Roku Privacy Policy

Legal Rights & Agreement Rules · Context

Policy states a last-updated date of July 1, 2026

Roku presents this Privacy Policy with a single version label above the policy text: "Last updated: July 1, 2026". The document identifies that date as the point the policy text was last revised; it does not here use the words "effective" or name a different coming-into-force date. Anything Roku says in this policy is therefore the practice the publisher described as current on that date, and later changes would appear in a later update of this page rather than in this text.

Supporting quotations

Last updated: July 1, 2026

Qualifications & exceptions

• The policy labels the date "Last updated", not as an effective date, and no separate coming-into-force date is stated with it.

Not stated here

• Whether this version became operative on July 1, 2026 rather than being published later is not stated in this text.

Legal Rights & Agreement Rules · Restriction or exception

"Roku" excludes the Frndly TV and TOH companies from the companies this policy covers

The policy is issued by Roku, Inc. together with its affiliated companies, but it names an exclusion: Frndly TV, Inc., TOH Intermediate Holdings, LLC and their subsidiaries are left out of the group the words "Roku", "we" and "us" mean. The exclusion is stated in the same sentence that defines who collects the information, so it shapes every statement that follows: a practice described here is a practice of Roku, Inc. and its other affiliates, and nothing in this text tells a reader what Frndly TV or the TOH companies do with information they hold. The rest of the sentence also fixes the audience, using "consumers" and defining you as both the individual and the household.

Supporting quotations

This Privacy Policy describes the information that Roku, Inc. and our affiliated companies other than Frndly TV, Inc., TOH Intermediate Holdings, LLC and the subsidiaries of Frndly TV, Inc. and TOH Intermediate Holdings, LLC (“Roku”, “we”, or “us”) collect about consumers (“you” and “your household”) and how we use and disclose that information.

Roku Privacy Policy

Qualifications & exceptions

• The exclusion covers Frndly TV, Inc., TOH Intermediate Holdings, LLC and the subsidiaries of both, not all affiliates.

Not stated here

• This text does not say how Frndly TV, Inc. or TOH Intermediate Holdings, LLC handle information about their own users.

Data Access & Collection · Context

The policy treats information about your household as information about you

When Roku says who the information is about, it defines "you" to include "your household" as well as the individual consumer. Practically, information gathered from a shared device or a shared account sits inside this policy as information about you, even when it came from someone else in the home; the policy does not offer the household member their own separate treatment in this sentence.

Supporting quotations

collect about consumers (“you” and “your household”)

Qualifications & exceptions

• The definition appears where the policy describes what Roku collects about consumers, and is not repeated as a separate choice or control for other household members.

Not stated here

• This text does not say how Roku separates one household member's information from another's.

Legal Rights & Agreement Rules · Context

What counts as the "Roku Services" under this policy

The policy applies to information Roku collects through the "Roku Services", and it lists what that covers: Roku's websites, Roku players and Roku TV models plus other products built on Roku's streaming platform or operating system (including Roku Smart Home devices, speakers and other audio-enabled products) as "Roku Devices", the mobile apps (named as the Roku Mobile App and Roku Smart Home App), Roku-branded services named as the Roku Media Player, The Roku Channel and Roku Sports Channel, Roku's advertising services, Roku emails and newsletters, and Roku's accounts on third-party social networking sites. Two reach points matter for a reader: Roku's own Channels count even when you reach them through someone else's platform or service, and devices count even when a different company built them on Roku's platform or operating system.

Supporting quotations

This Privacy Policy applies to information collected by Roku through the “Roku Services”, which includes: Roku's websites (“Roku Sites”), Roku’s products and certain other products utilizing Roku’s streaming platform or operating systems (including Roku players, Roku TV models, Roku Smart Home devices, speakers and other audio-enabled products) (collectively, “Roku Devices”), Roku’s mobile apps (including the Roku Mobile App and Roku Smart Home App), Roku branded services like the Roku Media Player, The Roku Channel and Roku Sports Channel, including when you access them from third-party platforms and services (“Roku’s Channels”), Roku’s advertising services, Roku emails and newsletters, and Roku’s accounts on third-party social networking sites.

Qualifications & exceptions

• "Roku's Channels" includes use through third-party platforms and services, so the policy follows the channel rather than the device it is watched on.
• "Roku Devices" reaches certain other companies' products that use Roku's streaming platform or operating system, not only products Roku sells itself.

Not stated here

• The text does not name which other companies' products use Roku's platform or operating system.

Legal Rights & Agreement Rules · Restriction or exception

This policy does not cover third-party channel providers or other platform operators

Roku states plainly that its own Privacy Policy does not cover "the actions and privacy practices of these app providers, platform operators or their partners", meaning third-party channel publishers and the companies operating platforms where Roku's Channels appear. Whoever runs the app governs that relationship, and Roku directs the reader to those companies' own privacy policies instead of describing them here.

Supporting quotations

This Privacy Policy does not cover the actions and privacy practices of these app providers, platform operators or their partners.

Qualifications & exceptions

• The exclusion is limited to app providers, platform operators and their partners; acts Roku describes as its own elsewhere in this document remain within the policy.

Not stated here

• The document does not list any third-party channel provider or platform operator by name.

Sharing & Disclosure · Company practice

Third-party channel providers and their ad partners may collect from your Roku Device

Using a Third-Party Channel means dealing with that app's publisher directly, and Roku says that publisher "and its analytics and advertising partners may collect information from your Roku Device, including your device identifier and how you use their services". The collection runs from the device itself, so it happens whether or not Roku is involved in it; the named data points are the device identifier and the user's use of that app. The same passage notes that hybrid broadcast broadband (hbbtv) channels may exist in some regions, so which third-party channels are even reachable depends on where the viewer is.

Supporting quotations

the app provider and its analytics and advertising partners may collect information from your Roku Device, including your device identifier and how you use their services.

Qualifications & exceptions

• This follows from installing, accessing or streaming the third-party app; the document ties it to that interaction.
• Availability of hbbtv channels, one category of Third-Party Channel, varies by region.

Not stated here

• The text does not say what the app provider or its partners do with the device identifier afterwards, or list the analytics and advertising partners.

Data Access & Collection · Company practice

Signing up for a Roku account means giving Roku identifying details

For a Roku account, Roku asks for "information such as your name, email address, postal address, telephone number, birth date, tax ID (for users in certain countries), gender and other demographic information". The list is introduced with "such as", so it is illustrative rather than a closed inventory, and the tax ID is collected conditionally, only from users in certain countries. The same collection stretches beyond the account itself: Roku says it may also collect similar contact information when someone registers for another product or service offered through Roku, giving blog-post copies as the example.

Supporting quotations

When you sign up for a Roku account, we ask for information such as your name, email address, postal address, telephone number, birth date, tax ID (for users in certain countries), gender and other demographic information.

Qualifications & exceptions

• "information such as" presents the list as examples, not an exhaustive set of what registration can involve.
• Tax ID is described as applying to users in certain countries, which the text does not name.
• Similar contact information may also be collected for registrations other than the Roku account itself, such as registering for blog-post copies.

Not stated here

• Which countries trigger the tax ID request is not stated here, nor is the reason it is needed.

Sharing & Disclosure · Company practice

Subscribing to another company's streaming service can pass your registration details to it

When a subscription is bought through the Roku Services to a streaming service run by someone else — on Roku Sites, inside The Roku Channel, or for a Third-Party Channel on the device — Roku says "your Roku account registration information may need to be collected by the provider to create an account with that service". The recipient is that provider, acting to set up its own account for you, and Roku points to that provider's privacy policy rather than describing its handling. The wording is permissive ("may need to be"), not a flat statement that it always happens.

Supporting quotations

your Roku account registration information may need to be collected by the provider to create an account with that service.

Qualifications & exceptions

• Only when you subscribe to another provider's streaming service through the Roku Services, and only "as may be needed" to create the account.
• The receiving provider's own privacy policy governs what it does afterwards; this document does not describe it.

Not stated here

• Which registration fields are actually transferred, and whether the transfer is optional, are not stated here.

Charges & Financial Obligations · Company practice

Adding a payment method or ordering from Roku adds payment and shipping details

Attaching a credit card or other payment method to the account, or placing an order with Roku, brings in "your payment information and billing address", and for a product purchase Roku may also need "other information that may be needed to complete your purchase, such as your shipping address, tax ID or other verification information". The trigger is either adding a stored payment method or actually ordering, and the second category is open-ended, tied to completing the purchase rather than listed exhaustively.

Supporting quotations

When you add a credit card or payment method to your account or place an order with us, we will also collect your payment information and billing address, and if you make a product purchase, other information that may be needed to complete your purchase, such as your shipping address, tax ID or other verification information.

Qualifications & exceptions

• Triggered by adding a payment method to the account or placing an order, not by browsing.
• Extra verification data is framed as what "may be needed to complete your purchase", leaving the set open.

Not stated here

• What counts as "other verification information" beyond shipping address and tax ID is not defined.

Sharing & Disclosure · Company practice

Participating merchants and their partners collect your details, including for unnamed "other purposes"

Roku connects users with merchants selling goods on the Roku Services through features such as shoppable ads. Interacting with a shoppable ad, or choosing to buy from these merchants, means "they and their partners will also collect information about you", named as name, billing address, shipping address, email address, phone number and payment information. The stated uses are processing the transaction, fulfilling and shipping the order — and then "and for other purposes", which the document leaves open, so the permitted uses extend past the ones enumerated. Roku tells the reader to review those companies' privacy policies, which this document does not substitute for.

Supporting quotations

they and their partners will also collect information about you or information you provide, including your name, billing address, shipping address, email address, phone number, and payment information, to process the transaction, fulfill and ship your order, and for other purposes.

Qualifications & exceptions

• Applies when you interact with a shoppable ad or choose to purchase from participating merchants on the Roku Services.
• Roku's own collection of purchase information sits alongside this and is stated separately.

Not stated here

• The "other purposes" for which merchants and their partners may use the information are not listed in this text.

Data Access & Collection · Company practice

Roku also collects your purchase information when a partner merchant sells to you

The merchant passage ends with a flat statement: "Roku will also collect your purchase information." The word "also" matters — the merchant's own collection does not replace Roku's, so a purchase made from a participating merchant produces information at both the seller and Roku. The sentence gives no purpose or limit for Roku's collection here.

Supporting quotations

Roku will also collect your purchase information.

Qualifications & exceptions

• Stated as an addition to the merchants' and their partners' own collection, not instead of it.

Not stated here

• This sentence does not say what Roku does with purchase information or how long it keeps it.

Data Access & Collection · Company practice

Text-messaging and email product features let Roku collect your contact details

If a user turns on product features that involve text messaging or email, Roku says it "will also collect the phone number, email address, and any other contact information you provide to communicate with you". The purpose is stated in the same breath as a limit: communication is to follow "your account preferences and device or service settings". "Any other contact information you provide" keeps the set open rather than fixed.

Supporting quotations

If you use product features with text messaging or email, Roku will also collect the phone number, email address, and any other contact information you provide to communicate with you in accordance with your account preferences and device or service settings.

Qualifications & exceptions

• Triggered by using product features with text messaging or email.
• The stated purpose, communicating with you, is expressly tied to the account preferences, device or service settings in force.

Not stated here

• "Any other contact information you provide" is not enumerated, and the document does not say it all serves communication.

Account & Service Control · User right or choice

You can change Roku communication preferences in the account, the mobile app or some device settings

Roku gives the user a standing control: "You may modify your Roku communication preferences and settings at any time" by updating the information in the Roku account, in the relevant Roku mobile app, or "certain device settings". The control is offered at any time and through several places, but the last route is qualified — only some device settings carry it, and the text says which only by pointing to Roku's online support documentation.

Supporting quotations

You may modify your Roku communication preferences and settings at any time by updating this information in your Roku account, in the relevant Roku mobile app, or certain device settings.

Qualifications & exceptions

• Available at any time, rather than only at signup or on request.
• Device-level controls are described as "certain device settings", so not every device setting necessarily carries the control.

Not stated here

• Which device settings include the control is left to Roku's online support documentation, which is not part of this document.

Data Access & Collection · Company practice

Contacting Roku means Roku keeps what you send, including message contents

Direct contact produces information at Roku: "we will receive additional information you provide, such as your name, email address and phone number, and the contents of any message or attachments that you send to us". The reach is the whole submission, not just the identifiers — attachments included. Roku adds that information is also provided when someone subscribes to marketing communications or asks for content such as product information, whitepapers and reports.

Supporting quotations

If you contact us directly, we will receive additional information you provide, such as your name, email address and phone number, and the contents of any message or attachments that you send to us.

Qualifications & exceptions

• Triggered by contacting Roku directly; also covers subscribing to marketing communications or requesting content such as whitepapers and reports.

Not stated here

• How long Roku keeps support messages and attachments is not stated in this passage.

Data Access & Collection · Company practice

Roku receives messages you send other users on services like Roku Community

Messages between users are not private from Roku: "If you message other users on the Roku Services like Roku Community, we will receive the contents of those messages." The example given is Roku Community, but the wording reaches messaging features across the Roku Services, and unlike the support-message sentence this one attaches no purpose or retention limit.

Supporting quotations

If you message other users on the Roku Services like Roku Community, we will receive the contents of those messages.

Qualifications & exceptions

• Covers messages to other users on the Roku Services; Roku Community is given as the example.

Not stated here

• The text does not say what Roku does with these messages or how long they are kept.

Data Access & Collection · Company practice

Roku collects personal information about people who are not the account holder

Under "Information You Provide About Others", Roku states "We also collect the personal information of other people". The examples are a user's own referrals and gifts: giving Roku the names or email addresses of family and friends, or the postal addresses and other contact details of gift recipients. The reach extends further for smart home products — "Personal information about other people may be collected and used when you use Roku Smart Home devices and services", and "your Smart Home Devices may capture videos, images or voice content of other individuals". Someone who is not a user therefore ends up in Roku's records through another person's invitation, purchase or device, and nothing here gives that person a notice or a choice of their own.

Supporting quotations

Information You Provide About Others

We also collect the personal information of other people.

For instance, your Smart Home Devices may capture videos, images or voice content of other individuals.

Qualifications & exceptions

• Applies to information the user supplies about other people, plus what Roku Smart Home devices and services capture.
• Captured content is named as videos, images and voice content of other individuals.

Not stated here

• The document does not say how people featured in another user's smart home recordings are notified or can ask for removal.

Legal Rights & Agreement Rules · Company practice

Getting permission from people you give Roku data about is left to you

Right after saying it collects personal information about other people, Roku states "We rely on you to obtain any required permissions in advance to allow us to collect their personal information." Roku does not describe itself as checking that consent exists or as notifying those people; the step is placed on the user who supplies the referral, the gift address or runs the smart home device. "Any required permissions" points outside this document to whatever consent a given situation requires, and "in advance" makes it a precondition rather than something Roku cures later.

Supporting quotations

We rely on you to obtain any required permissions in advance to allow us to collect their personal information.

We also collect the personal information of other people.

Personal information about other people may be collected and used when you use Roku Smart Home devices and services.

Qualifications & exceptions

• Spoken about the people whose information the user supplies — invitees, gift recipients and individuals captured by smart home devices.
• The permission is due "in advance", before the collection.

Not stated here

• This text does not say what happens if the user does not obtain permission, nor which permissions are "required".

Data Access & Collection · Company practice

Files you upload to the Roku Services are collected by Roku

If a user uploads files, or makes them reachable from the Roku Services, Roku collects them: photos, videos and audio files are named, introduced by "including", so other file types are within reach too. The trigger is the user's own choice to upload or make the file accessible, not something Roku does silently.

Supporting quotations

Roku collects and may review (for example, for content moderation purposes) any files, including photos, videos or audio files, that you choose to upload or make accessible to the Roku Services.

Qualifications & exceptions

• Applies to any files "that you choose to upload or make accessible to the Roku Services"; photos, videos and audio files are examples rather than the whole set.

Not stated here

• How long uploaded files stay with Roku is not stated here.

Use & Processing · Company practice

Uploaded files may be reviewed by Roku, content moderation given as the example

The same sentence says Roku "may review" uploaded files and gives content moderation as its example. "May" makes review discretionary rather than promised or excluded, and "for example" means content moderation is illustrative — the same review could serve other ends the document does not name. A user cannot tell from this sentence whether a particular upload will be looked at, by whom, or how.

Supporting quotations

may review (for example, for content moderation purposes)

Qualifications & exceptions

• Review is discretionary ("may review") and the stated reason is only an example.

Not stated here

• The document does not say who reviews files, whether automated means are used, or what follows from a review.

Sharing & Disclosure · Company practice

Comments and reviews you post may be visible to the public

Roku invites comments, reviews and feedback on Roku Sites — developer forums, blogs, message boards, community pages — and on its third-party social networking accounts, and warns that "Information posted in these venues may be available to the public." The consequence is that anything written there leaves the boundary of Roku's own systems; because the venues include third-party social networks, the audience is not only Roku users.

Supporting quotations

Information posted in these venues may be available to the public.

Qualifications & exceptions

• Reaches comments, reviews and feedback on Roku Sites and Roku's third-party social networking accounts.
• Availability is stated as "may be available to the public", depending on the venue.

Not stated here

• The document does not say which posts are public and which are not.

Legal Rights & Agreement Rules · Restriction or exception

Once you make something public, Roku says it cannot control who sees it

Roku disclaims responsibility for information the user makes public: "We cannot control the privacy or security of information you choose to make public." The disclaimer is about control after publication, not about collecting — it sits alongside the reminder to weigh one's own privacy needs and those of others before posting. Read with the "available to the public" sentence, the practical result is that a public post is outside Roku's protection, and no withdrawal or deletion right is offered here.

