalized ads
The policy says you can exercise choices about data processing for the advertising purpose on your account's privacy settings page, and that depending on where you live you may have additional rights, with region-specific information in Section 7. It says Roblox does not disclose any Personal Information from users under 18 for the purposes of directing personalized advertising. When you interact with an ad on Roblox, it says it works with partners to produce aggregated measurement information.
Details
What it does
Visit the account privacy settings page
Condition
Users under 18: no disclosure for directing personalized advertising
Where
Additional rights depend on where you live
Supporting quotations
You can exercise choices about data processing for this purpose by visiting your account’s privacy settings page
Depending on where you live, you may have additional rights that apply. For region-specific information, please visit Section 7 of this policy.
We do not disclose any Personal Information from users under 18 years old for the purposes of directing personalized advertising.
When you interact with an ad on Roblox, we work with partners to produce aggregated measurement information.
Qualifications & exceptions
The under-18 statement is limited to disclosure "for the purposes of directing personalized advertising".
Additional rights depend on where you live.
Not stated here
Whether under-18 data goes to partners for non-personalized advertising or measurement is not stated beyond the aggregated measurement sentence.
Roblox may share data that does not identify you for reporting, any business or marketing purpose and usage insight
The policy says that in some circumstances Roblox shares data that does not identify you, for example to comply with reporting requirements, for any business or marketing purposes, and to help Roblox and others understand how, when and why users visit its sites and use Roblox. It says it may share non-identifying data of all users regardless of their age.
Details
What it covers
Data that does not identify you
Why
Reporting, any business or marketing purposes, understanding site use
Condition
All users regardless of age
Supporting quotations
We may share information that does not identify you
In some circumstances, we share data that doesn’t identify you, for example:
To comply with reporting requirements
For any business or marketing purposes
To help us and others understand how, when, and why users visit our sites and use Roblox.
We may share non-identifying data of all users regardless of their age.
Qualifications & exceptions
Applies to data that "doesn't identify you".
The purpose "any business or marketing purposes" is broad.
Applies to users of any age.
Not stated here
How Roblox decides data does not identify a person is not described in this passage.
Sharing & Disclosure · Company practice
Information is stored on US servers and may be transferred abroad, with reasonable steps to protect privacy rights
The policy says Roblox is based in the United States and sends information it collects from you to its secure servers in the US, where it stores and uses it. It may also transfer information to its other offices and to the third parties mentioned in Section 4 of the policy, which might be outside your region, and its agents or contractors may also use your information. It says the data protection laws of the US or other countries may not be equivalent to those where you live. Wherever it transfers Personal Information, Roblox says it will take reasonable steps so that your privacy rights continue to be protected, and, if required by applicable legislation, it relies on a valid international data transfer mechanism.
Details
Where
United States servers; transfers possibly outside your region
Condition
International transfer mechanism if required by legislation
Supporting quotations
Where we store your information
Roblox is based in the United States. We send information we collect from you to our secure servers in the U.S. where we store and use it.
We may also transfer information that we collect from you to our other offices and to the third parties mentioned in Section 4 of this Policy – these might be outside your region.
The data protection laws of the U.S. or other countries may not be equivalent to those where you live.
Wherever we transfer your Personal Information, we will take reasonable steps so that your privacy rights continue to be protected. If required by applicable legislation, we rely on a valid international data transfer mechanism to enable cross-border data transfers.
Qualifications & exceptions
Information is sent to servers in the US.
Transfers may be outside your region.
A transfer mechanism is used only if required by applicable legislation.
Not stated here
Which transfer mechanism is used is not stated.
Which other offices receive information is not stated.
Sharing & Disclosure · Company practice
EEA/UK/Swiss list: Creator Event data goes to the third-party platform hosting the event
The list says that if you join a virtual event hosted by a Creator, data such as your username, email and Roblox user ID may be shared with the third-party platform that hosts events, to allow you to log in to the experience. Your activity during a Creator Event is subject to that platform's privacy policy as well as the Roblox Community Standards. The bases are Article 6 sec. 1 sent. 1 lit. b ("performance of a contract") to join an event and f ("legitimate interest") to support the security and integrity of the service.
