Roku Privacy Policy

Data Access & Collection · Context

The policy treats information about your household as information about you

When Roku says who the information is about, it defines "you" to include "your household" as well as the individual consumer. Practically, information gathered from a shared device or a shared account sits inside this policy as information about you, even when it came from someone else in the home; the policy does not offer the household member their own separate treatment in this sentence.

Supporting quotations

collect about consumers (“you” and “your household”)

Qualifications & exceptions

• The definition appears where the policy describes what Roku collects about consumers, and is not repeated as a separate choice or control for other household members.

Not stated here

• This text does not say how Roku separates one household member's information from another's.

Data Access & Collection · Company practice

Signing up for a Roku account means giving Roku identifying details

For a Roku account, Roku asks for "information such as your name, email address, postal address, telephone number, birth date, tax ID (for users in certain countries), gender and other demographic information". The list is introduced with "such as", so it is illustrative rather than a closed inventory, and the tax ID is collected conditionally, only from users in certain countries. The same collection stretches beyond the account itself: Roku says it may also collect similar contact information when someone registers for another product or service offered through Roku, giving blog-post copies as the example.

Supporting quotations

When you sign up for a Roku account, we ask for information such as your name, email address, postal address, telephone number, birth date, tax ID (for users in certain countries), gender and other demographic information.

Qualifications & exceptions

• "information such as" presents the list as examples, not an exhaustive set of what registration can involve.
• Tax ID is described as applying to users in certain countries, which the text does not name.
• Similar contact information may also be collected for registrations other than the Roku account itself, such as registering for blog-post copies.

Not stated here

• Which countries trigger the tax ID request is not stated here, nor is the reason it is needed.

Data Access & Collection · Company practice

Roku also collects your purchase information when a partner merchant sells to you

The merchant passage ends with a flat statement: "Roku will also collect your purchase information." The word "also" matters — the merchant's own collection does not replace Roku's, so a purchase made from a participating merchant produces information at both the seller and Roku. The sentence gives no purpose or limit for Roku's collection here.

Supporting quotations

Roku will also collect your purchase information.

Qualifications & exceptions

• Stated as an addition to the merchants' and their partners' own collection, not instead of it.

Not stated here

• This sentence does not say what Roku does with purchase information or how long it keeps it.

Data Access & Collection · Company practice

Text-messaging and email product features let Roku collect your contact details

If a user turns on product features that involve text messaging or email, Roku says it "will also collect the phone number, email address, and any other contact information you provide to communicate with you". The purpose is stated in the same breath as a limit: communication is to follow "your account preferences and device or service settings". "Any other contact information you provide" keeps the set open rather than fixed.

Supporting quotations

If you use product features with text messaging or email, Roku will also collect the phone number, email address, and any other contact information you provide to communicate with you in accordance with your account preferences and device or service settings.

Qualifications & exceptions

• Triggered by using product features with text messaging or email.
• The stated purpose, communicating with you, is expressly tied to the account preferences, device or service settings in force.

Not stated here

• "Any other contact information you provide" is not enumerated, and the document does not say it all serves communication.

Data Access & Collection · Company practice

Contacting Roku means Roku keeps what you send, including message contents

Direct contact produces information at Roku: "we will receive additional information you provide, such as your name, email address and phone number, and the contents of any message or attachments that you send to us". The reach is the whole submission, not just the identifiers — attachments included. Roku adds that information is also provided when someone subscribes to marketing communications or asks for content such as product information, whitepapers and reports.

Supporting quotations

If you contact us directly, we will receive additional information you provide, such as your name, email address and phone number, and the contents of any message or attachments that you send to us.

Qualifications & exceptions

• Triggered by contacting Roku directly; also covers subscribing to marketing communications or requesting content such as whitepapers and reports.

Not stated here

• How long Roku keeps support messages and attachments is not stated in this passage.

Data Access & Collection · Company practice

Roku receives messages you send other users on services like Roku Community

Messages between users are not private from Roku: "If you message other users on the Roku Services like Roku Community, we will receive the contents of those messages." The example given is Roku Community, but the wording reaches messaging features across the Roku Services, and unlike the support-message sentence this one attaches no purpose or retention limit.

Supporting quotations

If you message other users on the Roku Services like Roku Community, we will receive the contents of those messages.

Qualifications & exceptions

• Covers messages to other users on the Roku Services; Roku Community is given as the example.

Not stated here

• The text does not say what Roku does with these messages or how long they are kept.

Data Access & Collection · Company practice

Roku collects personal information about people who are not the account holder

Under "Information You Provide About Others", Roku states "We also collect the personal information of other people". The examples are a user's own referrals and gifts: giving Roku the names or email addresses of family and friends, or the postal addresses and other contact details of gift recipients. The reach extends further for smart home products — "Personal information about other people may be collected and used when you use Roku Smart Home devices and services", and "your Smart Home Devices may capture videos, images or voice content of other individuals". Someone who is not a user therefore ends up in Roku's records through another person's invitation, purchase or device, and nothing here gives that person a notice or a choice of their own.

Supporting quotations

Information You Provide About Others

We also collect the personal information of other people.

For instance, your Smart Home Devices may capture videos, images or voice content of other individuals.

Qualifications & exceptions

• Applies to information the user supplies about other people, plus what Roku Smart Home devices and services capture.
• Captured content is named as videos, images and voice content of other individuals.

Not stated here

• The document does not say how people featured in another user's smart home recordings are notified or can ask for removal.

Data Access & Collection · Company practice

Files you upload to the Roku Services are collected by Roku

If a user uploads files, or makes them reachable from the Roku Services, Roku collects them: photos, videos and audio files are named, introduced by "including", so other file types are within reach too. The trigger is the user's own choice to upload or make the file accessible, not something Roku does silently.