Supporting quotations

We cannot control the privacy or security of information you choose to make public.

Qualifications & exceptions

• Limited to information the user chooses to make public.
• The disclaimer covers privacy and security of that information, not its collection by Roku.

Not stated here

• Whether a user can later remove a public post is not stated in this passage.

Data Access & Collection · Company practice

Roku receives identifying details about the devices and network you use

Automatically, Roku may receive a long list about the browsers and devices used to reach the internet and its own services: device types and models, unique identifiers including advertising identifiers (for Roku Devices, the device's Advertising Identifier), MAC address, IP address, operating system type and version, browser type and language, Wi-Fi network name and connection data, and information about other devices on the same network. The network reach is wide: it pulls in the name of the user's own Wi-Fi network and data about other devices sharing it.

Supporting quotations

We may receive information about the browsers and devices you use to access the Internet, including our services, such as device types and models, unique identifiers including advertising identifiers (e.g., for Roku Devices, the Advertising Identifier associated with that device), MAC address, IP address, operating system type and version, browser type and language, Wi-Fi network name and connection data, and information about other devices connected to the same network.

Qualifications & exceptions

• Collected automatically when you access the internet including Roku's own services, not only from Roku Devices.
• "Unique identifiers including advertising identifiers" names the Roku Device Advertising Identifier specifically.

Not stated here

• How long this device and network information is kept is not stated here.

Data Access & Collection · Company practice

Wi-Fi routers belonging to other people around you are also gathered

Beyond the user's own network, Roku says "We may also gather the WiFi MAC addresses, country code, and broadcast signal strengths of your router and other Wi-Fi routers in your area." The reach therefore extends past the household's own equipment to nearby routers and the people who own them; the data points are identifiers (MAC addresses), coarse location context (country code) and radio measurements (signal strengths).

Supporting quotations

We may also gather the WiFi MAC addresses, country code, and broadcast signal strengths of your router and other Wi-Fi routers in your area.

Qualifications & exceptions

• Covers your own router and other Wi-Fi routers within range of the device.

Not stated here

• The text does not say what this neighbouring-router information is used for.

Data Access & Collection · Company practice

Roku Devices report retailer, quality measures, error logs and device status

For the Roku Devices themselves, Roku may collect "the name of the retailer to whom your Roku Device was shipped, various quality measures, error logs, software version numbers, and device status (including the status of battery-powered accessories)". Several of these are diagnostics rather than user content, but the retailer name ties the purchase channel to the device, and "various quality measures" is open-ended — the document does not say what they measure.

Supporting quotations

For Roku Devices, we may also collect the name of the retailer to whom your Roku Device was shipped, various quality measures, error logs, software version numbers, and device status (including the status of battery-powered accessories).

Qualifications & exceptions

• Applies to Roku Devices specifically rather than to browsers generally.
• Battery-powered accessories are included through device status.

Not stated here

• "Various quality measures" is not defined or enumerated.

Data Access & Collection · Company practice

Turning on Bluetooth records connection details over time

Bluetooth collection is described conditionally: "When you enable Bluetooth while using Roku Services, we may collect your Bluetooth usage, such as connection quality, the name of the device connected to your Roku Device, and the start and stop time of your connection." The start and stop times mean Roku records when connections happened, not just that they exist, and the named other endpoint is whatever device was paired.

Supporting quotations

When you enable Bluetooth while using Roku Services, we may collect your Bluetooth usage, such as connection quality, the name of the device connected to your Roku Device, and the start and stop time of your connection.

Qualifications & exceptions

• Triggered by enabling Bluetooth while using Roku Services; it is not described as running when Bluetooth is off.

Not stated here

• Whether this covers every paired device type is not stated.

Inference & Profiling · Company practice

General location and ISP are inferred rather than collected directly

Roku says it may derive where you roughly are: "We may infer your general location information and internet service provider from the device information we collect", with IP address and MAC address given as the means of inferring a geographic area. This is inference from identifiers already gathered, described as "general" rather than precise, and it does not require the user to turn anything on.

Supporting quotations

We may infer your general location information and internet service provider from the device information we collect (for example, IP address and MAC address may be used to infer your geographic area).

Qualifications & exceptions

• Derived from device information, with IP address and MAC address named as the inputs to geographic inference.
• Described as "general location information", not precise location.

Not stated here

• Precision of the geographic area inferred, and retention of the inference, are not stated.

Account & Service Control · User right or choice

Location for Smart Home devices is presented as your choice to give

Alongside inference, Roku frames one location input as voluntary: "You may also choose to provide your location to enhance the functionality of your Smart Home Devices." The offer is tied to a benefit — making smart home features work better — and is worded as a choice, so it reads as opt-in rather than automatic.

Supporting quotations

You may also choose to provide your location to enhance the functionality of your Smart Home Devices.

Qualifications & exceptions

• Limited to location supplied for Smart Home device functionality.

Not stated here

• The document does not say what location granularity is shared or where the choice appears in the product.

Data Access & Collection · Company practice

Roku and its business partners track online activity over time and across services

Roku states plainly that "We and our business partners, such as analytics and advertising partners, collect information about your online activities over time and across different online services." Two things make this broader than on-device collection: it accumulates over time, and it crosses services rather than stopping at Roku's own. The technologies named as the means are cookies, pixel tags, web beacons, SDK and device identifiers, used to recognize the user, count visits and popular features, and measure browsing.

Supporting quotations

We and our business partners, such as analytics and advertising partners, collect information about your online activities over time and across different online services.

Qualifications & exceptions

• Carried out by Roku together with business partners named as analytics and advertising partners.
• Ranges over activity on other online services, not only the Roku Services.

Not stated here

• No mechanism for limiting this cross-service tracking is offered in this passage.

Use & Processing · Company practice

Tracking technologies serve service improvement, personalization and ad measurement

Roku gives the uses of those technologies: they "allow us to optimize the operation of our services, including by allowing us to ensure our services are functioning properly, improve and personalize the services, and to provide, personalize, and measure advertisements." The list runs from operations to advertising, so the same recognition data underlies both keeping the service working and measuring and personalizing ads; the document offers no separate control for the advertising half here.

Supporting quotations

These technologies allow us to optimize the operation of our services, including by allowing us to ensure our services are functioning properly, improve and personalize the services, and to provide, personalize, and measure advertisements.

Qualifications & exceptions

• Purposes range from checking services function properly to personalizing and measuring advertisements.

Not stated here

• The text does not separate advertising use from operational use for any control purpose.

Data Access & Collection · Company practice

Roku emails track whether you opened them

In the same breath as cookies, Roku says "we and our third-party service providers use e-mail tracking technologies to monitor the success of e-mail campaigns", giving open tracking as the example — whether an email was opened, and how many emails in a campaign were opened. So interaction with Roku's own marketing email feeds back to Roku, and third-party service providers are part of that measurement.

Supporting quotations

we and our third-party service providers use e-mail tracking technologies to monitor the success of e-mail campaigns (for example, to track whether an email was opened and record how many e-mails in a campaign were opened).

Qualifications & exceptions

• Done by Roku and third-party service providers together, for monitoring email campaign success.

Not stated here

• Whether opting out of marketing email is possible is not addressed in this passage.

Data Access & Collection · Company practice

Your browsing, search and voice interactions are recorded

Roku receives "information about your interactions with the Roku Services", enumerated as browsing history, search history, search results, audio information when voice-enabled features are used, interactions with content and ads, interactions with other platform features, and settings and preferences. Voice use is explicitly included through "audio information", so speaking to a voice feature produces retained data in the same way clicking does.

Supporting quotations

We receive information about your interactions with the Roku Services, such as your browsing history, search history, search results, audio information when you use voice-enabled features, interactions with content and ads, interactions with other features of our platform, and settings and preferences.

Qualifications & exceptions

• Includes audio information captured when voice-enabled features are used.
• Covers interactions with advertisements as well as with content.

Not stated here

• Retention of search and voice interaction records is not stated here.

Data Access & Collection · Company practice

Which apps you open and what you stream are measured, including time spent

When streaming services are used on a Roku device, or Roku's Channels are used on other devices, Roku may collect "information about your activities, like the apps you install or access (including usage statistics such as what apps you access, the time you access them, and how long you interact with them), and information about the videos and other content you select and stream within these streaming services." The measurements include the hour of access and the duration of interaction, so usage is timestamped, and the reach covers both directions: third-party streaming on a Roku device, and Roku's own Channels on someone else's device.

Supporting quotations

we may collect information about your activities, like the apps you install or access (including usage statistics such as what apps you access, the time you access them, and how long you interact with them), and information about the videos and other content you select and stream within these streaming services.

Qualifications & exceptions

• Covers streaming services accessed on a Roku device and Roku's Channels accessed on other devices.
• Usage statistics include the time of access and how long you interact.

Not stated here

• Whether this reaches content watched inside every third-party streaming app is left to the general wording "videos and other content you select and stream".

Data Access & Collection · Company practice

The Smart TV Experience's ACR can capture what you watch across connected devices

On devices running Roku's operating system with the Smart TV Experience, the user "has the option to enable Automatic Content Recognition (“ACR”) technology to collect information about what you watch or access". The examples named are programs, video games, ads and channels viewed or accessed, together with the date, time and duration of the viewing or access, and Roku may also collect additional information about streamed videos and content. The capture path is not limited to streaming: it runs via the TV's antenna, cable box, game console, media player or other connected devices, so it can read what is playing through the television from outside sources. The document also warns that what is collected while ACR is on is not fixed: the data collected may vary depending on the particular device and when the setting was enabled, with device-specific detail left to the Privacy > Smart TV Experience section of that device's settings menu.

Supporting quotations

you have the option to enable Automatic Content Recognition (“ACR”) technology to collect information about what you watch or access

The data collected while the Smart TV Experience is enabled may vary depending on your particular device and when you enabled the Smart TV Experience.

Qualifications & exceptions

• Applies while ACR is enabled on a device with Roku's operating system and the Smart TV Experience.
• Captures viewing or access via antenna, cable box, game console, media player or other connected devices, not only through apps.
• The data collected varies by particular device and by when the setting was enabled.

Not stated here

• What a given device collects specifically is not stated here; Roku points to that device's settings menu for it.

Data Access & Collection · Restriction or exception

Turning ACR off stops that technology but not Roku's other collection

The opt-out is narrower than it first appears: if the setting is disabled, Roku will not use ACR on the user's devices, but Roku still receives information about interactions and streaming activities on those devices through other methods. Roku spells out what continues — viewing or interactions with third-party streaming apps, The Roku Channel, the Streaming Store, the Roku Home screen, ads enabled by Roku (including ads inside third-party streaming apps on the device), and whatever third-party streaming app providers pass to Roku. So disabling ACR removes one collection method without making viewing activity invisible to Roku.

Supporting quotations

If you disable this setting, Roku will not use ACR on your devices, but Roku still receives information about your interactions and streaming activities on your devices through other methods.

Qualifications & exceptions

• The limit is to ACR itself, expressly stated as Roku will not use ACR on the user's devices.
• Interaction and streaming information continues through other methods, including third-party streaming apps, Roku's own channels and store, the home screen, Roku-enabled ads, and data third-party app providers send.

Not stated here

• The document does not enumerate every other method it relies on once ACR is off.

Data Access & Collection · Company practice

Using the Roku Media Player tells Roku about your local files

Playing local content through Roku's own player is itself a source: using the Roku Media Player to view video or photo files or listen to music files means Roku will collect data about the files viewed within it, such as codecs, and other metadata of the local files played through the player. The named data is technical metadata about the user's own files rather than the content itself, and it is tied to playing them through the player.

Supporting quotations

Roku will collect data about the files viewed within the Roku Media Player, such as codecs, and other metadata of the local files you play through the Roku Media Player.

Qualifications & exceptions

• Triggered by using the Roku Media Player for video, photo or music files.

Not stated here

• Other metadata beyond codecs is not enumerated.

Data Access & Collection · Company practice

Using the mobile app as a remote reveals the identifier of the device it controls

Remote-control use carries its own collection: using Roku's mobile app as a remote control, or otherwise to interact with another device, means Roku will collect the device identifier of the device the app interacts with. The data point is the other device's identifier, so the app's use links the phone to whichever device it is driving.

Supporting quotations

we will collect the device identifier of the device with which the mobile app interacts.

Qualifications & exceptions

• Triggered by using the mobile app as a remote or otherwise interacting with another device.

Not stated here

• How long the identifier is kept, and whether it is linked to the account, are not stated here.

Data Access & Collection · Company practice

Interacting with an ad gives Roku delivery data and whatever the ad asks for

Through its advertising services Roku receives information about when, where and how an ad was displayed, other contextual information about when the ad was served, the user's clicks, and any other information the user provides when interacting with the ad. The document's own examples show how far that last phrase reaches: a phone number given to receive a coupon code, a zip code given to find an advertiser's closest locations, and information about purchases made through shoppable ads. Roku adds that the same receipt happens when it provides advertising services inside Third-Party Channels.

Supporting quotations

Through Roku’s advertising services, we receive information about when, where and how an ad was displayed, and other contextual information about when the ad was served, and your clicks and any other information you provide when you interact with the ad

when Roku provides advertising services in Third-Party Channels, Roku receives information related to the ad.

Qualifications & exceptions

• Covers ad delivery and contextual information plus interaction data, including details volunteered to an ad.
• Also applies when Roku provides advertising services in Third-Party Channels.

Not stated here

• Any other information the user provides is open-ended; what a given ad asks for depends on that advertiser.

Data Access & Collection · Company practice

Where Roku supplies ads or measurement, it receives activity data off its own devices

Roku's reach extends to properties it does not run: visiting websites, apps, streaming services and connected devices to which Roku provides advertising or measurement and analytics services can put that visit in Roku's hands — it may receive information about the user's activities, including content viewed, the date and time of visits, how the user interacts with those websites, apps and devices, and how the user interacts and responds to ads. Browsing another company's site can therefore generate records at Roku where Roku's advertising or measurement technology is present.

Supporting quotations

we may receive information about your activities, including information related to content you view, the date and time of your visits, how you interact with these websites, apps and devices, and how you interact and respond to ads.

Qualifications & exceptions

• Applies to third-party websites, apps, streaming services and connected devices where Roku provides advertising or measurement and analytics services.
• Stated permissively as "may receive", not as a guarantee for every visit.

Not stated here

• The document does not name the sites, apps or devices, or say how Roku learns about a visit there.

Data Access & Collection · Company practice

Advertising partners may hand Roku identifying details about you

The off-device passage adds a conditional flow of much richer data: if Roku's advertising partners choose to disclose it, Roku will also receive information connected to the user's interactions with those ads or advertisers, such as name, email address, phone number, postal address, IP address, user agent and other online identifiers that the advertiser has associated with the user. Whether this happens is left to the partner rather than to Roku or the user, and Roku directs the reader to the advertisers' own privacy policies for their handling.

Supporting quotations

we will also receive other information connected to your interactions with these ads or advertisers, such as your name, email address, phone number, postal address, IP address, user agent and other online identifiers

Qualifications & exceptions

• Depends on the advertising partner choosing to disclose it; not described as automatic.
• Tied to the user's interactions with those ads or advertisers.

Not stated here

• Which partners do this, and what the advertiser itself does with the data, are not stated in this document.

Data Access & Collection · Company practice

Data about you is taken in from other sources to tailor your experience and ads

Part I closes its collection section with a general statement: Roku collects information about the user from other sources for the purposes described in Part II of this policy, including to provide a tailored user experience and advertising that may be of interest. The purposes are said to be the ones Part II lists, so this sentence does not restate them, and the sources themselves follow as examples rather than a closed register.

Supporting quotations

We collect information about you from other sources for the purposes described in Part II of this Privacy Policy, including to provide you a tailored user experience and advertising that may be of interest to you.

Qualifications & exceptions

• Purposes are the ones Part II describes; this sentence names tailoring and advertising rather than restating Part II.
• The sources that follow are introduced as examples.

Not stated here

• Part II's full purpose list is not repeated here, so the complete set of uses is not stated in this passage.

Data Access & Collection · Company practice

Companies that distribute Roku's Channels send Roku identifiers and your actions

One outside source is whoever carries Roku's Channels: if a user accesses Roku's Channels on media streaming devices, mobile devices, or websites from other companies, those companies may provide Roku with IP addresses, device IDs or other unique identifiers, and user actions that relate to Roku. Watching Roku's own channel on another company's hardware or site therefore produces data at Roku from that distributor, and the text states it permissively.

Supporting quotations

if you access Roku’s Channels on media streaming devices, mobile devices, or websites from other companies, they may provide us IP addresses, device IDs or other unique identifiers, and user actions that relate to Roku.

Qualifications & exceptions

• Applies when Roku's Channels are accessed through another company's device or website.
• Supplied permissively: those companies "may provide" the data.

Not stated here

• Which distributors do this and when is not stated.

Data Access & Collection · Company practice

Third-Party Channels pass identifiers and account status back to Roku

The app publishers inside the Roku Services are another source: third parties whose services are available through the Roku Services may provide IP addresses, device IDs or other unique identifiers, account status and services, with Third Party Channels given as the example. Installing or using another company's channel can therefore result in that company reporting identifiers and account-related facts to Roku.

Supporting quotations

Third Party Channels may provide us IP addresses, device IDs or other unique identifiers, account status, services.

Qualifications & exceptions

• Applies to third parties whose services run through the Roku Services; Third Party Channels are the named example.