Details
Who
The third-party platform that hosts events
Why
Log in to the experience; security and integrity
Supporting quotations
If you join a virtual event hosted by a Creator, data such as your username, email, and Roblox user ID may be shared with the third-party platform that hosts events. Such data is used to allow you to log in to the experience.
Your activity during a Creator Event is subject to the third party platform’s privacy policy as well as the Roblox Community Standards
The bases for processing this Personal Information are Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”) to join an event and f (“legitimate interest”) GDPR to support the security and integrity of our service.
Qualifications & exceptions
The data listed is introduced by "such as".
The third-party platform's privacy policy governs your activity during the event.
Not stated here
The third-party platform's privacy policy is not supplied here.
The Roblox Community Standards are linked but not supplied here.
Sharing & Disclosure · Company practice
EEA/UK/Swiss list: ads shown with partners rest on consent if personalized and legitimate interest if not
The list says Roblox also may work with partners to directly show you ads on Roblox. To the extent this involves processing Personal Information to display personalized ads, the stated legal basis is Article 6 sec. 1 sent. 1 lit. a GDPR ("consent"); to display non-personalized ads, it is Article 6 sec. 1 sent. 1 lit. f GDPR ("legitimate interest").
Details
Who
Partners
Condition
Consent if personalized; legitimate interest if non-personalized
Supporting quotations
Roblox also may work with partners to directly show you ads on Roblox. To the extent these practices involve the processing of Personal Information to display personalized ads, the legal basis for the processing is Article 6 sec. 1 sent. 1 lit. a GDPR (“consent”). To the extent these practices involve the processing of Personal Information to display non-personalized ads, the legal basis for processing is Article 6 sec. 1 sent. 1 lit. f GDPR (“legitimate interest”).
Qualifications & exceptions
Basis depends on whether the ads are personalized.
Not stated here
Which partners are involved is not stated.
Sharing & Disclosure · Company commitment
EEA/UK/Swiss list: child account information is used only for stated purposes; parental consent if the law requires
The list says that in general Roblox will not use or share account information (including Personal Information) from a child's account except for the permissible purposes stated in the Privacy Policy and, if required by law, only with the prior verifiable consent of a parent or legal guardian (Article 6 sec. 1 sent. 1 lit. a and Article 8 sec. 1 GDPR).
Details
Condition
In general; consent only if required by law
Supporting quotations
In general, we will not use or share account information (including Personal Information) from a child’s account except for the permissible purposes stated in this Privacy Policy, and, if required by law, only with the prior verifiable consent of a parent or legal guardian (Article 6 sec. 1 sent. 1 lit. a and Article 8 sec. 1 GDPR).
Qualifications & exceptions
The commitment is "in general".
Parental consent is required only "if required by law".
Not stated here
In which cases the law requires verifiable parental consent is not stated.
EEA/UK/Swiss list: service providers receive information under Article 28 agreements for assigned tasks only
The list says Roblox may share users' information, including Personal Information like billing information or usernames, with third-party agents, contractors or service providers hired to perform services on its behalf, who may operate or support certain functions of the Service. It gives an illustrative list of functions and providers: account integrity and security (for example Persona), analytics (Google LLC), user acquisition (AppsFlyer), community filtering and moderation, customer support, surveys and promotions (Reach3), billing services and payment gateway providers (Kount, Worldpay, PayPal, Incomm, Blackhawk, Google, Apple, Amazon, Windows Store, Xbox, Playstation, Meta Quest, Xsolla), and hosting and content delivery network services (AWS, Equinix, CenturyLink, YouTube, Vimeo). The stated legal basis is Article 28 of GDPR in conjunction with the data processing agreements with the agents. The agents may use the information only for the specific tasks they were hired for, consistent with the Privacy Policy, and Roblox says it takes steps so that all service providers with access to Personal Information are capable of protecting it.