Supporting quotations

Roku collects and may review (for example, for content moderation purposes) any files, including photos, videos or audio files, that you choose to upload or make accessible to the Roku Services.

Qualifications & exceptions

• Applies to any files "that you choose to upload or make accessible to the Roku Services"; photos, videos and audio files are examples rather than the whole set.

Not stated here

• How long uploaded files stay with Roku is not stated here.

Data Access & Collection · Company practice

Roku receives identifying details about the devices and network you use

Automatically, Roku may receive a long list about the browsers and devices used to reach the internet and its own services: device types and models, unique identifiers including advertising identifiers (for Roku Devices, the device's Advertising Identifier), MAC address, IP address, operating system type and version, browser type and language, Wi-Fi network name and connection data, and information about other devices on the same network. The network reach is wide: it pulls in the name of the user's own Wi-Fi network and data about other devices sharing it.

Supporting quotations

We may receive information about the browsers and devices you use to access the Internet, including our services, such as device types and models, unique identifiers including advertising identifiers (e.g., for Roku Devices, the Advertising Identifier associated with that device), MAC address, IP address, operating system type and version, browser type and language, Wi-Fi network name and connection data, and information about other devices connected to the same network.

Qualifications & exceptions

• Collected automatically when you access the internet including Roku's own services, not only from Roku Devices.
• "Unique identifiers including advertising identifiers" names the Roku Device Advertising Identifier specifically.

Not stated here

• How long this device and network information is kept is not stated here.

Data Access & Collection · Company practice

Wi-Fi routers belonging to other people around you are also gathered

Beyond the user's own network, Roku says "We may also gather the WiFi MAC addresses, country code, and broadcast signal strengths of your router and other Wi-Fi routers in your area." The reach therefore extends past the household's own equipment to nearby routers and the people who own them; the data points are identifiers (MAC addresses), coarse location context (country code) and radio measurements (signal strengths).

Supporting quotations

We may also gather the WiFi MAC addresses, country code, and broadcast signal strengths of your router and other Wi-Fi routers in your area.

Qualifications & exceptions

• Covers your own router and other Wi-Fi routers within range of the device.

Not stated here

• The text does not say what this neighbouring-router information is used for.

Data Access & Collection · Company practice

Roku Devices report retailer, quality measures, error logs and device status

For the Roku Devices themselves, Roku may collect "the name of the retailer to whom your Roku Device was shipped, various quality measures, error logs, software version numbers, and device status (including the status of battery-powered accessories)". Several of these are diagnostics rather than user content, but the retailer name ties the purchase channel to the device, and "various quality measures" is open-ended — the document does not say what they measure.

Supporting quotations

For Roku Devices, we may also collect the name of the retailer to whom your Roku Device was shipped, various quality measures, error logs, software version numbers, and device status (including the status of battery-powered accessories).

Qualifications & exceptions

• Applies to Roku Devices specifically rather than to browsers generally.
• Battery-powered accessories are included through device status.

Not stated here

• "Various quality measures" is not defined or enumerated.

Data Access & Collection · Company practice

Turning on Bluetooth records connection details over time

Bluetooth collection is described conditionally: "When you enable Bluetooth while using Roku Services, we may collect your Bluetooth usage, such as connection quality, the name of the device connected to your Roku Device, and the start and stop time of your connection." The start and stop times mean Roku records when connections happened, not just that they exist, and the named other endpoint is whatever device was paired.

Supporting quotations

When you enable Bluetooth while using Roku Services, we may collect your Bluetooth usage, such as connection quality, the name of the device connected to your Roku Device, and the start and stop time of your connection.

Qualifications & exceptions

• Triggered by enabling Bluetooth while using Roku Services; it is not described as running when Bluetooth is off.

Not stated here

• Whether this covers every paired device type is not stated.

Data Access & Collection · Company practice

Roku and its business partners track online activity over time and across services

Roku states plainly that "We and our business partners, such as analytics and advertising partners, collect information about your online activities over time and across different online services." Two things make this broader than on-device collection: it accumulates over time, and it crosses services rather than stopping at Roku's own. The technologies named as the means are cookies, pixel tags, web beacons, SDK and device identifiers, used to recognize the user, count visits and popular features, and measure browsing.

Supporting quotations

We and our business partners, such as analytics and advertising partners, collect information about your online activities over time and across different online services.

Qualifications & exceptions

• Carried out by Roku together with business partners named as analytics and advertising partners.
• Ranges over activity on other online services, not only the Roku Services.

Not stated here

• No mechanism for limiting this cross-service tracking is offered in this passage.

Data Access & Collection · Company practice

Roku emails track whether you opened them

In the same breath as cookies, Roku says "we and our third-party service providers use e-mail tracking technologies to monitor the success of e-mail campaigns", giving open tracking as the example — whether an email was opened, and how many emails in a campaign were opened. So interaction with Roku's own marketing email feeds back to Roku, and third-party service providers are part of that measurement.

Supporting quotations

we and our third-party service providers use e-mail tracking technologies to monitor the success of e-mail campaigns (for example, to track whether an email was opened and record how many e-mails in a campaign were opened).

Qualifications & exceptions

• Done by Roku and third-party service providers together, for monitoring email campaign success.

Not stated here

• Whether opting out of marketing email is possible is not addressed in this passage.

Data Access & Collection · Company practice

Your browsing, search and voice interactions are recorded

Roku receives "information about your interactions with the Roku Services", enumerated as browsing history, search history, search results, audio information when voice-enabled features are used, interactions with content and ads, interactions with other platform features, and settings and preferences. Voice use is explicitly included through "audio information", so speaking to a voice feature produces retained data in the same way clicking does.

Supporting quotations

We receive information about your interactions with the Roku Services, such as your browsing history, search history, search results, audio information when you use voice-enabled features, interactions with content and ads, interactions with other features of our platform, and settings and preferences.