Not stated here

• What the source text means by "account status, services" is not explained further.

Charges & Financial Obligations · Company practice

Linking another company's payment service feeds Roku payment and billing data

Adding an outside payment method to the account produces data at Roku: if a user adds a third-party payment service to the Roku account, Roku will receive payment and billing information about that user, such as the payment method, from that service. Receipt is stated flatly once the link exists, rather than depending on a later purchase.

Supporting quotations

If you add a third-party payment service to your Roku account, we will receive payment and billing information about you (e.g., your payment method) from that service.

Qualifications & exceptions

• Triggered by adding a third-party payment service to the Roku account.
• The payment method is the named example of what is received.

Not stated here

• The full set of payment and billing fields received is not enumerated.

Data Access & Collection · Company practice

Linking Alexa, Google Home or Google Photos sends their data to Roku

Linking an outside account to a Roku account opens a channel from that provider: linking a third-party account such as Alexa, Google Home or Google Photos means Roku will receive data from that provider such as voice command transcriptions for voice assistant accounts and photo album metadata for photo storage accounts. The examples are specific rather than incidental, and the wording "such as" leaves room for more.

Supporting quotations

Roku will receive data from that provider such as voice command transcriptions (in the case of voice assistant accounts), and photo album metadata (in the case of photo storage accounts).

Qualifications & exceptions

• Triggered by linking a third-party account such as Alexa, Google Home or Google Photos.
• Voice command transcriptions come from voice assistant accounts and photo album metadata from photo storage accounts.

Not stated here

• How long Roku keeps linked-account data, and whether unlinking stops further receipt, are not stated here.

Data Access & Collection · Company practice

Data brokers and ad partners supply profiles including interests, household and health data

Among the named sources are data providers, ad networks and other advertising partners, who may provide IP addresses, device IDs, other unique identifiers, and information about the user such as online activities, interests, household information, demographics, health and wellness. The last items matter: attributes Roku did not observe itself arrive from outside, the list reaches health and wellness, and nothing here limits the categories or says how the brokers obtained them.

Supporting quotations

These business partners may provide IP addresses, device IDs, other unique identifiers, and information about you, such as information about your online activities, interests, household information, demographics, health, and wellness.

Qualifications & exceptions

• Provided by data providers, ad networks and other advertising partners, permissively ("may provide").

Not stated here

• The document does not say how those partners gathered the data, or restrict the categories beyond "such as".

Use & Processing · Company practice

Advertisers give Roku data to personalize and measure ads

Advertisers running ads through Roku feed it data of their own: advertisers that show ads through Roku's advertising services may also provide data about individuals to Roku, to personalize and measure ads through those services, and for other purposes described in Part II. The stated uses are personalization and measurement, with Part II's broader purposes cross-referenced rather than repeated.

Supporting quotations

Advertisers that show ads through Roku’s advertising services may also provide data about individuals to us to personalize and measure ads through Roku’s advertising services, and for other purposes described in Part II.

Qualifications & exceptions

• Applies to advertisers that advertise through Roku's advertising services.
• Beyond personalizing and measuring ads, the purposes are those Part II lists.

Not stated here

• What kinds of individual-level data advertisers supply is not specified in this sentence.

Charges & Financial Obligations · Company practice

Vendors running parts of Roku's operation report back, including payment balances

Roku outsources some operations, and those vendors are themselves a source of data: payment service providers provide payment or balance information as one named example. The flow is operational rather than promotional — it is the information needed to run payments and accounts.

Supporting quotations

payment service providers that provide us payment or balance information

Qualifications & exceptions

• Limited to providers and vendors used for Roku's own operations; payment or balance information is the named example.

Not stated here

• Which other vendors return data to Roku is not listed.

Security & Safeguards · Company practice

Ad-fraud vendors supply IP addresses used to flag suspicious activity

The same sentence names a second operational source: ad fraud vendors provide IP addresses to help Roku identify potentially suspicious activities. The purpose is screening rather than marketing, and nothing here says what Roku does once activity is flagged.

Supporting quotations

ad fraud vendors that provide IP addresses to help us identify potentially suspicious activities

Qualifications & exceptions

• Used to identify potentially suspicious activity, not to personalize content or ads.

Not stated here

• What counts as potentially suspicious, and what follows from a flag, are not stated.

Data Access & Collection · Company practice

Entering a sweepstakes on another platform means Roku receives your entry

Promotions hosted elsewhere still produce data at Roku: entering a Roku sweepstakes or contest hosted on a third-party platform means Roku will receive information about the entrant and the information provided to enter. Both identity and entry content come back, and because the platform is someone else's, the entry may also be governed by that platform's own terms.

Supporting quotations

we will receive information about you and the information you provide to enter.

Qualifications & exceptions

• Applies to sweepstakes or contests hosted on a third-party platform rather than on Roku properties.

Not stated here

• What identity data is received, and whether it is shared back with the host platform, is not stated.

Data Access & Collection · Company practice

Someone else referring you puts your information at Roku

Roku may receive your personal information from other individuals if they have referred you as described under Part I, Section A(5), above. This is the mirror image of the referral and permission statements earlier in Part I: the person doing the referring supplies details about someone else, and that person's information arrives at Roku without having asked for it. Roku does not here say that the referred person is notified, or that Roku verifies consent.

Supporting quotations

We may also receive your personal information from other individuals if they have referred you as described under Part I, Section A(5), above.

Qualifications & exceptions

• Triggered by another individual referring the person, the case Part I Section A(5) describes.

Not stated here

• Whether the referred person is told, or asked, is not stated in this text.

Data Access & Collection · Company practice

Streaming providers and their ad partners can read your Roku Devices and usage

Installing, accessing or using a streaming service through Roku — a Third-Party Channel, a third-party streaming service inside The Roku Channel — can put the user in direct contact with that provider, and the provider and its advertising partners may collect information about the user's Roku Devices, including unique identifiers, IP addresses and device settings such as language and time zone, together with usage of their service. Usage is spelled out as videos, ads and other content searched, selected and streamed, and audio information when voice-enabled features are used. The routes are broader than installing: conducting a voice search inside one of those services, and reaching the apps through hbbtv features on a Roku TV model's remote, are both named.

Supporting quotations

the provider and its advertising partners may collect information about your Roku Devices (including unique identifiers, IP addresses, and device settings like language and time zone) and your usage of their service

Qualifications & exceptions

• Collected by the streaming provider and its advertising partners, not by Roku itself.
• Reaches voice searches inside those services and access through hbbtv features on a Roku TV model's remote.
• Named data includes unique identifiers, IP addresses, device settings such as language and time zone, searched/selected/streamed content, and audio from voice-enabled features.

Not stated here

• This sentence does not say what the provider or its partners do with the data afterwards.

Data Access & Collection · Restriction or exception

A streaming app can collect even while it is installed but not playing

Roku states that these streaming services may collect some of the information described in this section when their app is installed but not actively streaming. The trigger is therefore installation alone, not playback: having the app on the device is enough for at least some of the described collection. The text limits this to "some of the information" without identifying which items.

Supporting quotations

These streaming services may collect some of the information described in this section when their app is installed but not actively streaming.

Qualifications & exceptions

• Applies when the app is installed but not actively streaming, so playback is not required.
• Limited to "some of the information described in this section", which the text does not itemise.

Not stated here

• Which data points continue while an app is merely installed is not stated.

Data Access & Collection · Company practice

Subscribing hands your registration and interaction data to the streaming provider

Alongside what providers collect themselves, Roku says these streaming services may also receive the user's Roku account registration information, if the user chooses to subscribe to their service, and information about the user's interactions with the Roku Services, as further described in Part III, B below. The registration part is conditioned on the user's own subscription choice; the interaction part points to Part III, B rather than being restated here, and Roku directs the reader to the provider's privacy policy for how that provider uses it.

Supporting quotations

These streaming services may also receive your Roku account registration information (if you choose to subscribe to their service), and information about your interactions with the Roku Services, as further described in Part III, B below.

Qualifications & exceptions

• Registration information is received only if the user chooses to subscribe to that provider's service.
• Interaction information is cross-referenced to Part III, B, which this sentence does not restate.

Not stated here

• What Part III, B provides for is not supplied in this passage.

Data Access & Collection · Company practice

Linking a non-Roku service gives it details about you and your device

Linking a Roku Device or Roku account to a non-Roku service, the examples being Google Photos, Alexa and Google Assistant, is described as choosing to have that provider collect information about the user and the device. The named items go beyond identifiers: device type and name, device identifiers, device state such as whether it is powered on or playing video, the names of installed streaming service apps, and even the names of the device's HDMI ports. Roku frames it as the user's choice and refers to the providers' own privacy policies for their use.

Supporting quotations

you are choosing to have the provider of that service collect information about you and your Roku Device, which may include device type and name, device identifiers, its state (e.g., whether the device is powered on, whether the device is playing video), names of installed streaming service apps, and the names of your device HDMI ports.

Qualifications & exceptions

• Triggered by linking a Roku Device or Roku account to a non-Roku service such as Google Photos, Alexa or Google Assistant.
• Named data includes device state (powered on, playing video), installed streaming app names and HDMI port names.

Not stated here

• Roku does not here say what the linked provider does with the data, or what unlinking stops.

Sharing & Disclosure · Permission or license

Asking a voice assistant to show Roku content authorises sharing it with that assistant

The same passage covers a specific disclosure: directing a virtual assistant to display content, given as the feed of the user's Roku home security camera, is described as authorizing Roku to provide that information to the virtual assistant provider to carry out the request. The authorization is the user's request itself, and the content can be sensitive in kind — a home security camera feed is the document's own example.

Supporting quotations

If you direct a virtual assistant to display content (such as the feed of your Roku home security camera), you are authorizing Roku to provide that information to the virtual assistant provider to carry out your request.

Qualifications & exceptions

• Triggered by directing a virtual assistant to display content; the document's example is a Roku home security camera feed.
• The stated purpose is carrying out that request.

Not stated here

• The text does not say whether the assistant provider keeps the content afterwards.

Data Access & Collection · Company practice

Using someone else's platform to reach Roku's services puts you in their hands too

Accessing Roku services such as Roku's Channels on platforms, online services and devices operated by other companies — third-party smart TVs, streaming devices, mobile phones or websites — means those companies may also collect information about the user. Roku tells the reader to review those companies' privacy policies, both for their own use and for their access to data by them and their partners.

Supporting quotations

these companies may also collect information about you.

Qualifications & exceptions

• Applies when Roku services are accessed through another company's platform, online service or device.
• Stated permissively as "may also collect", and those companies' own privacy policies govern their use.

Not stated here

• Which platforms or companies, and what they collect, are not named.

Data Access & Collection · Company practice

Roku combines what it has about you and derives further inferences

Part II opens with a general statement of what Roku does with what it collects: it may combine the information it collects about the user and use it to derive other information and inferences about the user, and it then uses both the collected and the derived information for the purposes that follow. Combination across sources and derivation of new inferences are therefore stated openly as the basis for every listed use.

Supporting quotations

We may combine the information we collect about you and use it to derive other information and inferences about you.

Qualifications & exceptions

• Applies to information Roku collected about the user, combined together.
• Derived information and inferences are stated to be used for the same listed purposes as collected information.

Not stated here

• What kinds of inferences Roku draws are not enumerated in this sentence.

Use & Processing · Company practice

Your information runs the Roku Services and fulfils your orders

The first listed use is operational: Roku uses the information to provide and maintain the Roku Services, and to process and fulfil the user's requests or orders. This is the baseline purpose that needs no separate permission — it covers keeping the service working and completing what the user asked for.

Supporting quotations

Support, Maintenance and Fulfillment. We use your information to provide and maintain the Roku Services, and to process and fulfill your requests or orders;

Qualifications & exceptions

• Limited to providing and maintaining the Roku Services and processing and fulfilling requests or orders.

Not stated here

• No retention period is given for information used this way.

Use & Processing · Company practice

Usage data improves Roku products and builds advertising correlations

Roku also uses the information to understand and analyse its user base and how the services are used, to improve and enhance them, and to develop new products, services, features and functionalities. Inside that purpose sits a specific advertising use, stated in parentheses: building correlations for use in Roku's advertising services in order to better serve its advertisers. Product improvement and the construction of advertising correlations therefore sit in the same stated purpose.

Supporting quotations

Improvement of Products and Services. We use your information to understand and analyze our user base and how you use the Roku Services, to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionalities;

Qualifications & exceptions

• Includes analysing the user base and service use, and developing new products, services, features and functionalities.
• Expressly includes building correlations for use in Roku's advertising services to better serve advertisers.

Not stated here

• What those correlations are built from is not specified beyond the collected information described earlier.

Use & Processing · Company practice

What you see on Roku is tailored from your information

A named purpose is personalization: Roku uses the information to personalize the user's experience on the Roku Services, including suggesting and offering relevant content and recommendations. Recommendations are therefore built on the collected information rather than being neutral listings.

Supporting quotations

Personalization. We use your information to personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations;

Qualifications & exceptions

• Applies to the experience on the Roku Services; content suggestions and recommendations are the named example.

Not stated here

• The document does not offer a control for personalization at this point.

Use & Processing · Company practice

Ads, including personalized ones, are served on Roku and across other sites and devices

Roku uses the information to show ads, including personalized ads, through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. The same purpose covers creating online identifiers, measuring and understanding the reach, viewership and effectiveness of advertising, providing advertising analytics and reporting, and helping advertisers and advertising partners reach a desired audience and understand, measure and improve their campaigns.

Supporting quotations

We use your information to show you ads (including personalized ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

Qualifications & exceptions

• Includes personalized advertising, not only non-personalized placement.
• Extends to Third-Party Channels and third-party websites, mobile apps, platforms and devices.
• Covers measurement, analytics and reporting as well as ad delivery.

Not stated here

• No separate mechanism for limiting personalized advertising is given in this passage.

Linking & Identification · Company practice

Browsers and devices in one household are joined for advertising

Roku states that it associates the browsers and devices used by the same individual or household for the purposes of advertising to that individual or household on different browsers or devices, naming smartphones, tablets, streaming players, connected TVs and computers. Its illustration is concrete: this allows ads seen on a tablet to be based on activity engaged in on the Roku TV. The unit of advertising is therefore the household joined across devices rather than a single device.

Supporting quotations

We associate the browsers and devices (such as smartphones, tablets, streaming players, connected TVs, and computers) used by the same individual or household for purposes of advertising to that individual or household on different browsers or devices.

Qualifications & exceptions

• Joins browsers and devices used by the same individual or household.
• Named device types include smartphones, tablets, streaming players, connected TVs and computers.

Not stated here

• How Roku decides that devices belong to one household is not stated here.

Use & Processing · Company practice

Roku markets to you by alert, email and text, including partner offers

Another listed purpose is marketing and promotion: sending alerts, notifications, emails and text messages about products, events, promotions and offers from Roku or its partners, and measuring and understanding the effectiveness of that marketing. Messages arrive through several channels and may carry partner offers, not only Roku's own.

Supporting quotations

We use your information for marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing;

Qualifications & exceptions

• Channels named are alerts, notifications, emails and text messages.
• Offers may come from partners as well as from Roku, and effectiveness measurement is included.

Not stated here

• How to opt out of these messages is not stated in this passage.

Use & Processing · Company practice

Business metrics are measured from your information

Analytics and performance is listed as its own purpose: Roku measures performance and analyses key metrics relevant to its business. It is stated generally, without naming which metrics or what is done with the results.

Supporting quotations

Analytics and Performance. We use your information to measure performance and analyze key metrics relevant to our business;

Qualifications & exceptions

• Framed as key metrics relevant to Roku's business rather than user-facing features.

Not stated here

• Which metrics Roku analyses is not stated.

Use & Processing · Company practice

Service messages and support run on your information too

Roku uses the information to communicate service information — confirmations, invoices, notices, updates, security alerts, user surveys, support and administrative messages — and to respond to comments and questions and provide customer service. Both transactional and support messaging therefore sit within the same purpose list.

Supporting quotations

Service Communication and Customer Care. We use your information to communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service;

Qualifications & exceptions

• Covers confirmations, invoices, notices, updates, security alerts, surveys and support or administrative messages.
• Also covers responding to the user's own comments and questions.

Not stated here

• Whether service messages can be switched off is not stated here.

Legal Rights & Agreement Rules · Company practice

Enforcing terms, protecting users and meeting legal duties are stated uses

The last purpose covers protection: enforcing Roku's terms and conditions, protecting its business, partners or users, and complying with contractual and legal obligations. This is the purpose that lets Roku use collected information against a user's interests in a dispute, and it reaches legal obligations without naming which ones.

Supporting quotations

Protect Roku, our Users and Others. We use your information to enforce our terms and conditions or protect our business, partners or users, and to comply with our contractual and legal obligations; and

Qualifications & exceptions

• Includes enforcing Roku's terms and conditions and protecting its business, partners or users.
• Includes complying with contractual and legal obligations, unnamed here.

Not stated here

• Which legal obligations Roku has in mind are not specified.

Security & Safeguards · Company practice

Fraud and abuse prevention is another stated use, including click fraud

The last purpose Roku lists for using information is security: protecting, investigating and deterring fraudulent, unauthorized, infringing or illegal activity, with click fraud named as an example. The purpose covers investigation as well as prevention, so it reaches looking into suspected conduct, and "unauthorized or infringing" activity goes beyond fraud alone.

Supporting quotations

Security and Fraud Prevention. We use your information to protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Includes investigating and deterring, not only preventing.
• Click fraud is named as an example of the activity covered.