Details
Who
Third-party agents, contractors and service providers
Why
Specific tasks they were hired to do only
Supporting quotations
Data Sharing
Roblox may share users’ information, including Personal Information like billing information or usernames, with our third-party agents, contractors, or service providers who are hired to perform services on Roblox’s behalf.
Below is an illustrative list of functions for which we may use third party service providers and the names of the providers we may use to perform these functions:
Account Integrity and Security (e.g., Persona);
Analytics services (e.g., Google LLC);
User Acquisition services (e.g., AppsFlyer);
Community filtering and moderation services;
Customer support services;
Surveys and promotions (e.g., Reach3);
Billing services and payment gateway providers (e.g., Kount, Worldpay, PayPal, Incomm, Blackhawk, Google, Apple, Amazon, Windows Store, Xbox, Playstation, Meta Quest, Xsolla); and
The legal basis for this data transfer and processing activity is Article 28 of GDPR in conjunction with the data processing agreements we concluded with respective third-party agents. These agents and contractors are only allowed to use the information shared with them only for the specific tasks they’ve been hired to do and consistent with this Privacy Policy, and for no other purposes.
Qualifications & exceptions
The list of providers is "illustrative".
Providers may use the information only for the tasks they were hired to do.
Not stated here
Which providers actually receive which information is not stated.
The data processing agreements are not supplied.
Sharing & Disclosure · Company practice
EEA/UK/Swiss list: creators see usernames, user ID, game metrics, UGC details and region; IP address is not shared
The list says creators of the experiences you use or content you interact with have access to your username, display name, user ID, game metrics, UGC transaction details and your regional location (based on your IP address), and that Roblox does not share your IP address with creators. Regional location is given to creators to determine their player base and ensure their experiences meet the legal requirements of the country you live in. The stated bases are Article 6 sec. 1 sent. 1 lit. b ("performance of a contract"), lit. c ("compliance with legal obligation") in compliance with the respective EEA or Member State law, and lit. f ("legitimate interest"). It says it is the creators' legitimate interest to comply with non-EEA legal obligations.
Details
Who
Creators of experiences
What it covers
Username, display name, user ID, game metrics, UGC transaction details, regional location
Why
Determine player base; meet legal requirements
Supporting quotations
the creators of the experiences you use or content you interact with will have access to your username, display name, user ID, game metrics, UGC transaction details, and your regional location (which we base on your IP address). We do not share your IP address with the creators.
We provide creators with the regional location of players to determine their player base and make sure their experiences meet the legal requirements of the country you live in.
It is the creators’ legitimate interest to comply with non-EEA legal obligations.
Qualifications & exceptions
Applies to creators of the experiences you use or content you interact with.
The IP address itself is not shared.
Not stated here
What creators may do with this information beyond the stated purposes is not addressed.
Sharing & Disclosure · Company practice
EEA/UK/Swiss list: disclosure to advertising partners rests on consent; measurement covers contact and device IDs
The list says that in accordance with applicable laws Roblox may disclose information collected from or about you to advertisers and/or advertising measurement companies to select advertisements for you or to measure and improve advertising effectiveness. The stated legal basis for disclosing information to third-party advertising partners is Article 6 sec. 1 sent. 1 lit. a ("consent"). Data disclosed for advertising measurement includes contact identifiers and device identifiers, on the basis of legitimate interest (lit. f). The source writes the measurement basis as "Article 6 sec. sent. 1 lit. f", omitting the paragraph number, which is quoted as given.
Details
Who
Advertisers and advertising measurement companies
What it covers
Contact identifiers and device identifiers for measurement
Supporting quotations
In accordance with applicable laws, Roblox may disclose information collected from or about you with advertisers and/or advertising measurement companies to select advertisements for you, or measure and improve advertising effectiveness. The legal basis for disclosing information to third party advertising partners is Article 6 sec. 1 sent. 1 lit. a(“consent”).