Qualifications & exceptions

• Includes audio information captured when voice-enabled features are used.
• Covers interactions with advertisements as well as with content.

Not stated here

• Retention of search and voice interaction records is not stated here.

Data Access & Collection · Company practice

Which apps you open and what you stream are measured, including time spent

When streaming services are used on a Roku device, or Roku's Channels are used on other devices, Roku may collect "information about your activities, like the apps you install or access (including usage statistics such as what apps you access, the time you access them, and how long you interact with them), and information about the videos and other content you select and stream within these streaming services." The measurements include the hour of access and the duration of interaction, so usage is timestamped, and the reach covers both directions: third-party streaming on a Roku device, and Roku's own Channels on someone else's device.

Supporting quotations

we may collect information about your activities, like the apps you install or access (including usage statistics such as what apps you access, the time you access them, and how long you interact with them), and information about the videos and other content you select and stream within these streaming services.

Qualifications & exceptions

• Covers streaming services accessed on a Roku device and Roku's Channels accessed on other devices.
• Usage statistics include the time of access and how long you interact.

Not stated here

• Whether this reaches content watched inside every third-party streaming app is left to the general wording "videos and other content you select and stream".

Data Access & Collection · Company practice

The Smart TV Experience's ACR can capture what you watch across connected devices

On devices running Roku's operating system with the Smart TV Experience, the user "has the option to enable Automatic Content Recognition (“ACR”) technology to collect information about what you watch or access". The examples named are programs, video games, ads and channels viewed or accessed, together with the date, time and duration of the viewing or access, and Roku may also collect additional information about streamed videos and content. The capture path is not limited to streaming: it runs via the TV's antenna, cable box, game console, media player or other connected devices, so it can read what is playing through the television from outside sources. The document also warns that what is collected while ACR is on is not fixed: the data collected may vary depending on the particular device and when the setting was enabled, with device-specific detail left to the Privacy > Smart TV Experience section of that device's settings menu.

Supporting quotations

you have the option to enable Automatic Content Recognition (“ACR”) technology to collect information about what you watch or access

The data collected while the Smart TV Experience is enabled may vary depending on your particular device and when you enabled the Smart TV Experience.

Qualifications & exceptions

• Applies while ACR is enabled on a device with Roku's operating system and the Smart TV Experience.
• Captures viewing or access via antenna, cable box, game console, media player or other connected devices, not only through apps.
• The data collected varies by particular device and by when the setting was enabled.

Not stated here

• What a given device collects specifically is not stated here; Roku points to that device's settings menu for it.

Data Access & Collection · Restriction or exception

Turning ACR off stops that technology but not Roku's other collection

The opt-out is narrower than it first appears: if the setting is disabled, Roku will not use ACR on the user's devices, but Roku still receives information about interactions and streaming activities on those devices through other methods. Roku spells out what continues — viewing or interactions with third-party streaming apps, The Roku Channel, the Streaming Store, the Roku Home screen, ads enabled by Roku (including ads inside third-party streaming apps on the device), and whatever third-party streaming app providers pass to Roku. So disabling ACR removes one collection method without making viewing activity invisible to Roku.

Supporting quotations

If you disable this setting, Roku will not use ACR on your devices, but Roku still receives information about your interactions and streaming activities on your devices through other methods.

Qualifications & exceptions

• The limit is to ACR itself, expressly stated as Roku will not use ACR on the user's devices.
• Interaction and streaming information continues through other methods, including third-party streaming apps, Roku's own channels and store, the home screen, Roku-enabled ads, and data third-party app providers send.

Not stated here

• The document does not enumerate every other method it relies on once ACR is off.

Data Access & Collection · Company practice

Using the Roku Media Player tells Roku about your local files

Playing local content through Roku's own player is itself a source: using the Roku Media Player to view video or photo files or listen to music files means Roku will collect data about the files viewed within it, such as codecs, and other metadata of the local files played through the player. The named data is technical metadata about the user's own files rather than the content itself, and it is tied to playing them through the player.

Supporting quotations

Roku will collect data about the files viewed within the Roku Media Player, such as codecs, and other metadata of the local files you play through the Roku Media Player.

Qualifications & exceptions

• Triggered by using the Roku Media Player for video, photo or music files.

Not stated here

• Other metadata beyond codecs is not enumerated.

Data Access & Collection · Company practice

Using the mobile app as a remote reveals the identifier of the device it controls

Remote-control use carries its own collection: using Roku's mobile app as a remote control, or otherwise to interact with another device, means Roku will collect the device identifier of the device the app interacts with. The data point is the other device's identifier, so the app's use links the phone to whichever device it is driving.

Supporting quotations

we will collect the device identifier of the device with which the mobile app interacts.

Qualifications & exceptions

• Triggered by using the mobile app as a remote or otherwise interacting with another device.

Not stated here

• How long the identifier is kept, and whether it is linked to the account, are not stated here.

Data Access & Collection · Company practice

Interacting with an ad gives Roku delivery data and whatever the ad asks for

Through its advertising services Roku receives information about when, where and how an ad was displayed, other contextual information about when the ad was served, the user's clicks, and any other information the user provides when interacting with the ad. The document's own examples show how far that last phrase reaches: a phone number given to receive a coupon code, a zip code given to find an advertiser's closest locations, and information about purchases made through shoppable ads. Roku adds that the same receipt happens when it provides advertising services inside Third-Party Channels.

Supporting quotations

Through Roku’s advertising services, we receive information about when, where and how an ad was displayed, and other contextual information about when the ad was served, and your clicks and any other information you provide when you interact with the ad

when Roku provides advertising services in Third-Party Channels, Roku receives information related to the ad.

Qualifications & exceptions

• Covers ad delivery and contextual information plus interaction data, including details volunteered to an ad.
• Also applies when Roku provides advertising services in Third-Party Channels.