Not stated here

• What triggers an investigation, or what follows one, is not described here.

Sharing & Disclosure · Company practice

Contractors and service providers may access and use your information

Part III opens with vendors: Roku works with other businesses, including contractors and service providers, to provide services and help run its operations, and that may require them to access and use the user's information. The examples show how wide the access is — other companies communicating with the user by phone, email or letter, processing and collecting card payment, providing customer support, and obtaining additional data about the user. Support access is spelled out further: a chat feature managed by Roku's service providers means those providers receive the user's communications through it.

Supporting quotations

We work with other businesses (including contractors and service providers) to provide services for us and to help with our operations, which may require that they access and use your information.

including any chat feature managed by our service providers, who will receive your communications through the chat feature

Qualifications & exceptions

• Access follows from vendors providing services or helping with Roku's operations, not from any separate notice.
• Named examples include outsourced communications, payment processing, customer support and obtaining additional data about the user

Not stated here

• Roku does not say how it limits what vendors may do with the information, or list its vendors.

Sharing & Disclosure · Company practice

Outsourced analytics such as Google Analytics reach your use of other companies' sites and apps

Roku names Google Analytics as an example of analytics work it outsources, and says these analytics services may also collect information regarding the user's use of other companies' websites, apps, online services and devices. Roku gives two pointers rather than a control of its own: Google's partner privacy page for its practices, and a Google Analytics opt-out browser add-on. The opt-out is described as a browser add-on, so it is a browser mechanism rather than a Roku setting.

Supporting quotations

These analytics services may also collect information regarding your use of other companies’ websites, apps, online services, and devices.

Qualifications & exceptions

• Reaches the user's use of other companies' websites, apps, online services and devices.
• The offered opt-out is the Google Analytics browser add-on, not a Roku control.

Not stated here

• Whether Roku's own analytics use can be switched off is not stated in this passage.

Sharing & Disclosure · Company practice

App and content partners receive your registration and interaction information

Roku may disclose personal information to partners whose services are available through the Roku Services — providers of Third-Party Channels, media content or other services — and it says what that information may include: Roku account registration information, and information about the user's interactions with those providers, their services and the Roku Services. The disclosure is stated to serve different purposes, enumerated as reporting and analytics, helping the user subscribe to apps or access paid content, providing services to the user, tailoring the user experience, customizing searches and discovery, and personalizing ads. Registration details are therefore not confined to Roku, and title-level or provider-level interaction data leaves Roku too.

Supporting quotations

We may disclose personal information with partners whose services are available through the Roku Services such as providers of Third-Party Channels, media content, or other services on the Roku Services.

This information may include Roku account registration information, and information about your interactions with these providers, their services and the Roku Services, and it is disclosed for different purposes, including for reporting and analytics, helping you subscribe to apps or access paid content, providing services to you, tailoring your user experience, customizing your searches and discovery, and personalizing ads to you.

Qualifications & exceptions

• Recipients are partners whose services run through the Roku Services, including Third-Party Channel and media content providers.
• Enumerated purposes include personalizing ads and customizing searches and discovery, not only service delivery.

Not stated here

• The text does not say how much of the interaction record is disclosed, or let the user choose.

Sharing & Disclosure · Company practice

Ad networks set their own trackers on Roku and collect across services over time

Roku works with ad networks and other advertising partners to show ads for Roku's own products and for advertisers, both on the Roku Services and on other companies' websites, apps and devices, and it discloses information to those ad networks, advertising partners and advertisers. Those recipients may set and access their own cookies, pixel tags and similar technologies on the Roku Services, and may otherwise collect or have access to information about the user which they collect over time and across different online services and devices. The tracking is therefore the partners' own, accumulates over time, and is not confined to Roku's properties.

Supporting quotations

We disclose information to these ad networks, advertising partners and our advertisers, and they may set and access their own cookies, pixel tags and similar technologies on the Roku Services and they may otherwise collect or have access to information about you which they collect over time and across different online services and devices.

Qualifications & exceptions

• Recipients include ad networks, advertising partners and advertisers.
• Their own cookies, pixel tags and similar technologies may be set and accessed on the Roku Services.
• Their collection accumulates over time and across different online services and devices.

Not stated here

• The partners are not named, and no Roku-side control for this disclosure is offered here.

Sharing & Disclosure · Company practice

Measurement providers learn what content and ads you saw and how campaigns performed

Roku works with advertising measurement providers and their service providers to help itself, advertisers and others understand information about the content and ads viewed and the effectiveness of ad campaigns, including the audience that saw the ads and how those viewers responded. Measurement therefore covers both what was watched and how the viewer reacted, and it is shared outward rather than kept internal.

Supporting quotations

We work with advertising measurement providers and their service providers to help us, advertisers and others understand information about the content and ads viewed, and the effectiveness of ad campaigns, including the audience that saw their ads and how they responded.

Qualifications & exceptions

• Recipients are advertising measurement providers and their service providers, and they serve advertisers as well as Roku.
• Covers content and ads viewed plus audience response, not only aggregate counts.

Not stated here

• Whether the shared data is identified or aggregated is not stated.

Sharing & Disclosure · Company practice

Demographics and audience labels such as sports fan are disclosed to measurement providers

Beyond viewing data, Roku may disclose the user's demographics data and audience segments — its own examples being sports fans, sitcom enthusiasts and cord cutters — with advertising measurement providers and their service providers. These are assignments about the person rather than records of what they did, and they are handed to third parties.

Supporting quotations

We may also disclose your demographics data and audience segments (e.g., sports fans, sitcom enthusiasts, cord cutters, etc.) with advertising measurement providers and their service providers.

Qualifications & exceptions

• Named segments include sports fans, sitcom enthusiasts and cord cutters.
• Recipients are advertising measurement providers and their service providers.

Not stated here

• How Roku assigns a person to a segment is not explained here.

Use & Processing · Company practice

Roku sells measurement that tells other companies whether viewers share a household

Roku also provides measurement and analytics solutions to other companies through its advertising services. In doing so it analyzes and reorganizes those companies' ad campaign data and provides analytics reports to help them better understand the audience that viewed the company's ads and whether those viewers belong to the same household. So the household grouping described earlier is also a product feature: Roku tells other companies that different viewers share a home.

Supporting quotations

In providing these services, we analyze and reorganize ad campaign data from these companies and provide analytics reports to help them better understand the audience that viewed the company’s ads and whether those viewers belong to the same household.

Qualifications & exceptions

• Performed for other companies' campaigns through Roku's advertising services.
• Reports cover who viewed the ads and whether viewers belong to the same household.

Not stated here

• How Roku determines shared household membership is not stated.

Sharing & Disclosure · Company practice

Reaching Roku's Channels through another company's device discloses your activity to it

Accessing Roku services such as Roku's Channels on media streaming devices, websites or mobile devices from other companies can lead Roku to disclose certain information to them: interactions with Roku's Channels and their content, IP address, device identifier, and the user's privacy settings. The stated uses are coordinating service provision, tailoring the experience and personalizing ads — so even privacy settings themselves travel with the disclosure.

Supporting quotations

we may disclose certain information to them, including information about your interactions with Roku’s Channels and their content, IP address, device identifier, and user privacy settings

Qualifications & exceptions

• Triggered by accessing Roku services through another company's device, website or mobile device.
• Disclosed items include channel interactions and content, IP address, device identifier and the user's privacy settings.

Not stated here

• Which companies receive this, and what they retain, is not named.

Sharing & Disclosure · Company practice

Buying through Roku discloses your information to the merchant, for stated and unspecified purposes

If the user buys goods or services on the Roku Services, Roku may need to disclose information about the user and information provided to the merchant, for processing the transaction, fulfilling and shipping the order — and, once more, for other purposes. The phrase repeats the open-ended tail seen earlier in the policy: uses beyond the transaction itself are permitted by the wording but not listed.

Supporting quotations

we may need to disclose information about you and information you provide to the merchant to process the transaction, fulfill and ship your order, and for other purposes.

Qualifications & exceptions

• Triggered by a purchase on the Roku Services.
• Beyond processing, fulfilment and shipping, other purposes are left open.

Not stated here

• The other purposes are not enumerated.

Sharing & Disclosure · Company practice

Current and future affiliates receive your information under this policy

Information may be disclosed to Roku's current or future affiliates, defined as a parent company and any subsidiaries, joint ventures or other companies under common control, and in that case Roku says it will require the affiliates to honor this Privacy Policy. The reach includes companies not yet affiliated at the time of reading, and the safeguard is contractual: the affiliates must honor this policy rather than being limited to particular uses.

Supporting quotations

We may disclose your information to our current or future affiliates (which means a parent company, and any subsidiaries, joint ventures, or other companies under common control), in which case we will require our affiliates to honor this Privacy Policy.

Qualifications & exceptions

• Reaches future affiliates, not only present ones.
• Roku states it will require those affiliates to honor this Privacy Policy.
• Affiliates are defined as parent, subsidiaries, joint ventures and other companies under common control.

Not stated here

• How compliance with the requirement is enforced is not stated.

Sharing & Disclosure · Permission or license

A consent setting can hand third parties what specific titles you requested and viewed

Alongside the disclosures Roku makes without asking, it may disclose personal information with consent, and its example is precise: agreeing to the disclosure of information about requests for and viewing of specific movies, programs, games and video services, either to personalize ads or to improve those companies' products, by enabling the Content Viewing Disclosure setting. Turning that setting on therefore shares named titles rather than patterns, and the stated recipients' uses include improving their own products.

Supporting quotations

For example, when you agree to our disclosure of information about your requests for and viewing of specific movies, programs, games, and video services to third parties to personalize ads or to improve their products by enabling the ‘Content Viewing Disclosure’ setting

Qualifications & exceptions

• Applies when the user enables the Content Viewing Disclosure setting, consenting to it.
• Covers requests for and viewing of specific movies, programs, games and video services.
• Stated purposes include personalizing ads and improving the recipients' products.

Not stated here

• Which third parties receive it under this setting is not named.

Sharing & Disclosure · Permission or license

Consent can also send identifying information to third parties for their own marketing

The same sentence covers a second consent case: agreeing to Roku providing personally identifying information to other third parties for their own marketing purposes, subject to those parties' separate privacy policies. Once given, the recipients' own policies govern rather than Roku's, so the protection the user relies on afterwards is the recipient's policy, not this document.

Supporting quotations

or when you agree to our provision of your personally identifying information to other third parties for their own marketing purposes, subject to their separate privacy policies.

Qualifications & exceptions

• Triggered by the user agreeing to it.
• Recipients use the information for their own marketing, under their own privacy policies rather than this one.

Not stated here

• Which third parties, and how consent is recorded or withdrawn, are not stated.

Sharing & Disclosure · Company practice

Your information can be disclosed during a merger, financing or sale of the business

Roku may disclose information to others in connection with, or during negotiation of, any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or part of its business or assets to another company. Disclosure during negotiation means it can happen before any deal completes, and the list of events reaches insolvency as well as a sale.

Supporting quotations

We may also disclose your information to others in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.

Qualifications & exceptions

• Covers negotiation as well as completion of the transaction.
• Reaches mergers, financing, acquisitions, bankruptcy, dissolution, transfers, divestitures and partial asset disclosures.

Not stated here

• The text does not say the recipient must keep honouring this policy, or that the user is notified.

Legal Rights & Agreement Rules · Company practice

Law, enforcement of Roku's terms, emergencies and suspected illegality are grounds to disclose

Roku lists four grounds for disclosing information without the user asking: complying with laws or responding to lawful requests and legal process; protecting the rights and property of Roku, its employees, agents, customers and others, including enforcing its agreements, policies and terms of use; acting in an emergency to protect personal safety of Roku, its employees or customers or any person; and investigating, preventing or taking action regarding illegal or suspected illegal activities. The reach is broad: the second ground covers civil enforcement of Roku's own agreements, and the fourth turns on suspicion rather than proof.

Supporting quotations

We may also disclose your information (1) to comply with laws or to respond to lawful requests and legal process, (2) to protect the rights and property of Roku, our employees, agents, customers, and others, including to enforce our agreements, policies, and terms of use, (3) in an emergency to protect the personal safety of Roku, its employees or customers, or any person, or (4) to investigate, prevent, or take action regarding illegal or suspected illegal activities.

Qualifications & exceptions

• Grounds are stated in the alternative; any one is enough.
• Includes enforcing Roku's own agreements, policies and terms of use, and acting on suspected illegal activity.

Not stated here

• Roku does not say whether it notifies users about such disclosures, or what it requires of requesters.

Sharing & Disclosure · Company practice

Aggregated and de-identified data, including audience segments, is shared for others' own uses

Roku may disclose aggregated or de-identified information, described as information that does not personally identify the user directly, or statistical information about the user including demographics data and audience segments such as sports fans, sitcom enthusiasts and cord cutters. Recipients may use it for a variety of purposes including their own uses, given as improving their products and services for Roku and others and making ads more relevant to the user's interests. The carve-out is therefore narrower than it sounds: the same audience segments appear here as disclosed data, and recipients use it for themselves.

Supporting quotations

We may also disclose aggregated or de-identified information (i.e., information that does not personally identify you directly), or statistical information about you, including demographics data and audience segments (e.g., sports fans, sitcom enthusiasts, cord cutters, etc.), to others for a variety of purposes, including for their own uses, for example, for improving their products and services for us and others, and to make ads more relevant to your interests.

Qualifications & exceptions

• The qualifying language is "does not personally identify you directly", not a promise that no personal data is involved.
• Disclosed items expressly include demographics data and audience segments.
• Recipients use it for their own purposes, including improving products and making ads more relevant.

Not stated here

• How Roku de-identifies the data, and whether recipients may re-identify it, is not stated.

Sharing & Disclosure · Company practice

Posts, uploads and shared devices are visible to other Roku users

Roku may disclose information to other users of the Roku Services at the user's request, or when certain features are used. The examples are concrete: a comment or product review posted on the Roku Sites can be read by other users; content uploaded for others' access, such as comments, videos or audio files, and Roku Devices the user grants access to, become viewable by other users. Sharing features therefore put the material — and the device itself — in front of other account holders.

Supporting quotations

We may disclose your information to other users of the Roku Services at your request, or when you use certain features of our products and services.

If you upload content for access by others, including comments, videos or audio files, to the Roku Services, or if you grant access to your Roku Devices, these content and devices will be viewable by other users.

Qualifications & exceptions

• Triggered by the user's request or by use of particular sharing features.
• Reaches uploaded comments, videos and audio files, and granted access to the user's Roku Devices.

Not stated here

• What other users may do with the content afterwards is not stated here.

Sharing & Disclosure · Company practice

A direct message carries your user ID to the person you message

Direct messaging is spelled out separately: directing a message to another user through the Roku Services means Roku will disclose both the message and the user's user ID to that user. The recipient therefore learns the sender's identifier along with the content, and this is described as disclosure rather than mere delivery.

Supporting quotations

If you direct message another user through the Roku Services, then we will disclose your message and your user ID to that user.

Qualifications & exceptions

• Applies to direct messages to another user through the Roku Services.
• Discloses the message contents and the sender's user ID.

Not stated here

• Whether the user ID is a persistent account identifier is not explained.

Legal Rights & Agreement Rules · Context

The children's notice is stated to be provided under COPPA

Roku says the notice that follows is provided pursuant to the Children's Online Privacy Protection Act (COPPA). The reference frames Part IV as a children's privacy notice given under that statute; the text of the Act is not part of this document, and nothing here resolves what COPPA requires beyond what Roku states.

Supporting quotations

This notice is provided pursuant to the Children’s Online Privacy Protection Act (COPPA).

Qualifications & exceptions

• Stated as the basis for this Part IV notice specifically.

Not stated here

• COPPA's own text and requirements are not supplied by this document.

Data Access & Collection · Company practice

In the Kids & Family areas Roku collects voice commands, persistent identifiers and usage

Roku describes special privacy protections in parts of the Roku Services such as the Kids & Family section in The Roku Channel and the Kids section of the Roku Channel Store, and states what it collects when any user interacts with those parts: any voice commands a user chooses to submit, persistent identifiers, and usage information about interactions with those parts. The protections described apply to the data, not to a verified child's identity — it is collected from any user who interacts with those areas.

Supporting quotations

Roku collects the following personal information: any voice commands that a user chooses to submit, persistent identifiers, and usage information about the interactions with those parts of the Roku Services.

Qualifications & exceptions

• Applies in the named Kids & Family and Kids sections of The Roku Channel and the Roku Channel Store.
• Applies to any user interacting with those parts, not only to children.
• Voice commands are limited to ones the user chooses to submit.

Not stated here

• Whether the same protections apply elsewhere in the Roku Services is not stated.

Retention & Deletion · Company commitment

Voice recordings from Kids areas are deleted once the request is carried out

Roku uses any submitted voice commands to effectuate the instruction or request, and states that the voice recordings it collects are immediately deleted thereafter. The retention for recordings is therefore tied to carrying out the request, and it is stated as deletion rather than a period of storage; the remaining persistent identifiers and usage information are then governed separately by the internal-operations list.

Supporting quotations

Roku uses these voice commands to effectuate their instructions or requests, and the voice recordings that Roku collects are immediately deleted thereafter. Roku uses these persistent identifiers and usage information for the following internal operations:

Qualifications & exceptions

• Applies to voice recordings collected in the protected parts of the Roku Services.
• Deletion is stated as immediate, after the instruction or request is effectuated.

Not stated here

• "Immediately" is not defined, and this document gives no verification mechanism.