Data disclosed for advertising measurement purposes includes contact identifiers and device identifiers. The legal basis for this processing activity is Article 6 sec. sent. 1 lit. f (“legitimate interest”).
Qualifications & exceptions
Disclosure for advertising partners rests on consent; measurement disclosure rests on legitimate interest.
The measurement data list says "includes".
Not stated here
The citation for the measurement basis omits a paragraph number in the source and is not corrected here.
Sharing & Disclosure · Permission or license
EEA/UK/Swiss list: Roblox may disclose information and communication content for legal process and agency requests
The list says Roblox may disclose Personal Information about you, including the content of your communications on the Service, to comply with legal process such as court orders and subpoenas, for example where consistent with its obligations under the Digital Services Act, Article 18 and information notices under the UK Online Safety Act. It may also disclose Personal Information, including content, in response to a request from law enforcement agencies, regulators or other public agencies (including schools or children services) if it believes there is a risk to user safety or security, for legal reasons, or to prevent a crime, in accordance with Section 4 of the policy. The stated bases are Article 6 sec. 1 sent. 1 lit. c ("compliance with legal obligation") in compliance with the respective EEA or Member State law, and lit. f ("legitimate interest"); it says it is Roblox's legitimate interest to comply with the legal requirements of U.S. law and that it has a legitimate interest in these purposes.
Details
What it covers
Personal Information and the content of communications
Who
Courts, law enforcement agencies, regulators and other public agencies
Condition
Legal process, or a request plus Roblox's belief of risk, legal reasons or crime prevention
Supporting quotations
Legal disclosure
We may disclose Personal Information about you, including the content of your communications on the Service, to comply with legal process, including court orders and subpoenas, served on our Service
In addition, we also may disclose Personal Information about you, including content, in response to a request from law enforcement agencies, regulators, or other public agencies (including schools or children services), if we believe that there is a risk to user safety or security, for legal reasons, or to prevent a crime, in accordance with Section 4 of the Roblox Privacy and Cookie Policy.
It is our legitimate interest to comply with the legal requirements of U.S. law.
Qualifications & exceptions
Agency requests lead to disclosure if Roblox believes there is a risk to user safety or security, for legal reasons, or to prevent a crime.
Legal bases include a legitimate interest in complying with U.S. law.
Not stated here
What the Digital Services Act and UK Online Safety Act require is not supplied here.
"Section 4" is referred to by number; the source does not print section numbers.
Sharing & Disclosure · Company practice
EEA/UK/Swiss list: information is stored on US servers; safeguards include Standard Contractual Clauses
The list says Roblox is based in the U.S. and that Personal Information it collects is sent to and stored on secure servers in the United States, which it calls necessary to process the information. Some of its agents and third-party service providers are outside the European Economic Area, for example in the United States. It says the data protection laws of the United States or other countries may not be as comprehensive or equivalent to those in your country of residence. Wherever it transfers Personal Information it says it will take reasonable steps so that privacy rights continue to be protected, for example by concluding the EU Standard Contractual Clauses with third parties.
Details
Where
United States servers; providers outside the EEA
What it does
Reasonable steps, e.g. Standard Contractual Clauses
Supporting quotations
Storage and international transfer of your Personal Information
Your Personal Information that we collect is sent to and stored on secure servers located in the United States of America.
Some of our agents and third-party service providers are located outside the European Economic Area, e.g. the United States.
Wherever we transfer your Personal Information, we will take reasonable steps so that your privacy rights continue to be protected, e.g. conclude the EU Standard Contractual Clauses with third parties.
Qualifications & exceptions
Storage is on servers in the United States.
The Standard Contractual Clauses are given as an example ("e.g.") of reasonable steps.
Not stated here
The text of the Standard Contractual Clauses is linked but not supplied here.
Which safeguards apply for UK and Swiss transfers is not stated.