Not stated here

• Any other information the user provides is open-ended; what a given ad asks for depends on that advertiser.

Data Access & Collection · Company practice

Where Roku supplies ads or measurement, it receives activity data off its own devices

Roku's reach extends to properties it does not run: visiting websites, apps, streaming services and connected devices to which Roku provides advertising or measurement and analytics services can put that visit in Roku's hands — it may receive information about the user's activities, including content viewed, the date and time of visits, how the user interacts with those websites, apps and devices, and how the user interacts and responds to ads. Browsing another company's site can therefore generate records at Roku where Roku's advertising or measurement technology is present.

Supporting quotations

we may receive information about your activities, including information related to content you view, the date and time of your visits, how you interact with these websites, apps and devices, and how you interact and respond to ads.

Qualifications & exceptions

• Applies to third-party websites, apps, streaming services and connected devices where Roku provides advertising or measurement and analytics services.
• Stated permissively as "may receive", not as a guarantee for every visit.

Not stated here

• The document does not name the sites, apps or devices, or say how Roku learns about a visit there.

Data Access & Collection · Company practice

Advertising partners may hand Roku identifying details about you

The off-device passage adds a conditional flow of much richer data: if Roku's advertising partners choose to disclose it, Roku will also receive information connected to the user's interactions with those ads or advertisers, such as name, email address, phone number, postal address, IP address, user agent and other online identifiers that the advertiser has associated with the user. Whether this happens is left to the partner rather than to Roku or the user, and Roku directs the reader to the advertisers' own privacy policies for their handling.

Supporting quotations

we will also receive other information connected to your interactions with these ads or advertisers, such as your name, email address, phone number, postal address, IP address, user agent and other online identifiers

Qualifications & exceptions

• Depends on the advertising partner choosing to disclose it; not described as automatic.
• Tied to the user's interactions with those ads or advertisers.

Not stated here

• Which partners do this, and what the advertiser itself does with the data, are not stated in this document.

Data Access & Collection · Company practice

Data about you is taken in from other sources to tailor your experience and ads

Part I closes its collection section with a general statement: Roku collects information about the user from other sources for the purposes described in Part II of this policy, including to provide a tailored user experience and advertising that may be of interest. The purposes are said to be the ones Part II lists, so this sentence does not restate them, and the sources themselves follow as examples rather than a closed register.

Supporting quotations

We collect information about you from other sources for the purposes described in Part II of this Privacy Policy, including to provide you a tailored user experience and advertising that may be of interest to you.

Qualifications & exceptions

• Purposes are the ones Part II describes; this sentence names tailoring and advertising rather than restating Part II.
• The sources that follow are introduced as examples.

Not stated here

• Part II's full purpose list is not repeated here, so the complete set of uses is not stated in this passage.

Data Access & Collection · Company practice

Companies that distribute Roku's Channels send Roku identifiers and your actions

One outside source is whoever carries Roku's Channels: if a user accesses Roku's Channels on media streaming devices, mobile devices, or websites from other companies, those companies may provide Roku with IP addresses, device IDs or other unique identifiers, and user actions that relate to Roku. Watching Roku's own channel on another company's hardware or site therefore produces data at Roku from that distributor, and the text states it permissively.

Supporting quotations

if you access Roku’s Channels on media streaming devices, mobile devices, or websites from other companies, they may provide us IP addresses, device IDs or other unique identifiers, and user actions that relate to Roku.

Qualifications & exceptions

• Applies when Roku's Channels are accessed through another company's device or website.
• Supplied permissively: those companies "may provide" the data.

Not stated here

• Which distributors do this and when is not stated.

Data Access & Collection · Company practice

Third-Party Channels pass identifiers and account status back to Roku

The app publishers inside the Roku Services are another source: third parties whose services are available through the Roku Services may provide IP addresses, device IDs or other unique identifiers, account status and services, with Third Party Channels given as the example. Installing or using another company's channel can therefore result in that company reporting identifiers and account-related facts to Roku.

Supporting quotations

Third Party Channels may provide us IP addresses, device IDs or other unique identifiers, account status, services.

Qualifications & exceptions

• Applies to third parties whose services run through the Roku Services; Third Party Channels are the named example.

Not stated here

• What the source text means by "account status, services" is not explained further.

Data Access & Collection · Company practice

Linking Alexa, Google Home or Google Photos sends their data to Roku

Linking an outside account to a Roku account opens a channel from that provider: linking a third-party account such as Alexa, Google Home or Google Photos means Roku will receive data from that provider such as voice command transcriptions for voice assistant accounts and photo album metadata for photo storage accounts. The examples are specific rather than incidental, and the wording "such as" leaves room for more.

Supporting quotations

Roku will receive data from that provider such as voice command transcriptions (in the case of voice assistant accounts), and photo album metadata (in the case of photo storage accounts).

Qualifications & exceptions

• Triggered by linking a third-party account such as Alexa, Google Home or Google Photos.
• Voice command transcriptions come from voice assistant accounts and photo album metadata from photo storage accounts.

Not stated here

• How long Roku keeps linked-account data, and whether unlinking stops further receipt, are not stated here.

Data Access & Collection · Company practice

Data brokers and ad partners supply profiles including interests, household and health data

Among the named sources are data providers, ad networks and other advertising partners, who may provide IP addresses, device IDs, other unique identifiers, and information about the user such as online activities, interests, household information, demographics, health and wellness. The last items matter: attributes Roku did not observe itself arrive from outside, the list reaches health and wellness, and nothing here limits the categories or says how the brokers obtained them.

Supporting quotations

These business partners may provide IP addresses, device IDs, other unique identifiers, and information about you, such as information about your online activities, interests, household information, demographics, health, and wellness.