Use & Processing · Company practice

Kids-area identifiers are limited to six named internal operations

For persistent identifiers and usage information from the protected parts, Roku states a closed purpose list it calls internal operations: maintaining or analyzing the functioning of the Roku Services; performing network communications; authenticating users of, or personalizing the content on, the Roku Services; serving contextual advertising on the Roku Services or capping the frequency of advertising; protecting the security or integrity of the user or the Roku Services; and ensuring legal or regulatory compliance. Personalization of content and contextual advertising are inside that list, while anything outside it is covered by the restriction described next.

Supporting quotations

Roku uses these voice commands to effectuate their instructions or requests, and the voice recordings that Roku collects are immediately deleted thereafter. Roku uses these persistent identifiers and usage information for the following internal operations:

Maintaining or analyzing the functioning of the Roku Services;

Performing network communications;

Authenticating users of, or personalizing the content on, the Roku Services;

Serving contextual advertising on the Roku Services or capping the frequency of advertising;

Protecting the security or integrity of the user or the Roku Services; and

Ensuring legal or regulatory compliance.

Qualifications & exceptions

• The six listed operations include content personalization and contextual advertising or frequency capping.
• Applies to persistent identifiers and usage information from the protected Kids & Family parts.

Not stated here

• How each operation is bounded in practice is not described.

Use & Processing · Company commitment

Kids-area data is walled off from behavioral advertising by policies and system restrictions

Roku states that it prevents these persistent identifiers and usage information from being used or disclosed for other purposes that do not constitute internal operations, giving behavioral advertising as the example, and it says this is done through internal policies and logic-based restrictions in its internal systems. As a concrete instance it says its behavioral advertising systems are configured to exclude personal information collected from those parts of the Roku Services. The control is therefore technical and internal rather than a user-facing switch.

Supporting quotations

Roku prevents these persistent identifiers and usage information from being used or disclosed for other purposes that do not constitute internal operations (such as behavioral advertising) through internal policies and logic-based restrictions in its internal systems.

Qualifications & exceptions

• The restriction covers use and disclosure for purposes outside the named internal operations.
• Behavioural advertising is named as an excluded use, with systems configured to exclude the data.
• Enforcement is described as internal policies plus logic-based restrictions in internal systems.

Not stated here

• The document does not describe any audit or external verification of these restrictions.

Retention & Deletion · Company practice

Kids-area identifiers are kept as long as the internal operations need them

Roku retains these persistent identifiers and usage information for as long as needed to fulfill the internal operations purposes for which the data was collected, unless it is required by law to retain it longer. The retention rule is purpose-linked rather than a fixed period, with a legal-requirement exception that can extend it.

Supporting quotations

Roku retains these persistent identifiers and usage information for as long as needed to fulfill the internal operations purposes for which the data was collected unless we are required by law to retain it for a longer period.

Qualifications & exceptions

• Retention runs for as long as needed for the internal operations purposes.
• The stated exception is a legal requirement to keep it longer.

Not stated here

• No maximum period is given, and which legal requirements could extend it are not named.

Legal Rights & Agreement Rules · Restriction or exception

The children's notice does not reach third-party services reached through Roku

Roku states that the disclosure in this notice does not apply to the practices of any third-party services, including Third-Party Channels, that may be accessed through the Roku Services, and it advises reviewing the applicable terms and policies before a child uses such a service, including its data collection and use practices. The protections described above therefore stop at Roku's own parts; a child's use of another company's channel is governed by that company's terms.

Supporting quotations

The disclosure in this notice does not apply to the practices of any third-party services (including Third-Party Channels) that may be accessed through the Roku Services.

Qualifications & exceptions

• Names Third-Party Channels among the services it does not cover.
• Advice given is to review each service's terms and policies before use.

Not stated here

• Roku does not say it screens those services for child appropriateness.

Account & Service Control · Procedure

Questions about children's privacy go to Roku's Legal Department

For questions about Roku's processing of personal information described in the Children's Privacy Notice, Roku gives a contact route: its Legal Department at Roku, Inc. in San Jose, the privacy@roku.com address, and a telephone number. It is a postal, email and phone route rather than a form or portal, and it is stated specifically for the children's notice.

Supporting quotations

If you have any questions about our processing of personal information described in this Children’s Privacy Notice, you can contact Roku at:

privacy@roku.com

Qualifications & exceptions

• Stated for questions about the processing described in the Children's Privacy Notice.
• Contact routes given include Roku's Legal Department, an email address and a telephone number.

Not stated here

• No response time is promised.

Account & Service Control · User right or choice

You can ask to see, correct or delete your information, and Roku may refuse

Part V opens with access rights: a user with a Roku account may view and update certain contact and billing information by logging into the account on Roku.com, and may otherwise ask for access, correction or deletion of personal information Roku holds, through the linked privacy contact page. The right is qualified — Roku may decline requests that are unreasonable, prohibited by law, or not required to be honored by applicable law. So the route exists but the outcome depends on Roku's assessment and on the law that applies.

Supporting quotations

If you otherwise wish to ask for access, correction, or deletion of any of your personal information held by us, please click here. However, we may decline requests that are unreasonable, prohibited by law, or are not required to be honored by applicable law.

Qualifications & exceptions

• Self-service covers certain contact and billing information only; other requests go through the privacy contact page.
• Requests may be declined where unreasonable, prohibited by law, or not required to be honored by applicable law.

Not stated here

• Which information is excluded from self-service, and what timelines apply, are not stated here.

Account & Service Control · User right or choice

Opting out of marketing email does not stop all email from Roku

Roku says its marketing emails explain how to opt out of further marketing emails, and offers a checkbox in the account to do so. Opting out has a stated limit: Roku may still send non-marketing email, examples being account and business-dealings messages and, where allowed by applicable law, survey invitations. So the choice removes marketing but leaves transactional and survey mail running.

Supporting quotations

Our marketing emails tell you how to opt out of receiving further marketing emails. If you opt out, we may still send you non-marketing emails, such as emails about your accounts and our business dealings with you, and, as allowed by applicable law, requests for your participation in surveys.

Qualifications & exceptions

• Non-marketing email continues: account and business-dealings messages, and survey requests where the law allows it.
• Two routes are named: instructions inside each marketing email and a checkbox in the account settings.

Not stated here

• Whether text-message marketing has an equivalent opt-out is not stated here.

Account & Service Control · User right or choice

A Personalized Ads setting can stop ad personalization while you use your account

A logged-in user can manage a preference for personalized ads from Roku through the Personalized Ads setting, reachable in the Privacy section of the Settings menu of Roku players and Roku TV models or on Roku's personalization page. Disabling it has a described effect: Roku will not personalize ads while the user is accessing its services using the Roku account, and ads continue but are less relevant. Roku explains what remains — contextual advertising, its own example being ads based on the subject matter being viewed or the time of day.

Supporting quotations

When you disable this setting, we will not personalize your ads while you are accessing our services using your Roku account. You will still see ads, but they will be less relevant to you.

Qualifications & exceptions

• Applies while accessing Roku services using the Roku account, not to unauthenticated use.
• Advertising continues, described as contextual — for example based on what is being viewed or the time of day.
• Reachable in device Settings privacy menus and through the Roku personalization page.

Not stated here

• Whether this setting changes Roku's other uses, such as measurement, is not stated here.

Account & Service Control · Restriction or exception

Third-Party Channels can ignore Roku's personalization setting

Roku warns that streaming a Third-Party Channel on a Roku player or Roku TV model may not respond to the Personalized Ads setting, and points the user to the app's own settings and the channel provider's privacy policy for choices there. The Roku-level control therefore does not guarantee the outcome inside another company's app.

Supporting quotations

If you are streaming a Third-Party Channel on a Roku player or Roku TV model, that app may not respond to this setting.

Qualifications & exceptions

• Applies to Third-Party Channels streamed on Roku players and Roku TV models.
• The channel may offer its own settings, and its privacy policy governs its choices.

Not stated here

• Which channels respond to the setting is not stated.

Account & Service Control · Procedure

The Advertising Identifier can be reset from device settings

Alongside the preference, Roku offers a reset: choosing Reset Advertising Identifier in the device settings resets the identifier of that Roku player or Roku TV model. This is a device-level action distinct from toggling personalization, and the document does not say what happens to previously collected activity once the identifier is reset.

Supporting quotations

You can also reset the Advertising Identifier of your Roku player or Roku TV model by choosing “Reset Advertising Identifier” in the device settings.

Qualifications & exceptions

• Applies to Roku players and Roku TV models through the device settings.

Not stated here

• Whether resetting removes prior profile associations is not stated.

Account & Service Control · User right or choice

Each ad opt-out covers only the one device or app it is set on

For use without logging in, or for other apps and devices where Roku provides advertising, Roku offers choices — and states their scope plainly: each mechanism opts the user out of Roku's personalizing of ads only for that specific device or app, and does not affect activity or personalized advertising on other apps or different devices. A user with several devices must therefore repeat the choice on each one.

Supporting quotations

Each of these opt-out mechanisms below opts you out of Roku’s personalizing of ads only for that specific device or app and will not affect activities or personalized advertising on other apps or different devices.

Qualifications & exceptions

• Limited to the specific device or app where it is exercised.
• Does not affect personalized advertising on other apps or devices.

Not stated here

• How many separate opt-outs an average household must make is not addressed.

Account & Service Control · User right or choice

On mobile apps the control is your operating system's limit ad tracking

One named route is the mobile operating system's own limit ad tracking setting, offered for advertising personalization in mobile apps. Roku points users to the platform's control rather than providing one of its own.

Supporting quotations

on mobile apps by using any limit ad tracking settings offered by your mobile operating system; and

Qualifications & exceptions

• Depends on the mobile operating system offering a limit ad tracking setting.

Not stated here

• What Roku does when no such setting exists is not stated.

Account & Service Control · User right or choice

On other companies' TVs and boxes, any limit ad tracking setting available

For Smart TVs, set top boxes, media streaming devices and other OTT platforms from other companies, Roku directs the user to that platform's limit ad tracking or similar setting, but only "if one is available". Where the platform offers nothing, this passage gives no alternative.

Supporting quotations

on Smart TVs, set top boxes, media streaming devices and other OTT platforms from other companies by using any limit ad tracking (or similar) settings offered by that platform, if one is available.

Qualifications & exceptions

• Applies to Smart TVs, set top boxes, media streaming devices and other OTT platforms made by other companies.
• Expressly conditional on that platform offering such a setting.

Not stated here

• What a user can do when no such setting exists is not stated.

Account & Service Control · User right or choice

The cookie opt-out for third-party ads works only in the browser you use

Roku offers its cookie consent tool to opt out of personalized ads from third parties on the Roku Sites, and states the limit: the tool opts the user out only for the specific browser used, and does not affect activity or targeted advertising on other browsers or different devices. Third-party personalized advertising on the Sites is therefore controlled browser by browser.

Supporting quotations

This tool opts you out of personalized advertising only for the specific browser from which you opt out and will not affect activities or targeted advertising on other browsers or different devices.

Qualifications & exceptions

• Limited to the specific browser used to opt out.
• Does not affect activity or targeted advertising on other browsers or devices.

Not stated here

• How long the opt-out persists in that browser is not stated here.

Account & Service Control · Company practice

The Roku Sites do not respond to Do Not Track signals

Roku addresses Do Not Track directly: because uniform standards for Do Not Track signals have not been adopted, the Roku Sites do not currently process or respond to them. A browser-level Do Not Track signal therefore produces no change on those sites, and Roku points users to an external explanation rather than offering an alternative.

Supporting quotations

Since uniform standards for “Do Not Track” signals have not been adopted, the Roku Sites do not currently process or respond to “Do Not Track” signals.

Qualifications & exceptions

• Applies to the Roku Sites rather than to Roku devices.
• The stated reason is the absence of adopted uniform standards, and the posture is described as current.

Not stated here

• Whether that position could change if standards are adopted is not promised.

Account & Service Control · User right or choice

ACR consent can be withdrawn from the Smart TV Experience settings

A user who enabled ACR can withdraw consent by going to the device's Settings, Privacy, Smart TV Experience menu and de-selecting Automatic Content Recognition (ACR). The withdrawal route is device-level, matching the earlier statement that ACR is something the user enables, and it is described as withdrawing consent rather than merely pausing collection.

Supporting quotations

you can withdraw your consent by going to Settings on your Roku device (Settings > Privacy > Smart TV Experience) and de-selecting “Automatic Content Recognition (ACR)”.

Qualifications & exceptions

• Requires access to Settings > Privacy > Smart TV Experience on the Roku device.
• Framed as withdrawal of consent to ACR.

Not stated here

• What happens to previously collected ACR data is not stated here.

Account & Service Control · User right or choice

Consent to disclose what you watch can be withdrawn, including title by title

The Content Viewing Disclosure setting can likewise be withdrawn in Settings > Privacy > Smart TV Experience by de-selecting it. Roku adds a narrower route for particular titles: emailing Roku at the Content Viewing Disclosure opt-out address. So a user can withdraw consent wholesale through the device, or ask about specific titles through an email request.

Supporting quotations

you can withdraw your consent by going to Settings on your Roku device (Settings > Privacy > Smart TV Experience) and de-selecting “Content Viewing Disclosure”.

If you wish to withdraw your consent to the disclosure of particular titles, email Roku at ContentViewingDisclosureOptOut@roku.com.

Qualifications & exceptions

• Device route withdraws consent generally; email route is described for withdrawing consent to disclosure of particular titles.

Not stated here

• What information the email request must contain, and how quickly it is actioned, are not stated.

Account & Service Control · User right or choice

Microphone access and Roku's retention of voice recordings can each be controlled

Voice controls sit under Settings > Privacy > Voice on Roku Devices with voice features, where the user governs apps' access to the microphone on the remote control or mobile device. Separately, Roku's own retention of voice recordings captured on a remote control or mobile device can be disabled from the Voice Settings page after logging into the account on Roku.com, and hands-free voice features on some remotes can be disabled as well. The controls therefore cover both microphone access and retention, but each is set in a different place.

Supporting quotations

Visit the Settings menu of your Roku Device with voice-activated features (under Settings > Privacy > Voice) for controls regarding apps’ access to the microphone on your remote control or mobile device.

You can also disable Roku’s retention of voice recordings captured on your remote control or mobile device by logging into your account on Roku.com and visiting the Voice Settings page.

Qualifications & exceptions

• Microphone access is managed in Settings > Privacy > Voice on the device.
• Retention of Roku's voice recordings is disabled through the account Voice Settings page on Roku.com.
• Hands-free voice features on some remotes can be disabled; instructions are left to product information or the support site.

Not stated here

• Whether disabling retention deletes recordings already held is not stated.

Account & Service Control · User right or choice

Smart Home device content, retention and transfer are managed in the app or webpage

Owners of Roku Smart Home devices can manage device settings and the retention and transfer of device content from the Roku Smart Home Mobile App or the Smart Home webpage. Roku also says users may be asked to provide video and audio recordings to help Roku and its partners improve products and services, but states that providing consent is not required. The consent request therefore exists without conditioning service on it.

Supporting quotations

You may be asked to provide video and audio recordings to help Roku and its partners improve their products and services but are not required to provide consent.

Qualifications & exceptions

• Covers device settings plus retention and transfer of device content.
• Contributing recordings is optional: consent is stated as not required.

Not stated here

• Default retention periods for smart home content are not stated here.

Account & Service Control · User right or choice

Cookie choices are per browser and device, and clearing cookies resets them

Many non-essential cookies served through a Roku Site can be managed or opted out of with the Cookie Consent Tool, but Roku spells out three limits: the choice applies only to the browser and device it was made on; rejecting or removing cookies may stop parts of the Sites working properly; and because the opt-out preference is itself stored in a browser cookie, deleting cookies, switching browsers or buying a new computer requires renewing the choice. The control is therefore self-limiting and can lapse without notice.

Supporting quotations

You may manage or opt-out of many non-essential cookies served through this Roku Site by using the Cookie Consent Tool provided. Your choices will apply only to the specific browser and device from which you opt out

Since your cookie opt-out preferences are also stored in a cookie in your website browser, please also note that if you delete all cookies, use a different browser, or buy a new computer, you will need to renew your opt-out choices.

Qualifications & exceptions

• Applies only to the specific browser and device, and not to Roku Devices or mobile devices.
• Rejecting or removing cookies may break features of the Sites.
• The opt-out preference is stored in a cookie, so clearing cookies or changing browser or computer reset it.

Not stated here

• Which cookies are classed as essential is not stated here.

Security & Safeguards · Company practice

Roku says it uses industry-standard security and that risk cannot be removed

Roku states that it uses industry-standard methods to secure electronic databases of personal information, and immediately qualifies this: no company, including Roku, can fully eliminate security risks associated with personal information. The advice that follows puts part of the burden on the user — a strong password, not reusing the password from other accounts or services, and protecting usernames and passwords. So the safeguard is described by standard rather than specifics, and residual risk is acknowledged.

Supporting quotations

We use industry-standard methods of securing electronic databases of personal information. However, you should know that no company, including Roku, can fully eliminate security risks associated with personal information.

Qualifications & exceptions

• Described as industry-standard methods applied to electronic databases of personal information.
• Roku states expressly that no company can fully eliminate security risks.

Not stated here

• The document does not describe the specific safeguards used.

