Roku Privacy Policy

Retention & Deletion · Company commitment

Voice recordings from Kids areas are deleted once the request is carried out

Roku uses any submitted voice commands to effectuate the instruction or request, and states that the voice recordings it collects are immediately deleted thereafter. The retention for recordings is therefore tied to carrying out the request, and it is stated as deletion rather than a period of storage; the remaining persistent identifiers and usage information are then governed separately by the internal-operations list.

Supporting quotations

Roku uses these voice commands to effectuate their instructions or requests, and the voice recordings that Roku collects are immediately deleted thereafter. Roku uses these persistent identifiers and usage information for the following internal operations:

Qualifications & exceptions

• Applies to voice recordings collected in the protected parts of the Roku Services.
• Deletion is stated as immediate, after the instruction or request is effectuated.

Not stated here

• "Immediately" is not defined, and this document gives no verification mechanism.

Retention & Deletion · Company practice

Kids-area identifiers are kept as long as the internal operations need them

Roku retains these persistent identifiers and usage information for as long as needed to fulfill the internal operations purposes for which the data was collected, unless it is required by law to retain it longer. The retention rule is purpose-linked rather than a fixed period, with a legal-requirement exception that can extend it.

Supporting quotations

Roku retains these persistent identifiers and usage information for as long as needed to fulfill the internal operations purposes for which the data was collected unless we are required by law to retain it for a longer period.

Qualifications & exceptions

• Retention runs for as long as needed for the internal operations purposes.
• The stated exception is a legal requirement to keep it longer.

Not stated here

• No maximum period is given, and which legal requirements could extend it are not named.

Retention & Deletion · Company practice

Retention runs as long as Roku's business purposes or the law require

Roku's retention rule is purpose-linked: personal information may be retained for as long as needed to fulfil legitimate business purposes, including the uses listed under Part II, or for a period specifically required or allowed by applicable regulations or laws. No fixed period is given, so retention can continue while a business purpose does, and the lawful allowance can extend it further.

Supporting quotations

Personal information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in “Information Usage” under Part II, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• Tied to legitimate business purposes including the Part II uses.
• Can also rest on a period specifically required or allowed by applicable law.

Not stated here

• No maximum or review period is stated.

Retention & Deletion · Company practice

State-notice retention lasts while its Section 2 purposes or the law require it

In the state notice, Roku says Personal Information may be kept as long as needed for legitimate business purposes, including the purposes outlined in Section 2 of the same Supplemental U.S. State Law Privacy Notice, or for a period specifically required or allowed by applicable regulations or laws. The state notice therefore measures retention against its own purposes section rather than naming a fixed period.

Supporting quotations

Retention

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• The retention period is defined by business purposes and by law, not by a stated number of months or years.
• "Required or allowed" brings permissive statutory retention periods into scope as well as mandatory ones.

Not stated here

• No concrete retention period is given in this item.

Retention & Deletion · Company commitment

Roku will not reidentify third-party deidentified data where the law forbids it

The general state part states that if Roku processes deidentified data provided by third parties, it will not attempt to reidentify it where applicable law prohibits doing so. The commitment is conditional on the legal prohibition, so it does not describe a general promise never to reidentify.

Supporting quotations

If we process deidentified data provided to us by third parties, we will not attempt to reidentify it if we are prohibited by applicable law from doing so.

Qualifications & exceptions

• The undertaking is limited to deidentified data provided by third parties.
• It applies only where applicable law prohibits reidentification.

Not stated here

• The notice does not describe any technical or contractual safeguards against reidentification.

Retention & Deletion · Company practice

The general state part repeats the retention rule with the same Section 2 reference

The general state part's retention item repeats that Personal Information may be retained as long as needed for legitimate business purposes, including the purposes outlined in Section 2 of the Supplemental U.S. State Law Privacy Notice, or for a period specifically required or allowed by applicable regulations or laws. The same phrasing recurs across the notice's state parts, and each occurrence points back to its own Section 2 rather than to a fixed schedule.

Supporting quotations

Retention

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• No fixed retention period is stated.
• Both mandatory and permissive statutory periods are included.

Retention & Deletion · Context

The Iowa and Utah part closes its chart with a retention item

The chart is followed by a Retention item label, and the retention statement that follows repeats the same business-purpose and statutory-period formula used in the notice's other state parts.

Supporting quotations

Retention

Qualifications & exceptions

• The item is a label whose statement follows in the next section of the notice.

Retention & Deletion · Company practice

The Iowa and Utah retention statement repeats the business-purpose formula

The statement under the retention item says Personal Information may be retained as long as needed to fulfil legitimate business purposes, including the purposes outlined in Section 2 of the Supplemental U.S. State Law Privacy Notice, or for a period specifically required or allowed by applicable regulations or laws. No fixed period or schedule is given for Iowa or Utah residents.

Supporting quotations

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• The reference point is the purposes listed in Section 2 of the same notice.
• Both mandatory and permissive statutory periods are included.

Not stated here

• No concrete retention period is stated.