Qualifications & exceptions

• Provided by data providers, ad networks and other advertising partners, permissively ("may provide").

Not stated here

• The document does not say how those partners gathered the data, or restrict the categories beyond "such as".

Data Access & Collection · Company practice

Entering a sweepstakes on another platform means Roku receives your entry

Promotions hosted elsewhere still produce data at Roku: entering a Roku sweepstakes or contest hosted on a third-party platform means Roku will receive information about the entrant and the information provided to enter. Both identity and entry content come back, and because the platform is someone else's, the entry may also be governed by that platform's own terms.

Supporting quotations

we will receive information about you and the information you provide to enter.

Qualifications & exceptions

• Applies to sweepstakes or contests hosted on a third-party platform rather than on Roku properties.

Not stated here

• What identity data is received, and whether it is shared back with the host platform, is not stated.

Data Access & Collection · Company practice

Someone else referring you puts your information at Roku

Roku may receive your personal information from other individuals if they have referred you as described under Part I, Section A(5), above. This is the mirror image of the referral and permission statements earlier in Part I: the person doing the referring supplies details about someone else, and that person's information arrives at Roku without having asked for it. Roku does not here say that the referred person is notified, or that Roku verifies consent.

Supporting quotations

We may also receive your personal information from other individuals if they have referred you as described under Part I, Section A(5), above.

Qualifications & exceptions

• Triggered by another individual referring the person, the case Part I Section A(5) describes.

Not stated here

• Whether the referred person is told, or asked, is not stated in this text.

Data Access & Collection · Company practice

Streaming providers and their ad partners can read your Roku Devices and usage

Installing, accessing or using a streaming service through Roku — a Third-Party Channel, a third-party streaming service inside The Roku Channel — can put the user in direct contact with that provider, and the provider and its advertising partners may collect information about the user's Roku Devices, including unique identifiers, IP addresses and device settings such as language and time zone, together with usage of their service. Usage is spelled out as videos, ads and other content searched, selected and streamed, and audio information when voice-enabled features are used. The routes are broader than installing: conducting a voice search inside one of those services, and reaching the apps through hbbtv features on a Roku TV model's remote, are both named.

Supporting quotations

the provider and its advertising partners may collect information about your Roku Devices (including unique identifiers, IP addresses, and device settings like language and time zone) and your usage of their service

Qualifications & exceptions

• Collected by the streaming provider and its advertising partners, not by Roku itself.
• Reaches voice searches inside those services and access through hbbtv features on a Roku TV model's remote.
• Named data includes unique identifiers, IP addresses, device settings such as language and time zone, searched/selected/streamed content, and audio from voice-enabled features.

Not stated here

• This sentence does not say what the provider or its partners do with the data afterwards.

Data Access & Collection · Restriction or exception

A streaming app can collect even while it is installed but not playing

Roku states that these streaming services may collect some of the information described in this section when their app is installed but not actively streaming. The trigger is therefore installation alone, not playback: having the app on the device is enough for at least some of the described collection. The text limits this to "some of the information" without identifying which items.

Supporting quotations

These streaming services may collect some of the information described in this section when their app is installed but not actively streaming.

Qualifications & exceptions

• Applies when the app is installed but not actively streaming, so playback is not required.
• Limited to "some of the information described in this section", which the text does not itemise.

Not stated here

• Which data points continue while an app is merely installed is not stated.

Data Access & Collection · Company practice

Subscribing hands your registration and interaction data to the streaming provider

Alongside what providers collect themselves, Roku says these streaming services may also receive the user's Roku account registration information, if the user chooses to subscribe to their service, and information about the user's interactions with the Roku Services, as further described in Part III, B below. The registration part is conditioned on the user's own subscription choice; the interaction part points to Part III, B rather than being restated here, and Roku directs the reader to the provider's privacy policy for how that provider uses it.

Supporting quotations

These streaming services may also receive your Roku account registration information (if you choose to subscribe to their service), and information about your interactions with the Roku Services, as further described in Part III, B below.

Qualifications & exceptions

• Registration information is received only if the user chooses to subscribe to that provider's service.
• Interaction information is cross-referenced to Part III, B, which this sentence does not restate.

Not stated here

• What Part III, B provides for is not supplied in this passage.

Data Access & Collection · Company practice

Linking a non-Roku service gives it details about you and your device

Linking a Roku Device or Roku account to a non-Roku service, the examples being Google Photos, Alexa and Google Assistant, is described as choosing to have that provider collect information about the user and the device. The named items go beyond identifiers: device type and name, device identifiers, device state such as whether it is powered on or playing video, the names of installed streaming service apps, and even the names of the device's HDMI ports. Roku frames it as the user's choice and refers to the providers' own privacy policies for their use.

Supporting quotations

you are choosing to have the provider of that service collect information about you and your Roku Device, which may include device type and name, device identifiers, its state (e.g., whether the device is powered on, whether the device is playing video), names of installed streaming service apps, and the names of your device HDMI ports.

Qualifications & exceptions

• Triggered by linking a Roku Device or Roku account to a non-Roku service such as Google Photos, Alexa or Google Assistant.
• Named data includes device state (powered on, playing video), installed streaming app names and HDMI port names.

Not stated here

• Roku does not here say what the linked provider does with the data, or what unlinking stops.

Data Access & Collection · Company practice

Using someone else's platform to reach Roku's services puts you in their hands too

Accessing Roku services such as Roku's Channels on platforms, online services and devices operated by other companies — third-party smart TVs, streaming devices, mobile phones or websites — means those companies may also collect information about the user. Roku tells the reader to review those companies' privacy policies, both for their own use and for their access to data by them and their partners.

Supporting quotations

these companies may also collect information about you.

Qualifications & exceptions

• Applies when Roku services are accessed through another company's platform, online service or device.
• Stated permissively as "may also collect", and those companies' own privacy policies govern their use.