Sharing & Disclosure · Company practice

Your information may be stored and processed anywhere Roku operates, including weaker-privacy countries

Roku describes itself as a global company whose processes and systems cross borders, and says information may be held on Roku Devices, on a mobile device using Roku's apps, or on Roku's servers, and may be transferred to, accessed from, or stored and processed globally in any country where Roku or its service providers maintain facilities or call centers. It names the consequence for the user: that includes jurisdictions whose data privacy laws may not give protections equivalent to those at home. Storage location is therefore not promised to be the user's own country.

Supporting quotations

may be transferred to, accessed from, or stored and processed globally in any other country where Roku or its service providers maintain facilities or call centers, including jurisdictions that may not have data privacy laws that provide protections equivalent to those provided in your home country.

Qualifications & exceptions

• May be held on the device, on the mobile app, or on Roku servers.
• Reaches any country where Roku or its service providers keep facilities or call centers.
• Roku acknowledges some of those countries may lack protections equivalent to the user's.

Not stated here

• Which countries are involved is not listed.

Security & Safeguards · Company practice

Once abroad, your information is subject to that country's law and possible government access

Roku states the legal consequence of the transfer: while information is outside the user's country of residence it is subject to the laws of the country where it is held, and may be subject to disclosure to the governments, courts, or law enforcement or regulatory agencies of that country under its laws. Against that, Roku commits to protect all personal information it obtains in accordance with this Privacy Policy and to take reasonable steps to ensure it is treated lawfully. The commitment is expressed without naming any transfer mechanism.

Supporting quotations

While such information is outside of your country of residence, it is subject to the laws of the country in which it is held, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country.

We will protect all personal information we obtain in accordance with this Privacy Policy and take reasonable steps to ensure that it is treated lawfully.

Qualifications & exceptions

• Applies while the information is outside the user's country of residence.
• Possible disclosure is to governments, courts, or law enforcement or regulatory agencies of the holding country.
• Roku's stated safeguard is protecting the information per this policy plus reasonable steps for lawful treatment.

Not stated here

• No transfer mechanism or contractual safeguard is identified.

Retention & Deletion · Company practice

Retention runs as long as Roku's business purposes or the law require

Roku's retention rule is purpose-linked: personal information may be retained for as long as needed to fulfil legitimate business purposes, including the uses listed under Part II, or for a period specifically required or allowed by applicable regulations or laws. No fixed period is given, so retention can continue while a business purpose does, and the lawful allowance can extend it further.

Supporting quotations

Personal information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in “Information Usage” under Part II, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• Tied to legitimate business purposes including the Part II uses.
• Can also rest on a period specifically required or allowed by applicable law.

Not stated here

• No maximum or review period is stated.

Legal Rights & Agreement Rules · Context

A supplemental notice covers twenty listed US states and their privacy statutes

Roku adds a notice for residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, supplementing the rest of the policy and applying to residents of those states whose data Roku processes as a business or controller. It says it describes how to exercise rights under the named state statutes, which it collects together as the U.S. State Privacy Laws — the California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia acts. The statutes themselves are not part of this document; their requirements are outside what this text supplies.

Supporting quotations

It also describes how you exercise the rights under the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Delaware Personal Data Privacy Act, the Florida Digital Bill of Rights, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the New Hampshire Data Privacy Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act (collectively the “U.S. State Privacy Laws”).

Qualifications & exceptions

• Applies to residents of the twenty named states whose data Roku processes as a business or controller.
• Supplements, rather than replaces, the rest of the policy.

Not stated here

• The text of the named state statutes is not supplied here, so what each requires is not resolved by this document.

Legal Rights & Agreement Rules · Context

The notice defines Personal Information by reference to the listed state laws

For this part the notice defines Personal Information as information that the laws listed in the part define as Personal Information or Personal Data, and then excludes three things: information that is publicly available as those laws define it, information that is deidentified or aggregated, and information otherwise excluded from those laws' scope. The definition is therefore circular by design — it inherits whatever the listed state statutes say rather than fixing a meaning here. The text also refers to itself as Part VI while appearing under the heading for Part VII; the document's own section numbering is inconsistent at this point, which is worth flagging rather than silently correcting.

Supporting quotations

For the purpose of this section (Part VI), “Personal Information” means information that the laws listed in this Part VI define as “Personal Information or “Personal Data”. Personal Information does not include information that is:

Publicly available, as defined by the applicable U.S. State Privacy Laws.

Deidentified or aggregated.

Otherwise excluded from the scope of the applicable U.S. State Privacy Laws.

Qualifications & exceptions

• Excludes publicly available information as the applicable state laws define it.
• Excludes deidentified or aggregated information.
• Excludes information otherwise outside the scope of those laws.

Not stated here

• The notice names itself Part VI in this sentence though it sits under Part VII; this text does not resolve which numbering governs.

Legal Rights & Agreement Rules · Context

Where state laws differ, the law of your own state supplies the meaning

The notice resolves conflicts by reference to the reader's own state: if a term used there has a different meaning under different U.S. State Privacy Laws, the term takes the meaning under the law of the state where the user resides. The notice again calls itself Part VI in this sentence. Which meaning applies therefore depends on residency, and the document does not tell a user which state's law is treated as theirs.

Supporting quotations

In the event that a term used in this Part VI has a different meaning under different U.S. State Privacy Laws, such term shall have the meaning under the laws of the state in which you reside.

Qualifications & exceptions

• Applies only where a term differs between the listed state laws.
• Resolved by the law of the resident's own state.

Not stated here

• How Roku determines a user's state of residence is not stated.

Data Access & Collection · Company practice

The state notice restates that Roku also gathers information about you from outside sources

Restating Part I for the state notice, Roku says it collects Personal Information when the user provides it or automatically through the Roku Services, and may also obtain information from other sources. The listed sources mirror earlier sections: third-party platforms, devices and services used to reach the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers including payment service providers, providers of accounts linked to the Roku account, participating merchants and their partners, and other users who referred the person or provided their information. The list makes explicit what Part I implied — data about a user can originate almost entirely elsewhere.

Supporting quotations

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• Also covers information the user provides directly or that is collected automatically through the Roku Services.
• The source list includes linked-account providers, merchants and other users who referred or provided the person's information.

Not stated here

• No categories or limits are attached to what each source may supply.

Data Access & Collection · Context

The California table begins with identifiers as a category collected, processed and disclosed

The disclosure table lists categories of Personal Information collected, processed and disclosed to third parties, together with the purposes and the recipients for cross-context behavioral advertising or sale. Its first row is identifiers, given as device identifiers, internet protocol addresses, browser cookies and other unique online identifiers. The row sits in a table whose other columns — purposes and sharing or sale recipients — are filled in by the rows that follow in this notice.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

Qualifications & exceptions

• Named items are device identifiers, IP addresses, browser cookies and other unique online identifiers.
• Listed in a table covering categories collected and processed, purposes, and sharing or sale for cross-context behavioral advertising.

Not stated here

• This row does not itself state the purposes or recipients; those appear in the table's other columns.

Use & Processing · Context

One listed purpose is providing the services and processing your orders

In the purposes column, Roku repeats its Part II purpose of providing and maintaining the Roku Services and processing and fulfilling requests or orders. The state notice therefore presents the same operational purpose as the basis for handling identifiers and the other listed categories.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

Qualifications & exceptions

• Stated in the purposes column of the California categories table.

Not stated here

• The table does not tie individual purposes to individual categories on its face.

Use & Processing · Context

Improvement and advertising correlations appear as a listed purpose

Another row of the purposes column restates analysing the user base and service use, improving and enhancing the Roku Services — again including building correlations for Roku's advertising services to better serve advertisers — and developing new products, services, features and functionality. The advertising-correlation language from Part II is therefore carried into the state notice's purpose list.

Supporting quotations

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

Qualifications & exceptions

• Stated in the purposes column of the California categories table.
• Advertising correlations are included in this purpose as in Part II.

Not stated here

• Which categories are processed for this purpose is not stated in the row itself.

Use & Processing · Context

Personalizing your experience is a listed purpose in the state notice

The purposes column also restates personalizing the user's experience on the Roku Services, including suggesting and offering relevant content and recommendations. The notice thus presents personalization as a purpose for processing the listed categories, consistent with Part II.

Supporting quotations

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• Stated in the purposes column of the California categories table.

Not stated here

• No opt-out is attached to this purpose in the table itself.

Use & Processing · Context

The identifiers row lists targeted advertising and ad measurement as purposes

In the California categories table, the purposes column for identifiers includes showing ads, including targeted ads, through the Roku Services, on Third-Party Channels and on third-party websites, mobile apps, platforms and devices; measuring and understanding reach, viewership and advertising effectiveness; providing advertising analytics and reporting; and helping advertisers and advertising partners reach a desired audience and understand, measure and improve their campaigns. The same advertising language appears again later for other categories, so advertising purposes run across the listed categories rather than belonging to one row.

Supporting quotations

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

Qualifications & exceptions

• Given in the purposes column for the identifiers row and repeated for later categories.
• Includes cross-property targeted advertising and ad measurement and reporting.

Not stated here

• The table does not indicate which categories are used for each of these advertising purposes beyond their appearance in the row.

Use & Processing · Context

Marketing, business metrics, service messages, enforcement and fraud purposes are listed too

The same column also states marketing purposes, including alerts, notifications, emails and text messages about products, events, promotions and offers from Roku or its partners and measuring marketing effectiveness; measuring performance and analysing business metrics; sending service information such as confirmations, invoices, notices, updates, security alerts, surveys and support messages and responding to the user; enforcing terms and protecting the business, partners or users and complying with contractual and legal obligations; and protecting, investigating and deterring fraudulent, unauthorized, infringing or illegal activity including click fraud. The purposes therefore reproduce Part II's list inside the state notice.

Supporting quotations

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Each row restates a Part II purpose rather than adding a new one.
• Enforcement and fraud purposes are included alongside marketing and metrics.

Not stated here

• Nothing in the table distinguishes which categories each purpose applies to beyond the row structure.

Sharing & Disclosure · Context

Advertising, app, content and platform recipients are named for sharing or sale

The recipients column names who receives the information for cross-context behavioral advertising or sale: advertisers, ad networks, advertising partners and ad measurement providers, to bring more relevant ads and report campaign effectiveness; app providers whose app is installed on the Roku Device and content providers from whom content is purchased or subscribed, for discovery, a tailored experience, the providers' own analytics and reporting, or relevant ads and campaign reporting; and third-party platforms and devices used to access the Roku Services, to help them bring more relevant ads and report effectiveness. The same recipient list recurs for later categories, so these recipients receive more than one category of information.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Given as recipients for cross-context behavioral advertising or sale.
• Recipients include the providers' own analytics use, not only Roku's.

Not stated here

• The table does not say whether each recipient receives every category.

Data Access & Collection · Context

Account registration information is its own category, including payment card details

The table's second category is account registration information, defined as name, address, email address, telephone number, and payment method and card number. Listing payment method and card number as part of registration information brings payment credentials into the category list for the state notice.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

Qualifications & exceptions

• Category B in the California table.
• Named fields include payment method and card number.

Not stated here

• The table does not state retention or deletion for this category.

Data Access & Collection · Context

Characteristics protected under California or federal law form a category

Category C is characteristics of protected classifications under California or federal law — for example characteristics such as race, religion or age. Roku lists this category among those collected, processed and disclosed, and the same purposes column follows it.

Supporting quotations

C. Characteristics of protected classifications under California or Federal law

Qualifications & exceptions

• Category C in the California table.
• Framed by reference to California or federal protected classifications.

Not stated here

• The document does not say what specific characteristics Roku holds, or how they are obtained.

Data Access & Collection · Context

Purchase and consumption histories form another listed category

Category D is commercial information, including records of personal property, products or services purchased, obtained or considered, and other purchasing or consuming histories or tendencies. It therefore covers not only completed purchases but things considered, so browsing and shopping behaviour can fall in this row.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Qualifications & exceptions

• Category D in the California table.
• Reaches products or services considered as well as purchased, obtained or subscribed to.

Not stated here

• How inferences about tendencies are drawn is not stated.

Use & Processing · Context

Account registration information is processed for the same list of purposes

The purposes column repeats for the account registration row: providing and maintaining the services and fulfilling orders; understanding and analysing the user base and improving the services, including building correlations for Roku’s advertising services; personalizing the experience with relevant content and recommendations; marketing messages about Roku and partner offers; measuring performance and key business metrics; service communications and customer care; enforcing terms, protecting the business, partners or users and complying with contractual and legal obligations; and protecting, investigating and deterring fraudulent, unauthorized, infringing or illegal activity. Registration details are therefore not held to a narrower set of purposes than other categories.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Restates the Part II purpose list within the California categories table.
• Applies to the account registration information row, including payment method and card number.

Not stated here

• The table does not distinguish which of these purposes apply to which registration field.

Use & Processing · Context

Protected-classification and commercial information rows carry the same purposes again

The purposes column repeats for the protected-classification and commercial-information rows: providing and maintaining the services and fulfilling orders; understanding the user base and improving the services, again including building correlations for Roku’s advertising services; personalizing the experience with relevant content and recommendations; showing ads including targeted ads across Roku and third-party properties with measurement and reporting; marketing messages about Roku and partner offers; business metrics; and enforcing terms, protecting the business, partners or users and complying with contractual and legal obligations. The same purposes list therefore applies to sensitive and purchasing categories alike.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

Qualifications & exceptions

• Restates the Part II purpose list for categories C and D of the California table.
• Advertising correlations and cross-property targeted ads appear for these categories too.

Not stated here

• The table does not limit any purpose to a particular category.

Use & Processing · Context

Commercial information carries the full set of listed processing purposes

For the commercial-information row the purposes column runs from providing and maintaining the Roku Services and fulfilling requests or orders, through understanding the user base and improving the services (including building correlations for Roku's advertising services to serve its advertisers) and developing new products, to personalisation, advertising, marketing, business metrics, service communications and customer service, enforcing terms and legal obligations, and deterring fraud including click fraud. The advertising purpose is stated to reach the Roku Services, Third-Party Channels and third-party websites, apps, platforms and devices, and to include measuring reach, viewership and campaign effectiveness and helping advertisers reach and improve campaigns.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Improvement and analysis is described as including correlations built for Roku's advertising services to better serve its advertisers.
• The advertising purpose extends beyond Roku's own surfaces to third-party websites, apps, platforms and devices.
• Fraud prevention names click fraud as the example.

Sharing & Disclosure · Context

Commercial information goes to advertisers and ad measurement providers

The recipients column for the commercial-information row names advertisers, ad networks, advertising partners and ad measurement providers, and states the reason in the row itself: to bring you more relevant ads and report on the effectiveness of ad campaigns. That connects buying and consumption histories with advertising recipients rather than only with the service.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of this disclosure is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Browsing, search and interaction with websites, apps and ads form a listed category

Category E is internet or other electronic network activity information, described as including browsing history, search history and information about a consumer's interaction with an internet website, application or advertisement. The category is therefore defined by behaviour across services and ads, not by a fixed list of fields.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

Qualifications & exceptions

• The list is introduced as non-exhaustive ("including, but not limited to").
• Interaction with an advertisement is itself listed as part of the category.

Use & Processing · Context

Internet activity is tied to the same nine purposes in the state notice

The purposes column for category E repeats the pattern used for the earlier rows: providing and maintaining the services and fulfilling requests or orders; understanding and improving the services with advertising correlations and new product development; personalisation with suggested content; targeted advertising across Roku, Third-Party Channels and third-party properties with measurement and reporting; marketing messages from Roku or its partners; business metrics; service communications and customer service; enforcing terms and legal obligations; and deterring fraud and illegal activity. Reading the row together with its recipients shows browsing and app-interaction data feeding both advertising and the provider-facing recipient list.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Each purpose is stated as a row entry without a stated legal basis in this table.

Sharing & Disclosure · Context

Internet activity reaches app, content and platform providers as well as ad partners

Category E is the first row read here whose recipients column names three groups. Advertisers, ad networks, advertising partners and ad measurement providers receive it for relevant ads and campaign reporting. App providers whose app is installed on the Roku Device, and content providers from whom content is purchased or subscribed, receive it to help discover content and provide a tailored experience, for the providers' own analytics and reporting, or for relevant ads and campaign reporting. Third-party platforms and devices used to access the Roku Services receive it to bring more relevant ads and report campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• The app-provider recipient is limited to an app installed on the Roku Device.
• Content providers are recipients only where the user purchases or subscribes to content from them.
• Each recipient group comes with its own stated purposes rather than one shared purpose.

Data Access & Collection · Context

General geolocation is a listed category, down to designated market area and postal code

Category F is general geolocation data, described as general location and geographical information including designated market area, country, province, state, city and postal code. The examples show household-level rather than precise coordinates, and the row is placed separately from the device and network categories already described.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

Qualifications & exceptions

• The category is described as general location, and every listed example is a coarse geographic unit.

Not stated here

• The table does not say here whether precise device location is collected outside this category.

Use & Processing · Context

General geolocation supports service operation, improvement and personalisation

The purposes column for category F opens with providing and maintaining the Roku Services and fulfilling requests or orders, then understanding and improving the services with advertising correlations and new-product development, then personalising the experience with suggested content and recommendations. The row continues beyond these entries in the same table.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• These are the row's opening entries; the purposes list is not complete at this point in the table.

Use & Processing · Context

General geolocation also feeds advertising, marketing and business metrics

The rest of category F's purposes column adds targeted advertising across Roku, Third-Party Channels and third-party sites, apps, platforms and devices with measurement and campaign reporting; marketing messages and marketing-effectiveness measurement; business metrics; service communications and customer service; enforcement of terms and legal obligations; and fraud prevention including click fraud. Together with the opening entries read earlier, general geolocation is tied to the same full purpose list as the other broad categories.