Sharing & Disclosure · Company practice
Brazil list: Creator Event data goes to the third-party platform hosting the event
The list for Brazil says that if you join a virtual event hosted by a Creator, data such as your username, email and Roblox user ID may be shared with the third-party platform that hosts events, to allow you to log in. Your activity during a Creator Event is subject to that platform's privacy policy as well as the Roblox Community Standards.
Details
Who
The third-party platform that hosts events
Supporting quotations
If you join a virtual event hosted by a Creator, data such as your username, email, and Roblox user ID may be shared with the third-party platform that hosts events. Such data is used to allow you to log in to the experience.
Your activity during a Creator Event is subject to the third party platform’s privacy policy as well as the Roblox Community Standards
Qualifications & exceptions
The data listed is introduced by "such as".
Not stated here
The third-party platform's privacy policy and the Roblox Community Standards are not supplied here.
Sharing & Disclosure · Company commitment
Brazil list: child account information is generally used only for stated purposes; parental consent where applicable
The list for Brazil says that in general Roblox will not use or share account information (including Personal Information) from a child's account except for the permissible purposes stated in the Privacy Policy and, where applicable, only with the prior verifiable consent of a parent or legal guardian.
Details
Condition
In general; consent where applicable
Supporting quotations
In general, we will not use or share account information (including Personal Information) from a child's account except for the permissible purposes stated in this Privacy Policy and, where applicable, only with the prior verifiable consent of a parent or legal guardian.
“Children” or “Child” means any user under the age of 13
Qualifications & exceptions
The commitment is "in general".
Parental consent applies "where applicable".
Not stated here
When parental consent is applicable is not stated.
Sharing & Disclosure · Company practice
Brazil list: service providers receive information for assigned tasks only; illustrative providers listed
The list for Brazil says Roblox may share users' information, including Personal Information like billing information or usernames, with third-party agents, contractors or service providers hired to perform services on its behalf, who may operate or support certain functions of the Service. It gives an illustrative list of functions and providers: account integrity and security (for example Persona), analytics (Google LLC), user acquisition (AppsFlyer), community filtering and moderation, customer support, surveys and promotions (Reach3), billing services and payment gateway providers (Kount, Worldpay, PayPal, Incomm, Blackhawk, Google, Apple, Amazon, Windows Store, Xbox, Playstation, Meta Quest, Xsolla), and hosting and content delivery network services (AWS, Equinix, CenturyLink, YouTube, Vimeo). The agents may use the information only for the specific tasks they were hired for, consistent with the Privacy Policy, and Roblox says it takes steps so that service providers with access to Personal Information are capable of protecting it.
Details
Who
Third-party agents, contractors and service providers
Why
Specific tasks they were hired to do only
Supporting quotations
Data Sharing
Roblox may share users’ information, including Personal Information like billing information or usernames, with our third-party agents, contractors, or service providers who are hired to perform services on Roblox’s behalf.
Below is an illustrative list of functions for which we may use third party service providers and the names of the providers we may use to perform these functions:
Account Integrity and Security (e.g., Persona);
Analytics services (e.g., Google LLC);
User Acquisition services (e.g., AppsFlyer);
Community filtering and moderation services;
Customer support services;
Surveys and promotions (e.g., Reach3);
Billing services and payment gateway providers (e.g., Kount, Worldpay, PayPal, Incomm, Blackhawk, Google, Apple, Amazon, Windows Store, Xbox, Playstation, Meta Quest, Xsolla); and
These agents and contractors are only allowed to use the information shared with them only for the specific tasks they’ve been hired to do and consistent with this Privacy Policy, and for no other purposes.
Qualifications & exceptions
The list of providers is "illustrative".
Providers may use the information only for the tasks they were hired to do.
Not stated here
Which providers actually receive which information is not stated.
Sharing & Disclosure · Company practice
Brazil list: creators see usernames, user ID, game metrics, UGC details and region; IP address is not shared
The list for Brazil says creators of the experiences you use or content you interact with have access to your username, display name, user ID, game metrics, UGC transaction details and your regional location (based on your IP address), and that Roblox does not share your IP address with creators. Regional location is provided so creators can determine their player base and ensure their experiences meet the legal requirements of the country you live in.