Not stated here

• Which platforms or companies, and what they collect, are not named.

Data Access & Collection · Company practice

Roku combines what it has about you and derives further inferences

Part II opens with a general statement of what Roku does with what it collects: it may combine the information it collects about the user and use it to derive other information and inferences about the user, and it then uses both the collected and the derived information for the purposes that follow. Combination across sources and derivation of new inferences are therefore stated openly as the basis for every listed use.

Supporting quotations

We may combine the information we collect about you and use it to derive other information and inferences about you.

Qualifications & exceptions

• Applies to information Roku collected about the user, combined together.
• Derived information and inferences are stated to be used for the same listed purposes as collected information.

Not stated here

• What kinds of inferences Roku draws are not enumerated in this sentence.

Data Access & Collection · Company practice

In the Kids & Family areas Roku collects voice commands, persistent identifiers and usage

Roku describes special privacy protections in parts of the Roku Services such as the Kids & Family section in The Roku Channel and the Kids section of the Roku Channel Store, and states what it collects when any user interacts with those parts: any voice commands a user chooses to submit, persistent identifiers, and usage information about interactions with those parts. The protections described apply to the data, not to a verified child's identity — it is collected from any user who interacts with those areas.

Supporting quotations

Roku collects the following personal information: any voice commands that a user chooses to submit, persistent identifiers, and usage information about the interactions with those parts of the Roku Services.

Qualifications & exceptions

• Applies in the named Kids & Family and Kids sections of The Roku Channel and the Roku Channel Store.
• Applies to any user interacting with those parts, not only to children.
• Voice commands are limited to ones the user chooses to submit.

Not stated here

• Whether the same protections apply elsewhere in the Roku Services is not stated.

Data Access & Collection · Company practice

The state notice restates that Roku also gathers information about you from outside sources

Restating Part I for the state notice, Roku says it collects Personal Information when the user provides it or automatically through the Roku Services, and may also obtain information from other sources. The listed sources mirror earlier sections: third-party platforms, devices and services used to reach the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers including payment service providers, providers of accounts linked to the Roku account, participating merchants and their partners, and other users who referred the person or provided their information. The list makes explicit what Part I implied — data about a user can originate almost entirely elsewhere.

Supporting quotations

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• Also covers information the user provides directly or that is collected automatically through the Roku Services.
• The source list includes linked-account providers, merchants and other users who referred or provided the person's information.

Not stated here

• No categories or limits are attached to what each source may supply.

Data Access & Collection · Context

The California table begins with identifiers as a category collected, processed and disclosed

The disclosure table lists categories of Personal Information collected, processed and disclosed to third parties, together with the purposes and the recipients for cross-context behavioral advertising or sale. Its first row is identifiers, given as device identifiers, internet protocol addresses, browser cookies and other unique online identifiers. The row sits in a table whose other columns — purposes and sharing or sale recipients — are filled in by the rows that follow in this notice.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

Qualifications & exceptions

• Named items are device identifiers, IP addresses, browser cookies and other unique online identifiers.
• Listed in a table covering categories collected and processed, purposes, and sharing or sale for cross-context behavioral advertising.

Not stated here

• This row does not itself state the purposes or recipients; those appear in the table's other columns.

Data Access & Collection · Context

Account registration information is its own category, including payment card details

The table's second category is account registration information, defined as name, address, email address, telephone number, and payment method and card number. Listing payment method and card number as part of registration information brings payment credentials into the category list for the state notice.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

Qualifications & exceptions

• Category B in the California table.
• Named fields include payment method and card number.

Not stated here

• The table does not state retention or deletion for this category.

Data Access & Collection · Context

Characteristics protected under California or federal law form a category

Category C is characteristics of protected classifications under California or federal law — for example characteristics such as race, religion or age. Roku lists this category among those collected, processed and disclosed, and the same purposes column follows it.

Supporting quotations

C. Characteristics of protected classifications under California or Federal law

Qualifications & exceptions

• Category C in the California table.
• Framed by reference to California or federal protected classifications.

Not stated here

• The document does not say what specific characteristics Roku holds, or how they are obtained.

Data Access & Collection · Context

Purchase and consumption histories form another listed category

Category D is commercial information, including records of personal property, products or services purchased, obtained or considered, and other purchasing or consuming histories or tendencies. It therefore covers not only completed purchases but things considered, so browsing and shopping behaviour can fall in this row.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Qualifications & exceptions

• Category D in the California table.
• Reaches products or services considered as well as purchased, obtained or subscribed to.

Not stated here

• How inferences about tendencies are drawn is not stated.

Data Access & Collection · Context

Browsing, search and interaction with websites, apps and ads form a listed category

Category E is internet or other electronic network activity information, described as including browsing history, search history and information about a consumer's interaction with an internet website, application or advertisement. The category is therefore defined by behaviour across services and ads, not by a fixed list of fields.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

Qualifications & exceptions

• The list is introduced as non-exhaustive ("including, but not limited to").
• Interaction with an advertisement is itself listed as part of the category.

Data Access & Collection · Context

General geolocation is a listed category, down to designated market area and postal code

Category F is general geolocation data, described as general location and geographical information including designated market area, country, province, state, city and postal code. The examples show household-level rather than precise coordinates, and the row is placed separately from the device and network categories already described.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

Qualifications & exceptions

• The category is described as general location, and every listed example is a coarse geographic unit.

Not stated here

• The table does not say here whether precise device location is collected outside this category.

Data Access & Collection · Context

Precise geolocation is listed as a category separate from general location

Category G is stated only as "Precise geolocation". The table places it in its own row, distinct from the general geolocation row that lists designated market area, country, province, state, city and postal code, so the notice separates coarse location from precise location rather than treating them as one category.