Supporting quotations

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• The advertising purpose reaches third-party properties, not only Roku's own services.

Sharing & Disclosure · Context

General geolocation is disclosed to advertising and ad-measurement recipients

The recipients column for category F names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. The row pairs a coarse location category with advertising recipients rather than with service providers.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of this disclosure is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Precise geolocation is listed as a category separate from general location

Category G is stated only as "Precise geolocation". The table places it in its own row, distinct from the general geolocation row that lists designated market area, country, province, state, city and postal code, so the notice separates coarse location from precise location rather than treating them as one category.

Supporting quotations

G. Precise geolocation

Qualifications & exceptions

• The source gives no examples or definition of precise location in this row.

Use & Processing · Context

Precise geolocation carries the shortest purpose list: service, personalisation and fraud

The purposes column for category G contains only three entries: providing and maintaining the Roku Services and fulfilling requests or orders, personalising the experience, and preventing, investigating and deterring fraudulent, unauthorised, infringing or illegal activity including click fraud. Unlike the rows around it, this row does not list advertising, marketing, business metrics, service communications or general improvement as purposes.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• The response is personalisation without the content-and-recommendations wording used in other rows.
• No advertising or marketing purpose appears in this row.

Not stated here

• The table does not explain why precise location has fewer purposes than general location.

Data Access & Collection · Context

Audio, visual, thermal and similar information is a listed category

Category H covers audio, electronic, visual, thermal, olfactory or similar information. The category is described by the type of sensor data rather than by the product feature that captures it, and it sits between precise location and inferences in the table.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

Qualifications & exceptions

• "Similar information" extends the category beyond the four named types.

Not stated here

• The notice does not say here which Roku features produce each listed type of information.

Use & Processing · Context

Audio and visual data is listed for service, metrics, communications and security uses

The purposes column for category H lists providing and maintaining the services and fulfilling orders; understanding the user base and improving the services with advertising correlations and new-product development; business metrics; service communications and customer service; enforcing terms and legal obligations; and preventing fraud and illegal activity. Personalisation, targeted advertising and marketing do not appear in this row.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• The improvement entry still mentions correlations built for Roku's advertising services even though this row lists no advertising purpose.

Inference & Profiling · Context

Inferences about preferences and interests are their own category

Category I is inferences drawn from Personal Information, including preferences, interests and other information used to personalise the experience. The notice therefore treats derived conclusions, not just the underlying observations, as a category that is processed and disclosed.

Supporting quotations

I. Inferences drawn from Personal Information, including your preferences, interests, and other information used to personalize your experience

Qualifications & exceptions

• The examples tie the category to personalisation, while the row's purposes also include advertising.

Use & Processing · Context

Inferences carry the full nine-purpose list in the state notice

The purposes column for category I is the full list: providing and maintaining the services and fulfilling orders; understanding and improving the services, including advertising correlations and new products; personalisation with suggested content and recommendations; targeted advertising across Roku and third-party properties with measurement and reporting; marketing messages; business metrics; service communications and customer care; enforcement and legal obligations; and fraud prevention. The inferences row is thus tied to advertising as directly as the identifiers row.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Advertising and marketing are both listed, so inferences are not confined to personalising content.

Sharing & Disclosure · Context

Inferences are disclosed to the same advertising recipients

The recipients column for category I names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. Because the category is derived preferences and interests, this row connects Roku's own inferences to advertising recipients.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of this disclosure is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Professional or employment information is a listed category

Category J is professional or employment information. The row is stated as a bare category name, and its purposes column begins with understanding and improving the services and personalising the experience. The table treats workplace information as part of the same state-notice disclosure scheme as the consumer categories above it.

Supporting quotations

J. Professional or Employment Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• The source gives no examples or definition of professional or employment information.

Not stated here

• The notice does not say here when Roku collects employment information about a consumer.

Use & Processing · Context

Employment information is also used for advertising, marketing and enforcement

The rest of category J's purposes column adds targeted advertising across Roku, Third-Party Channels and third-party properties with campaign measurement and reporting; marketing messages and marketing-effectiveness measurement; business metrics; and enforcement of terms and legal obligations. With the earlier entries, professional or employment information is tied to advertising and marketing, not only to workplace administration.

Supporting quotations

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• Advertising here again extends to third-party websites, apps, platforms and devices.

Sharing & Disclosure · Context

Employment information goes to advertising and ad-measurement recipients

The recipients column for category J names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. The row therefore places employment information in the same disclosure channel as the consumer activity categories.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of this disclosure is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Education information is listed as its own category

Category K is education information. The source states the category name without examples, and the row carries its own purposes and advertising recipients, so schooling information sits alongside the consumer categories in the same notice.

Supporting quotations

K. Education Information

Qualifications & exceptions

• The source gives no examples or definition of education information.

Not stated here

• The notice does not say here how education information is obtained from a Roku user.

Use & Processing · Context

Education information is processed for improvement, personalisation, ads and marketing

The purposes column for category K lists understanding and improving the services with advertising correlations and new products; personalisation with suggested content and recommendations; targeted advertising across Roku and third-party properties with measurement and reporting; marketing messages; business metrics; and enforcement of terms and legal obligations. Service communications, customer care and fraud prevention do not appear in this row.

Supporting quotations

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• This row lists advertising and marketing for education information.

Sharing & Disclosure · Context

Education information is disclosed to advertising and ad-measurement recipients

The recipients column for category K names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of this disclosure is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Racial origin, religion, union membership and health form a sensitive category

Category L is Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, and health and wellness information. The row groups these sensitive attributes together as one category, separate from the identifiers, activity, location and inference rows.

Supporting quotations

L. Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, health, and wellness information

Qualifications & exceptions

• The category is defined by what the information reveals, not by the source it came from.

Cross-references

• contrast (model-proposed): The Iowa and Utah sensitive row is narrower: race, religion, health and wellness — Both charts have a separate sensitive-attribute row, but the attribute lists differ: the California row names racial or ethnic origin, religious or philosophical beliefs, union membership, health and wellness, while the Iowa and Utah row names racial or ethnic origin, religious beliefs, health and wellness. Philosophical beliefs and union membership appear only in the California version.

Use & Processing · Context

Sensitive-category information is listed for advertising and marketing too

The purposes column for category L repeats the pattern: improvement and advertising correlations, personalisation, targeted advertising across Roku and third-party properties with measurement and reporting, marketing messages, business metrics and enforcement of terms and legal obligations. As written, the row does not carve these sensitive attributes out of advertising or marketing.

Supporting quotations

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• The row itself lists advertising and marketing; no exception for sensitive attributes appears in this row.
• Service communications and fraud prevention are absent from this row.

Not stated here

• Whether another part of the policy limits advertising use of these sensitive attributes is not stated in this row.

Cross-references

• qualified by (model-proposed): The California list covers know, access, correct, delete, opt out, limit and appeal — The California chart lists targeted advertising and marketing for the category that reveals racial or ethnic origin, religion, union membership and health, while the same part's rights list offers a right to limit use or disclosure of sensitive Personal Information where permitted by law. The limit right is the control the reader has over the advertising use the row describes.

Sharing & Disclosure · Context

Sensitive-category information is disclosed to advertising recipients

The recipients column for category L names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. Combined with the purposes column, the row connects sensitive attributes to advertising recipients.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of this disclosure is relevant ads and campaign-effectiveness reporting.

Not stated here

• The row does not distinguish recipients that act as service providers from those receiving the data for their own purposes.

Data Access & Collection · Context

Log-in credentials, government identifiers and others' messages form the last category

Category M covers information that reveals three things: account log-in details, financial account, debit or credit card numbers together with any required security or access code, password or credential; social security, driver's license, state identification card or passport numbers; and the content of consumer emails, texts and messages where Roku is not the intended recipient. The third prong concerns messages addressed to someone else.

Supporting quotations

M. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

Qualifications & exceptions

• Card numbers count only in combination with a required security or access code, password or credential.
• The message-content prong is limited to messages where Roku is not the intended recipient.

Use & Processing · Context

Credential and message data carries only service, enforcement and fraud purposes

The purposes column for category M is limited to providing and maintaining the Roku Services and fulfilling requests or orders, enforcing terms and protecting the business, partners or users and complying with contractual and legal obligations, and preventing, investigating and deterring fraudulent, unauthorised, infringing or illegal activity including click fraud. Advertising, marketing and personalisation do not appear for this category.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• No advertising, marketing or personalisation purpose is listed in this row.

Sharing & Disclosure · Company practice

Every chart category was disclosed to service providers and sold or shared in 12 months

After the chart, Roku states that over the past 12 months it has disclosed each chart category for a business purpose to service providers and contractors, and that over the same period it has collected, processed, disclosed, shared for cross-context behavioral advertising and sold each of those categories. The same passage limits the sale and sharing statement: Roku says it has no actual knowledge of selling or sharing the Personal Information of consumers under 16, and states that it does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship status.

Supporting quotations

Over the past 12 months, Roku has disclosed for a business purpose each of the categories of Personal Information as described in the chart above to service providers and contractors.

Over the past 12 months, Roku has collected, processed, disclosed, shared for cross-context behavioral advertising, and sold each of the categories of Personal Information as described in the chart above. Roku does not have actual knowledge that it sells Personal Information or shares for cross-context behavioral advertising the Personal Information of consumers under 16 years of age. Roku does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status.

Qualifications & exceptions

• The 12-month statements are limited to service providers and contractors for the business-purpose disclosure sentence.
• Roku denies actual knowledge of selling or sharing under-16 Personal Information rather than stating an absolute bar.
• Genetic and biometric information, neural data, information on sex life or sexual orientation, and citizenship status are stated as not collected.

Not stated here

• The chart does not say which named recipients act as service providers and which receive the information for their own purposes.

Retention & Deletion · Company practice

State-notice retention lasts while its Section 2 purposes or the law require it

In the state notice, Roku says Personal Information may be kept as long as needed for legitimate business purposes, including the purposes outlined in Section 2 of the same Supplemental U.S. State Law Privacy Notice, or for a period specifically required or allowed by applicable regulations or laws. The state notice therefore measures retention against its own purposes section rather than naming a fixed period.

Supporting quotations

Retention

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• The retention period is defined by business purposes and by law, not by a stated number of months or years.
• "Required or allowed" brings permissive statutory retention periods into scope as well as mandatory ones.

Not stated here

• No concrete retention period is given in this item.

Legal Rights & Agreement Rules · User right or choice

California residents get the listed rights subject to exceptions

The notice states that California residents may exercise the following rights, subject to certain exceptions. The exceptions are not enumerated in this introduction, so each listed right is qualified by them without saying what they are.

Supporting quotations

Your California Privacy Rights

If you are a California resident, subject to certain exceptions, you may exercise the following rights:

Qualifications & exceptions

• Every right in the list is stated as subject to unspecified exceptions.
• The rights are offered to California residents.

Not stated here

• The introduction does not say what the exceptions are or where they are stated.

Account & Service Control · User right or choice

The California list covers know, access, correct, delete, opt out, limit and appeal

The listed rights are: to know what Personal Information has been collected, including categories, sources, business or commercial purposes, third parties receiving it, categories sold or shared and the recipients of each, and categories disclosed for a business purpose with the service providers or contractors for each; to access specific pieces in a portable and readily usable format to the extent technically feasible; to correct inaccurate information; to request deletion; to opt out of the sale of Personal Information or its sharing for cross-context behavioral advertising; to limit use or disclosure of sensitive Personal Information where permitted by law; not to be retaliated against for exercising rights; and to appeal any decision on a privacy request.

Supporting quotations

The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, the categories of Personal Information that the business sold or shared, and for each category identified, the categories of third parties to whom it sold or shared that particular category of Personal Information, and the categories of Personal Information that the business disclosed for a business purpose, and for each category identified, the categories of service providers or contractors to whom it disclosed that particular category of Personal Information.

The right to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.

The right to correct inaccurate Personal Information that we maintain about you.

The right to request deletion of the Personal Information that we have collected about you.

The right to opt out of the sale of Personal Information, or the sharing of Personal Information for cross-context behavioral advertising.

The right to limit our use or disclosure of your sensitive Personal Information, where permitted by law.

The right to not be retaliated against for the exercise of your privacy rights.

The right to appeal any decision with regard to your privacy request

Qualifications & exceptions

• The access right is portable and readily usable only to the extent technically feasible.
• The right to limit sensitive Personal Information applies where permitted by law.
• The right to know extends to per-category recipient information for sale, sharing and business-purpose disclosure.

Not stated here

• The notice does not state here how an appeal is filed or how long Roku takes to decide one.

Cross-references

• qualifies (model-proposed): Sensitive-category information is listed for advertising and marketing too — The California chart lists targeted advertising and marketing for the category that reveals racial or ethnic origin, religion, union membership and health, while the same part's rights list offers a right to limit use or disclosure of sensitive Personal Information where permitted by law. The limit right is the control the reader has over the advertising use the row describes.

Account & Service Control · Procedure

Know, correct and delete requests go through an online form and identity checks

Requests to know, access, correct or delete are submitted through Roku's online form, and are subject to Roku's ability to reasonably verify identity where it has the right or obligation to do so. Account holders are verified by logging into the account; people without an account are asked for data elements Roku may already hold, such as device type, device ID and cookie ID, through the form or privacy@roku.com.

Supporting quotations

You can submit a right to know/access, correct, and deletion request to through our online form. Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law. If you have a Roku account, we will verify your identity by asking you to log into your account. If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.

Qualifications & exceptions

• Verification applies where Roku has the right or obligation to verify under applicable law.
• Without an account, Roku relies on data elements it may already hold to match the request.

Account & Service Control · Procedure

Opt-out and sensitive-data limits run through a choices page, device settings and GPC

Opting out of the sale of Personal Information or of sharing for cross-context behavioral advertising, and limiting use of sensitive Personal Information where permitted by law, can be done at Roku's Your Privacy Choices page or in the Privacy section of the Settings menu of Roku players and Roku TV models. For the Roku Sites, a browser Global Privacy Control signal is treated as a sale and sharing opt-out request; when logged in it applies to that account, and when not logged in or without an account it applies to the browser from which the signal is received, subject to Roku's ability to associate the signal with the user's information.

Supporting quotations

You can exercise your right to opt out of the “sale” of your Personal Information, or the “sharing” of your Personal Information for cross-context behavioral advertising, and limit our use of your sensitive Personal Information, where permitted by law, by visiting Roku’s Your Privacy Choices page or visiting the Privacy section of the Settings menu of your Roku players and Roku TV models. If you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a “sale” and “sharing” opt-out request. When you are logged into your Roku account, we honor a GPC signal as a request to opt out of the “sale” and “sharing” of personal information for that account. When you are not logged into a Roku account or you do not have a Roku account, we honor a GPC signal as a request to opt out of the “sale” and “sharing” of personal information for the browser from which the signal is received, subject to our ability to associate the signal with your information.

Qualifications & exceptions

• The sensitive-information limit is offered where permitted by law.
• The GPC treatment is stated for visits to a Roku Site using a browser with the signal enabled.
• The browser-level GPC opt-out is subject to Roku's ability to associate the signal with the person's information.

Not stated here

• The notice does not say how an opt-out set in device settings relates to an opt-out set on the choices page.

Account & Service Control · Procedure

An authorized agent needs signed permission and Roku may still verify the consumer

Where applicable law permits, another person may submit a request as the consumer's Authorized Agent through the same methods. The agent should submit proof of signed permission, and Roku may still require the consumer to verify identity directly and to confirm directly that the agent was authorized.

Supporting quotations

Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above. Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request. We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Qualifications & exceptions

• Authority for an agent to act applies where permitted by applicable law.
• Roku keeps the option of direct verification and direct confirmation from the consumer.

Data Access & Collection · Company practice

Roku says it does not collect genetic, biometric, neural or citizenship information

In the same 12-month statement that accompanies the categories chart, Roku says it does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status. The sentence is a list of excluded data types stated as a company practice, placed directly after the statement that every chart category has been collected, processed, disclosed, shared and sold.

Supporting quotations

Over the past 12 months, Roku has collected, processed, disclosed, shared for cross-context behavioral advertising, and sold each of the categories of Personal Information as described in the chart above. Roku does not have actual knowledge that it sells Personal Information or shares for cross-context behavioral advertising the Personal Information of consumers under 16 years of age. Roku does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status.

Qualifications & exceptions

• The statement is an assertion about what Roku does not collect, not a list of categories withheld from sale or sharing.
• It sits in the state notice, next to the categories chart, rather than in the general collection part.

Not stated here

• Whether the exclusion covers information about a user's citizenship held for account or tax purposes is not stated.

Legal Rights & Agreement Rules · User right or choice

Shine the Light requests are free, once a calendar year, by email

The notice's Shine the Light item says California residents may request and receive, once per calendar year and free of charge, information about Roku's sharing of Personal Information with third parties for those third parties' own direct marketing use. Requests go to privacy@roku.com.

Supporting quotations

California’s Shine-the-Light Law.

California’s Shine the Light law permits California residents to request and receive, once per calendar year and free of charge, information about our sharing of your Personal Information (if any) with third parties for their own direct marketing use. If you are a California resident and would like to make such a request, please email privacy@roku.com. In your request, please include your name and attest to the fact that you are a California resident and provide a current California address. We may ask you for additional information to confirm your identity before responding to this request.

Qualifications & exceptions

• Limited to one request per calendar year.
• The information concerns sharing with third parties for their own direct marketing use.

