Children's Privacy Notice

Legal Rights & Agreement Rules · Context

Notice is issued under COPPA

Roku states that this Children's Privacy Notice is provided pursuant to the Children's Online Privacy Protection Act (COPPA). The notice gives that statute as its stated legal basis; it does not describe what the statute requires, and it states no effective date.

Supporting quotations

This notice is provided pursuant to the Children’s Online Privacy Protection Act (COPPA).

Not stated here

• The notice does not state an effective date, so the analyzed version is identified by its saved source rather than by a date in the text.

Data Access & Collection · Company commitment

Extra protections cover only certain Roku areas

Roku says it implements special privacy protections in certain parts of the Roku Services, naming the Kids & Family section in The Roku Channel and the Kids section of the Roku Channel Store as examples. The notice presents those sections as examples of the covered parts, not as a complete list, and it does not describe the privacy protections that apply elsewhere in the Roku Services.

Supporting quotations

Roku implements special privacy protections in certain parts of the Roku Services, such as the Kids & Family section in The Roku Channel, and the Kids section of the Roku Channel Store.

Qualifications & exceptions

• Only the parts of the Roku Services Roku treats as children's areas; the two named sections are examples ('such as').

Not stated here

• Which other parts of the Roku Services count as covered is not listed.

Data Access & Collection · Company practice

Kids areas collect voice commands, identifiers and usage data

When any user interacts with those covered parts of the Roku Services, Roku collects any voice commands the user chooses to submit, persistent identifiers, and usage information about the interactions with those parts. The trigger is interaction by any user, not only a child, and voice commands are limited to those a user chooses to submit.

Supporting quotations

When any user interacts with these parts of the Roku Services, Roku collects the following personal information: any voice commands that a user chooses to submit, persistent identifiers, and usage information about the interactions with those parts of the Roku Services.

Qualifications & exceptions

• When any user interacts with the covered parts of the Roku Services.
• Voice commands only when a user chooses to submit them.
• Usage information only about interactions with those parts.

Not stated here

• The notice does not enumerate which persistent identifiers or which usage data it collects.

Retention & Deletion · Company practice

Voice commands serve the request and recordings are deleted

Roku uses voice commands collected in those parts of the Roku Services to carry out the instruction or request they express, and it states that the voice recordings it collects are immediately deleted after that use. The sentence addresses the recordings only: it does not say how long any transcript or other copy of the command is kept.

Supporting quotations

Roku uses these voice commands to effectuate their instructions or requests, and the voice recordings that Roku collects are immediately deleted thereafter.

Qualifications & exceptions

• Voice commands collected from the covered children's parts of the Roku Services.
• The recordings are deleted after the command is used to effectuate the instruction or request.

Not stated here

• The notice does not say whether a transcript or non-recording copy of the command persists after the recording is deleted.

Use & Processing · Company practice

Identifiers and usage data serve listed internal operations

Roku uses the persistent identifiers and usage information from those parts of the Roku Services for the internal operations it lists: maintaining or analyzing how the Roku Services function; performing network communications; authenticating users or personalizing content; serving contextual advertising or capping advertising frequency; protecting the security or integrity of the user or the Roku Services; and ensuring legal or regulatory compliance. The list is the stated set of purposes for this data, and the notice separately restricts using it for anything else.

Supporting quotations

Roku uses these persistent identifiers and usage information for the following internal operations:

Maintaining or analyzing the functioning of the Roku Services;

Performing network communications;

Authenticating users of, or personalizing the content on, the Roku Services;

Serving contextual advertising on the Roku Services or capping the frequency of advertising;

Protecting the security or integrity of the user or the Roku Services; and

Ensuring legal or regulatory compliance.

Qualifications & exceptions

• Only for the internal operations listed in the notice.
• Applies to persistent identifiers and usage information, not to voice commands.

Cross-references

• contrast (model-proposed): Behavioral advertising is excluded for this data — The internal-operations list permits contextual advertising and frequency capping, while the next sentence excludes behavioral advertising and other non-internal uses of the same identifiers and usage information; together they mark the advertising boundary the notice draws.

Use & Processing · Company commitment

Behavioral advertising is excluded for this data

Roku states that it prevents these persistent identifiers and usage information from being used or disclosed for purposes that are not internal operations, giving behavioral advertising as an example, through internal policies and logic-based restrictions in its internal systems. It illustrates the limit by saying its behavioral advertising systems are configured to exclude personal information collected from those parts of the Roku Services. Contextual advertising and frequency capping stay within the permitted internal operations.

Supporting quotations

Roku prevents these persistent identifiers and usage information from being used or disclosed for other purposes that do not constitute internal operations (such as behavioral advertising) through internal policies and logic-based restrictions in its internal systems.

For example, Roku's behavioral advertising systems are configured to exclude personal information collected from those parts of the Roku Services described above.

Qualifications & exceptions

• Covers persistent identifiers and usage information from the covered parts; the notice does not attach this limit to voice commands.
• Enforcement is described as internal policies and logic-based system restrictions, not a stated external audit.

Cross-references

• contrast (model-proposed): Identifiers and usage data serve listed internal operations — The internal-operations list permits contextual advertising and frequency capping, while the next sentence excludes behavioral advertising and other non-internal uses of the same identifiers and usage information; together they mark the advertising boundary the notice draws.

Retention & Deletion · Company practice

Identifiers and usage data kept as long as needed

Roku retains the persistent identifiers and usage information for as long as needed to fulfill the internal operations purposes for which it was collected, unless the law requires it to keep the data for a longer period. The notice states no fixed period and no specific legal retention requirement.

Supporting quotations

Roku retains these persistent identifiers and usage information for as long as needed to fulfill the internal operations purposes for which the data was collected unless we are required by law to retain it for a longer period.

Qualifications & exceptions

• Only as long as needed for the internal operations purposes.
• Longer retention only where the law requires it.

Not stated here

• No fixed retention period or named statutory requirement is stated.

Sharing & Disclosure · Restriction or exception

Third-party services fall outside this notice

The notice says its disclosure does not apply to the practices of third-party services, including Third-Party Channels, that may be accessed through the Roku Services. It directs the reader to review those services' applicable terms and policies, including their data collection and use practices, to judge whether they are appropriate for the child. The notice describes no third-party practice itself and does not define the term 'Third-Party Channels'.

Supporting quotations

The disclosure in this notice does not apply to the practices of any third-party services (including Third-Party Channels) that may be accessed through the Roku Services.

Before using any third-party service, you should review the applicable terms and policies to determine their appropriateness for your child, including the service’s data collection and use practices.

Qualifications & exceptions

• Only third-party services that may be accessed through the Roku Services.
• The review of terms is advised before using the third-party service.

Not stated here

• The notice does not define 'Third-Party Channels' or say whether Roku's own collection from activity inside such a channel is treated as third-party practice.

Legal Rights & Agreement Rules · Procedure

Questions go to Roku's Legal Department

For questions about Roku's processing of personal information described in this Children's Privacy Notice, the notice directs the reader to contact Roku at Attention: Legal Department, Roku, Inc., 1173 Coleman Avenue, San Jose, CA 95110, privacy@roku.com, or 408.556.9391. The notice gives these details as a contact route for questions about the processing it describes.

Supporting quotations

If you have any questions about our processing of personal information described in this Children’s Privacy Notice, you can contact Roku at:

Attention: Legal Department

Roku, Inc.

1173 Coleman Avenue

San Jose, CA 95110

privacy@roku.com

408.556.9391

Qualifications & exceptions

• Questions about the processing described in this notice.