Supporting quotations

G. Precise geolocation

Qualifications & exceptions

• The source gives no examples or definition of precise location in this row.

Data Access & Collection · Context

Audio, visual, thermal and similar information is a listed category

Category H covers audio, electronic, visual, thermal, olfactory or similar information. The category is described by the type of sensor data rather than by the product feature that captures it, and it sits between precise location and inferences in the table.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

Qualifications & exceptions

• "Similar information" extends the category beyond the four named types.

Not stated here

• The notice does not say here which Roku features produce each listed type of information.

Data Access & Collection · Context

Professional or employment information is a listed category

Category J is professional or employment information. The row is stated as a bare category name, and its purposes column begins with understanding and improving the services and personalising the experience. The table treats workplace information as part of the same state-notice disclosure scheme as the consumer categories above it.

Supporting quotations

J. Professional or Employment Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• The source gives no examples or definition of professional or employment information.

Not stated here

• The notice does not say here when Roku collects employment information about a consumer.

Data Access & Collection · Context

Education information is listed as its own category

Category K is education information. The source states the category name without examples, and the row carries its own purposes and advertising recipients, so schooling information sits alongside the consumer categories in the same notice.

Supporting quotations

K. Education Information

Qualifications & exceptions

• The source gives no examples or definition of education information.

Not stated here

• The notice does not say here how education information is obtained from a Roku user.

Data Access & Collection · Context

Racial origin, religion, union membership and health form a sensitive category

Category L is Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, and health and wellness information. The row groups these sensitive attributes together as one category, separate from the identifiers, activity, location and inference rows.

Supporting quotations

L. Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, health, and wellness information

Qualifications & exceptions

• The category is defined by what the information reveals, not by the source it came from.

Cross-references

• contrast (model-proposed): The Iowa and Utah sensitive row is narrower: race, religion, health and wellness — Both charts have a separate sensitive-attribute row, but the attribute lists differ: the California row names racial or ethnic origin, religious or philosophical beliefs, union membership, health and wellness, while the Iowa and Utah row names racial or ethnic origin, religious beliefs, health and wellness. Philosophical beliefs and union membership appear only in the California version.

Data Access & Collection · Context

Log-in credentials, government identifiers and others' messages form the last category

Category M covers information that reveals three things: account log-in details, financial account, debit or credit card numbers together with any required security or access code, password or credential; social security, driver's license, state identification card or passport numbers; and the content of consumer emails, texts and messages where Roku is not the intended recipient. The third prong concerns messages addressed to someone else.

Supporting quotations

M. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

Qualifications & exceptions

• Card numbers count only in combination with a required security or access code, password or credential.
• The message-content prong is limited to messages where Roku is not the intended recipient.

Data Access & Collection · Company practice

Roku says it does not collect genetic, biometric, neural or citizenship information

In the same 12-month statement that accompanies the categories chart, Roku says it does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status. The sentence is a list of excluded data types stated as a company practice, placed directly after the statement that every chart category has been collected, processed, disclosed, shared and sold.

Supporting quotations

Over the past 12 months, Roku has collected, processed, disclosed, shared for cross-context behavioral advertising, and sold each of the categories of Personal Information as described in the chart above. Roku does not have actual knowledge that it sells Personal Information or shares for cross-context behavioral advertising the Personal Information of consumers under 16 years of age. Roku does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status.

Qualifications & exceptions

• The statement is an assertion about what Roku does not collect, not a list of categories withheld from sale or sharing.
• It sits in the state notice, next to the categories chart, rather than in the general collection part.

Not stated here

• Whether the exclusion covers information about a user's citizenship held for account or tax purposes is not stated.

Data Access & Collection · Context

The general state part restates direct and third-party collection sources

The sources item says Personal Information comes from the user directly or automatically through the Roku Services, and may also be obtained from third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers including payment service providers, providers of accounts linked to the Roku account, participating merchants and their partners, and other users who referred the person or provided the information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services. We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• Third-party collection is stated as something Roku may do, not as a fixed list of every source.
• Other users are a source where they referred the person or provided the information.

Data Access & Collection · Context

Identifiers head the general state chart, from device IDs to cookies and IP addresses

Category A is identifiers, described as including device identifiers, internet protocol addresses, browser cookies and other unique online identifiers. The examples are network- and device-level identifiers rather than account details, which appear in the next row.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

Qualifications & exceptions

• The list is introduced as inclusive rather than exhaustive.

Data Access & Collection · Context

Account registration information follows identifiers, opening with the service purpose

Category B is account registration information: name, address, email address, telephone number, and payment method and card number. Its purposes column opens with providing and maintaining the Roku Services and fulfilling requests or orders, and the row continues in the same chart below.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

Qualifications & exceptions

• Payment method and card number are treated as part of registration information.
• The purposes list quoted here is only the row's opening entry.

Data Access & Collection · Context

Protected-classification characteristics count only where they are not sensitive data

Category C is characteristics of protected classifications under Federal law, but only to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws. The row therefore carves out information that a state law treats as sensitive, leaving the residual protected-classification data in this category rather than in the sensitive row below it.

Supporting quotations

C. Characteristics of protected classifications under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws

Qualifications & exceptions

• The category is limited to the extent the information is not sensitive data under applicable state privacy laws.

Not stated here

• The chart does not say which characteristics fall inside and outside the sensitive-data definitions of each state.

Data Access & Collection · Context

Commercial information follows in the general state chart

Category D is commercial information, including records of personal property, products or services purchased, obtained or considered, and other purchasing or consuming histories or tendencies. The wording matches the California chart's category D, so the general state notice covers the same purchasing and consideration records.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Qualifications & exceptions

• Items merely considered are included alongside purchases.