Details
Who
Creators of experiences
Why
Determine player base; meet legal requirements
Supporting quotations
the creators of the experiences you use or content you interact with will have access to your username, display name, user ID, game metrics, UGC transaction details, and your regional location (which we base on your IP address). We do not share your IP address with the creators.
We provide creators with the regional location of players to determine their player base and make sure their experiences meet the legal requirements of the country you live in.
Qualifications & exceptions
Applies to creators of the experiences you use or content you interact with.
Not stated here
What creators may do with this information beyond the stated purposes is not addressed.
Sharing & Disclosure · Company practice
Brazil list: information may be disclosed to advertisers and measurement companies, including identifiers
The list for Brazil says that in accordance with applicable laws Roblox may disclose information collected from or about you to advertisers and/or advertising measurement companies to select advertisements for you or to measure and improve advertising effectiveness. Data disclosed for this purpose includes contact identifiers and device identifiers.
Details
Who
Advertisers and advertising measurement companies
What it covers
Contact identifiers and device identifiers
Supporting quotations
In accordance with applicable laws, Roblox may disclose information collected from or about you with advertisers and/or advertising measurement companies to select advertisements for you, or measure and improve advertising effectiveness. Data disclosed for this purpose includes contact identifiers and device identifiers.
Qualifications & exceptions
Disclosure is "in accordance with applicable laws".
The data list says "includes".
Not stated here
This passage does not mention a consent step; the EEA list gives consent as the basis for disclosure to advertising partners.
Sharing & Disclosure · Permission or license
Brazil list: Roblox may disclose information, including communication content, for legal process and agency requests
The list for Brazil says Roblox may disclose Personal Information, including the content of your communications on the Service, to comply with legal process such as court orders and subpoenas. It may also disclose Personal Information, including content, in response to a request from law enforcement agencies, regulators or other public agencies (including schools or children services) if it believes there is a risk to user safety or security, for legal reasons, or to prevent a crime, in accordance with Section 4 of the policy.
Details
Who
Courts, law enforcement agencies, regulators and other public agencies
Supporting quotations
Legal disclosure
We may disclose Personal Information about you, including the content of your communications on the Service, to comply with legal process, including court orders and subpoenas, served on our Service.
In addition, we also may disclose Personal Information about you, including content, in response to a request from law enforcement agencies, regulators, or other public agencies (including schools or children services), if we believe that there is a risk to user safety or security, for legal reasons, or to prevent a crime, in accordance with Section 4 of the Roblox Privacy and Cookie Policy.
Qualifications & exceptions
Agency requests lead to disclosure if Roblox believes there is a risk to user safety or security, for legal reasons, or to prevent a crime.
Not stated here
"Section 4" is referred to by number; the source does not print section numbers.
Sharing & Disclosure · Company practice
Brazil list: information is stored on US servers; transfers rely on a mechanism set out in Brazilian law
The list for Brazil says Roblox is based in the U.S. and that Personal Information it collects is sent to and stored on secure servers in the United States, which it calls necessary to process the information. Some of its agents and third-party service providers are located outside Brazil, for example in the United States. It says US or other countries' data protection laws may not be as comprehensive or equivalent to those in Brazil. Wherever it transfers Personal Information, it says it will take reasonable steps so that it relies on a legitimate international transfer mechanism, as set out in Brazilian data protection laws.
Details
Where
United States servers; providers outside Brazil
Supporting quotations
Storage and international transfer of your Personal Information
Your Personal Information that we collect is sent to and stored on secure servers located in the United States of America.
Some of our agents and third-party service providers are located outside of Brazil, e.g. the United States.
Wherever we transfer your Personal Information, we will take reasonable steps so that we rely on a legitimate international transfer mechanism, as set out in Brazilian data protection laws.