Data Access & Collection · Context

Internet activity is category E in the general state chart

Category E is internet or other electronic network activity information, including browsing history, search history, and information about a consumer's interaction with an internet website, application or advertisement. The wording matches the California chart's category E.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

Qualifications & exceptions

• The examples are introduced as non-exhaustive.

Data Access & Collection · Context

General geolocation opens the location rows of the general state chart

Category F is general geolocation data, described as general location and geographical information including designated market area, country, province, state, city and postal code. Its purposes column opens with service operation and order fulfilment, improvement with advertising correlations and new products, personalisation, and targeted advertising with measurement and reporting.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

Qualifications & exceptions

• Every listed example is a coarse geographic unit rather than a coordinate.

Data Access & Collection · Context

Credentials and others' messages are used for service, enforcement and fraud only

Category L covers information that reveals account log-in or financial account and card numbers with security codes, passwords or credentials; social security, driver's license, state identification card or passport numbers; and the content of consumer emails, texts and messages where Roku is not the intended recipient. The purposes column has three entries: service operation and order fulfilment, enforcement of terms and legal obligations, and fraud prevention. The disclosure column names service providers and vendors, Roku's affiliates, law enforcement or others involved in legal, security and safety matters, processes and requests, and merchants and their partners the person transacts with on the Roku Services, and the row lists no recipients in the sold column.

Supporting quotations

L. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Service providers and vendors.

Our affiliates.

Law enforcement or others involved with legal, security and safety matters, processes and requests.

Merchants and their partners you transact with on Roku Services.

Qualifications & exceptions

• Card numbers count only in combination with a required security or access code, password or credential.
• Message content is limited to messages where Roku is not the intended recipient.
• No advertising, marketing, personalisation or metrics purpose appears in this row.
• The row's sale column contains no entries.

Data Access & Collection · Context

The Iowa and Utah part repeats the collection-sources statement

The Iowa and Utah part restates the sources item: Personal Information is collected directly or automatically through the Roku Services and may also be obtained from third-party platforms, devices and services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers including payment service providers, linked-account providers, merchants and their partners, and other users who referred the person or supplied the information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services. We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• Third-party sources are described as possibilities rather than an exhaustive list.

Data Access & Collection · Context

The Iowa and Utah chart's protected-classification row has no sensitive-data carve-out

Category C in this chart is characteristics of protected classifications under Federal law, stated without the earlier general-part qualifier that limits the category to data that is not sensitive data under applicable state privacy laws. The row's purposes column opens with service operation and order fulfilment and continues below in the same chart.

Supporting quotations

C. Characteristics of protected classifications under Federal law

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

Qualifications & exceptions

• The row is stated without the "to the extent they are not sensitive data" wording used in the general part's category C.
• The purposes list continues below the quoted entries.

Not stated here

• The chart does not say whether the sensitive-data carve-out applies in Iowa and Utah by operation of the listed state laws.

Data Access & Collection · Context

Internet activity in the Iowa and Utah chart opens with service, improvement and personalisation

Category E is internet or other electronic network activity information, including browsing history, search history and information about a consumer's interaction with an internet website, application or advertisement. The row's purposes column opens with service operation and order fulfilment, improvement with advertising correlations and new products, and personalisation with suggested content; further purposes follow in the same chart.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• The examples of the category are introduced as non-exhaustive.
• The purposes list continues below the quoted entries.

Data Access & Collection · Context

Precise geolocation stays narrow in the Iowa and Utah chart too

For category G the chart lists only three purposes: service operation and order fulfilment, personalisation of the experience, and fraud prevention including click fraud. Its disclosure column begins with service providers and vendors and Roku's affiliates, and the row continues below without advertising entries in the columns read here.

Supporting quotations

G. Precise geolocation

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Service providers and vendors

Our affiliates

Qualifications & exceptions

• No advertising or marketing purpose appears in the entries quoted.
• The row continues below the quoted entries.

Not stated here

• Whether the remainder of the row adds advertising recipients is not visible in these entries.

Data Access & Collection · Context

The Iowa and Utah sensitive row is narrower: race, religion, health and wellness

Category L in this chart is Personal Information that reveals racial or ethnic origin, religious beliefs, health, and wellness information. Unlike the California chart's category L, it does not name philosophical beliefs or union membership. Its purposes column lists improvement with advertising correlations, personalisation, targeted advertising with measurement and reporting, marketing, business metrics and enforcement.

Supporting quotations

L. Personal Information that reveals racial or ethnic origin, religious beliefs, health, and wellness information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• The category omits philosophical beliefs and union membership that the California chart includes.
• Targeted advertising and marketing are listed for these attributes in this chart.

Not stated here

• The chart does not say why the attribute list differs between the two state parts.

Cross-references

• contrast (model-proposed): Racial origin, religion, union membership and health form a sensitive category — Both charts have a separate sensitive-attribute row, but the attribute lists differ: the California row names racial or ethnic origin, religious or philosophical beliefs, union membership, health and wellness, while the Iowa and Utah row names racial or ethnic origin, religious beliefs, health and wellness. Philosophical beliefs and union membership appear only in the California version.

Data Access & Collection · Context

Credentials and others' messages carry service, enforcement and fraud purposes here

Category M covers information that reveals account log-in or financial account and card numbers with security codes, passwords or credentials; social security, driver's license, state identification card or passport numbers; and the content of consumer emails, texts and messages where Roku is not the intended recipient. The purposes column has three entries, and the disclosure column names service providers and vendors, Roku's affiliates, law enforcement or others involved in legal, security and safety matters, processes and requests, and merchants and their partners the person transacts with on the Roku Services. The row has no entries under the targeted-advertising-or-sale header.

Supporting quotations

M. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Service providers and vendors

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Card numbers count only in combination with a required security or access code, password or credential.
• Message content is limited to messages where Roku is not the intended recipient.
• The targeted-advertising-or-sale column contains no entries for this row.