Legal Rights & Agreement Rules · Procedure

A Shine the Light request must attest California residency and give a California address

The Shine the Light paragraph sets out what a request must contain: the requester's name, an attestation that the person is a California resident, and a current California address, sent by email to privacy@roku.com. Roku may ask for additional information to confirm identity before responding, so the statutory right is exercised through an identity-checked written request rather than an automatic disclosure.

Supporting quotations

California’s Shine the Light law permits California residents to request and receive, once per calendar year and free of charge, information about our sharing of your Personal Information (if any) with third parties for their own direct marketing use. If you are a California resident and would like to make such a request, please email privacy@roku.com. In your request, please include your name and attest to the fact that you are a California resident and provide a current California address. We may ask you for additional information to confirm your identity before responding to this request.

Qualifications & exceptions

• The right is limited to California residents who provide a current California address.
• Roku may request additional identity-confirming information before it responds.

Not stated here

• The paragraph does not state a response deadline.

Legal Rights & Agreement Rules · Context

The general state part names seventeen states, without Iowa or Utah

The notice's general state part opens with its own list: Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas and Virginia. That is seventeen states, while the notice's introduction describes it as applying to residents of twenty states, adding California, Iowa and Utah. California has its own part in the same notice; Iowa and Utah are not named in this list.

Supporting quotations

B. Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia

This additional notice is for residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and supplements the information contained in the Privacy Policy and applies to residents of those states whose data we process as a business or controller. It also describes how you exercise the rights under the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Delaware Personal Data Privacy Act, the Florida Digital Bill of Rights, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the New Hampshire Data Privacy Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act (collectively the “U.S. State Privacy Laws”).

Qualifications & exceptions

• California is covered by a separate part of the same notice, so its absence from this list is expected.
• Iowa and Utah appear only in the introduction's longer list.

Not stated here

• The notice does not say here whether Iowa and Utah residents are covered by this part or another part.

Cross-references

• qualifies (model-proposed): Iowa and Utah residents get a separate sensitive-data opt-out sub-part — The general state part lists seventeen states and leaves Iowa and Utah unnamed, and the later Iowa and Utah sub-part supplies the treatment for those two states: a sensitive-data opt-out rather than the general rights list. The two cards together account for the twenty states the notice's introduction names.

Data Access & Collection · Context

The general state part restates direct and third-party collection sources

The sources item says Personal Information comes from the user directly or automatically through the Roku Services, and may also be obtained from third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers including payment service providers, providers of accounts linked to the Roku account, participating merchants and their partners, and other users who referred the person or provided the information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services. We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• Third-party collection is stated as something Roku may do, not as a fixed list of every source.
• Other users are a source where they referred the person or provided the information.

Sharing & Disclosure · Context

The general state table separates disclosures from recipients of sold information

The second categories chart is built on four columns: categories of Personal Information collected and processed; the purposes for processing; categories of third parties to whom the information is disclosed; and categories of third parties to whom the information is sold, together with the purpose. Splitting the third-party columns this way means a recipient named in the disclosed column is not necessarily a purchaser in the sold column.

Supporting quotations

Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing

Categories of Personal Information Being Collected and Processed

The Purposes for Processing

Categories of Third Parties to Whom the Personal Information Is Disclosed

Categories of Third Parties to Whom the Personal Information is "Sold" and the Purpose

Qualifications & exceptions

• The sold column carries its own purpose statement, separate from the purposes column.
• Disclosure and sale are separate columns, so the same category can appear in one and not the other.

Data Access & Collection · Context

Identifiers head the general state chart, from device IDs to cookies and IP addresses

Category A is identifiers, described as including device identifiers, internet protocol addresses, browser cookies and other unique online identifiers. The examples are network- and device-level identifiers rather than account details, which appear in the next row.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

Qualifications & exceptions

• The list is introduced as inclusive rather than exhaustive.

Use & Processing · Context

Identifiers carry the nine processing purposes in the general state chart

The purposes column for identifiers lists service operation and order fulfilment; user-base analysis and service improvement with advertising correlations and new products; personalisation with suggested content; targeted advertising across Roku, Third-Party Channels and third-party properties with campaign measurement and reporting; marketing messages; business metrics; service communications and customer care; enforcement of terms and legal obligations; and fraud detection including click fraud.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Each purpose is presented as a row entry without a stated legal basis in the chart.

Sharing & Disclosure · Context

Identifiers are disclosed to ten groups, from vendors to other users and merchants

The disclosure column for identifiers names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; other users of the Roku Services; and merchants and their partners the person transacts with on the Roku Services. Unlike the California chart, this column names the recipient groups without adding a purpose beside each one.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Law enforcement is qualified to legal, security and safety matters, processes and requests.
• Merchant recipients are limited to merchants the person transacts with on the Roku Services.
• Other users appear as recipients of identifiers.

Sharing & Disclosure · Context

Identifiers listed as sold go to ad partners, installed-app providers and platforms

The sold column for identifiers names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign reporting; app providers where the app is installed on the Roku Device, and content providers from whom content is purchased or subscribed, for discovery, a tailored experience, the providers' own analytics and reporting, or relevant ads and campaign reporting; and third-party platforms and devices used to access the Roku Services, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• The app-provider entry is limited to apps installed on the Roku Device.
• Content providers are recipients only where the person purchases or subscribes to their content.

Not stated here

• The chart does not say whether the same recipients also appear in the disclosure column for identifiers.

Data Access & Collection · Context

Account registration information follows identifiers, opening with the service purpose

Category B is account registration information: name, address, email address, telephone number, and payment method and card number. Its purposes column opens with providing and maintaining the Roku Services and fulfilling requests or orders, and the row continues in the same chart below.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

Qualifications & exceptions

• Payment method and card number are treated as part of registration information.
• The purposes list quoted here is only the row's opening entry.

Use & Processing · Context

Registration information also drives personalisation, marketing and metrics

The rest of category B's purposes column adds user-base analysis and service improvement with advertising correlations and new products; personalisation with suggested content; marketing messages and marketing-effectiveness measurement; business metrics; service communications and customer care; enforcement of terms and legal obligations; and fraud prevention including click fraud. Registration details are therefore used well beyond setting up and running an account.

Supporting quotations

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Advertising and marketing are listed for account registration details.

Sharing & Disclosure · Context

Registration information goes to vendors, transacting providers, affiliates and authorities

The disclosure column for category B names service providers and vendors; channel and content providers from whom the person is purchasing or subscribing; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and merchants and their partners the person transacts with on the Roku Services. The row lists no recipients in the chart's sold column, unlike the identifiers row above it.

Supporting quotations

Service providers and vendors

Channel and content providers from whom you are purchasing or subscribing

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• "Channel and content providers" here is limited to providers the person is purchasing or subscribing from.
• The row's sale column contains no entries.

Data Access & Collection · Context

Protected-classification characteristics count only where they are not sensitive data

Category C is characteristics of protected classifications under Federal law, but only to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws. The row therefore carves out information that a state law treats as sensitive, leaving the residual protected-classification data in this category rather than in the sensitive row below it.

Supporting quotations

C. Characteristics of protected classifications under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws

Qualifications & exceptions

• The category is limited to the extent the information is not sensitive data under applicable state privacy laws.

Not stated here

• The chart does not say which characteristics fall inside and outside the sensitive-data definitions of each state.

Use & Processing · Context

Protected-classification data is used for advertising and marketing in this chart

The purposes column for category C lists service operation and order fulfilment; user-base analysis and service improvement with advertising correlations and new products; personalisation; targeted advertising across Roku and third-party properties with campaign measurement and reporting; marketing messages; business metrics; and enforcement of terms and legal obligations. Service communications and fraud prevention do not appear in this row.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• Advertising and marketing are listed for this category.
• The row is already limited to data that is not sensitive under applicable state law.

Sharing & Disclosure · Context

Protected-classification data is disclosed to six groups including ad partners

The disclosure column for category C names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Qualifications & exceptions

• The law-enforcement entry is limited to legal, security and safety matters, processes and requests.

Sharing & Disclosure · Context

Protected-classification data listed as sold goes to advertising and measurement recipients

The sold column for category C names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. Together with the row's advertising purpose, this places non-sensitive protected-classification data in the chart's sale column.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of the sale is relevant ads and campaign-effectiveness reporting.
• Applies only to the extent the information is not sensitive data under applicable state law.

Data Access & Collection · Context

Commercial information follows in the general state chart

Category D is commercial information, including records of personal property, products or services purchased, obtained or considered, and other purchasing or consuming histories or tendencies. The wording matches the California chart's category D, so the general state notice covers the same purchasing and consideration records.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Qualifications & exceptions

• Items merely considered are included alongside purchases.

Use & Processing · Context

Commercial information is processed for service, ads, marketing and communications

The purposes column for category D lists service operation and order fulfilment; user-base analysis and improvement with advertising correlations and new products; personalisation; targeted advertising with measurement and reporting; marketing messages and marketing-effectiveness measurement; business metrics; and service communications and customer care. Enforcement and fraud entries continue the same row below.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

Qualifications & exceptions

• The row continues beyond the entries quoted here.

Use & Processing · Context

Commercial information's purpose list ends with enforcement and fraud prevention

The last two purposes for category D are enforcing Roku's terms and protecting the business, partners or users while complying with contractual and legal obligations, and protecting against, investigating and deterring fraudulent, unauthorised, infringing or illegal activity including click fraud. These complete the nine-purpose list for commercial information in the general state chart.

Supporting quotations

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Fraud prevention names click fraud as the example.

Sharing & Disclosure · Context

Commercial information is disclosed to seven groups including merchants

The disclosure column for category D names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and merchants and their partners the person transacts with on the Roku Services. The merchants entry is specific to this category, which covers purchasing histories.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Merchant recipients are limited to merchants the person transacts with on the Roku Services.

Sharing & Disclosure · Context

Commercial information listed as sold goes to advertising and measurement recipients

The sold column for category D names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. Purchasing and consideration histories are therefore among the categories the chart places in its sale column.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of the sale is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Internet activity is category E in the general state chart

Category E is internet or other electronic network activity information, including browsing history, search history, and information about a consumer's interaction with an internet website, application or advertisement. The wording matches the California chart's category E.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

Qualifications & exceptions

• The examples are introduced as non-exhaustive.

Use & Processing · Context

Internet activity carries the nine purposes in the general state chart

The purposes column for category E lists service operation and order fulfilment; user-base analysis and improvement with advertising correlations and new products; personalisation; targeted advertising across Roku and third-party properties with campaign measurement and reporting; marketing; business metrics; service communications and customer care; enforcement of terms and legal obligations; and fraud prevention including click fraud.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Advertising is listed alongside the service and security purposes.

Sharing & Disclosure · Context

Internet activity reaches nine groups, including other users and voice assistants

The disclosure column for category E names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and other users of the Roku services when the person uses certain features, with Roku Community posts and uploaded product reviews or content given as examples.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku services when you use certain features of our service (e.g., when you post on Roku Community, upload product reviews or content)

Qualifications & exceptions

• The other-users entry is limited to certain features, with posting in Roku Community and uploading reviews or content as the examples.
• The law-enforcement entry is limited to legal, security and safety matters, processes and requests.

Sharing & Disclosure · Context

Internet activity listed as sold goes to ad partners, app providers and platforms

The sold column for category E names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign reporting; app providers where the app is installed on the Roku Device, and content providers from whom content is purchased or subscribed, for discovery, a tailored experience, the providers' own analytics and reporting, or relevant ads and campaign reporting; and third-party platforms and devices used to access the Roku Services, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• The app-provider entry is limited to apps installed on the Roku Device.
• Content providers are recipients only where the person purchases or subscribes to their content.

Data Access & Collection · Context

General geolocation opens the location rows of the general state chart

Category F is general geolocation data, described as general location and geographical information including designated market area, country, province, state, city and postal code. Its purposes column opens with service operation and order fulfilment, improvement with advertising correlations and new products, personalisation, and targeted advertising with measurement and reporting.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

Qualifications & exceptions

• Every listed example is a coarse geographic unit rather than a coordinate.

Use & Processing · Context

General geolocation also serves marketing, metrics, messages and security

The rest of category F's purposes column adds marketing messages and marketing-effectiveness measurement; business metrics; service communications and customer care; enforcement of terms and legal obligations; and fraud prevention including click fraud. The row's purpose list therefore matches the full nine-purpose pattern used for identifiers and internet activity.

Supporting quotations

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Marketing messages are described as coming from Roku or its partners.

Sharing & Disclosure · Context

General geolocation is disclosed to five groups and sold to advertising recipients

The disclosure column for category F names service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. The sold column names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign-effectiveness reporting. App and content providers, platforms, voice assistants and other users, which appear for internet activity, do not appear for this row.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The law-enforcement entry is limited to legal, security and safety matters, processes and requests.
• The stated purpose of the sale is relevant ads and campaign-effectiveness reporting.

Sharing & Disclosure · Context

Precise geolocation is limited to service, personalisation and fraud, with no sale column

For category G, the general state chart lists only three purposes: providing and maintaining the Roku Services and fulfilling requests or orders, personalising the experience, and preventing, investigating and deterring fraudulent, unauthorised, infringing or illegal activity including click fraud. Its disclosure column names only service providers and vendors, Roku's affiliates, and law enforcement or others involved in legal, security and safety matters, processes and requests, and the row has no entries in the sold column. The row therefore places precise location outside the advertising recipients and sale channel used for general geolocation.

Supporting quotations

G. Precise geolocation

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Service providers and vendors

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Qualifications & exceptions

• No advertising purpose appears for precise geolocation.
• No app, content, advertising, measurement, platform, voice-assistant or other-user recipient appears for this row.
• The row's sale column contains no entries.

Not stated here

• The chart does not say why precise location is treated more narrowly than general location.

Use & Processing · Context

Audio and visual data is used for service, metrics, messages and security

Category H is audio, electronic, visual, thermal, olfactory or similar information, and its purposes column lists service operation and order fulfilment; user-base analysis and improvement with advertising correlations and new products; business metrics; service communications and customer care; enforcement of terms and legal obligations; and fraud prevention including click fraud. Personalisation, targeted advertising and marketing are not listed for this row.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• The improvement entry still mentions correlations for Roku's advertising services although no advertising purpose is listed in this row.
• "Similar information" extends the category beyond the named types.

Not stated here

• The chart does not say which Roku features produce each type of audio or visual information.

Sharing & Disclosure · Context

Audio and visual data is disclosed to six groups including voice assistants

The disclosure column for category H names service providers and vendors; app and content providers; voice assistant providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and other users of the Roku Services. Voice assistant providers and other users appear here even though the row lists no advertising purpose or advertising recipient.

Supporting quotations

Service providers and vendors

App and content providers

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Qualifications & exceptions

• Other users are listed without the feature examples attached to the internet-activity row.
• The law-enforcement entry is limited to legal, security and safety matters, processes and requests.

Inference & Profiling · Context

Inferences carry the nine purposes in the general state chart

Category I is inferences drawn from Personal Information, including preferences, interests and other information used to personalise the experience. Its purposes column is the full nine-entry list: service operation, improvement with advertising correlations, personalisation with suggested content, targeted advertising with measurement and reporting, marketing, business metrics, service communications and customer care, enforcement, and fraud prevention.

Supporting quotations

I. Inferences drawn from Personal Information, including your preferences, interests, and other information used to personalize your experience

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Advertising and marketing both appear for derived preferences and interests.

Sharing & Disclosure · Context

Inferences are disclosed to vendors, ad partners, measurement services and affiliates

The disclosure column for category I begins with service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers and services; and Roku's affiliates. The wording of the measurement entry differs from other rows, which name advertising measurement providers without adding "and services"; the row continues below in the same chart.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers and services

Our affiliates

Qualifications & exceptions

• The measurement entry is worded "advertising measurement providers and services" rather than naming providers only.
• The row continues beyond the entries quoted here.

Sharing & Disclosure · Context

Inferences reach law enforcement and are sold to advertising recipients

The disclosure column for category I closes with law enforcement or others involved in legal, security and safety matters, processes and requests. The sold column for the row names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose of the sale is relevant ads and campaign-effectiveness reporting.
• The law-enforcement entry is limited to legal, security and safety matters, processes and requests.

Use & Processing · Context

Employment information's purpose list omits service operation and communications

Category J is professional or employment information. Its purposes column lists improvement of the services with advertising correlations and new products, personalisation, targeted advertising with measurement and reporting, marketing messages, business metrics and enforcement of terms and legal obligations. Unlike the earlier rows, it does not list service operation or order fulfilment, service communications, or fraud prevention.

Supporting quotations

J. Professional or Employment Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• No service-operation, service-communication or fraud-prevention purpose appears in this row.
• Advertising and marketing are listed for employment information.

Sharing & Disclosure · Context

Employment information is disclosed to five groups and sold to ad recipients

The disclosure column for category J names service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. The sold column names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• App and content providers and merchants do not appear as recipients for this row.
• The stated purpose of the sale is relevant ads and campaign-effectiveness reporting.

Use & Processing · Context

Education information is listed for improvement, ads and marketing, without service use

Category K is education information. Its purposes column lists improvement with advertising correlations and new products, personalisation, targeted advertising with measurement and reporting, marketing messages, business metrics and enforcement of terms and legal obligations, and does not list service operation and order fulfilment, service communications, or fraud prevention.

Supporting quotations

K. Education Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• No service-operation, service-communication or fraud-prevention purpose appears in this row.

Not stated here

• The chart does not say how Roku obtains education information about a user.

Sharing & Disclosure · Context

Education information is disclosed to five groups and sold to ad recipients

The disclosure column for category K names service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. The sold column names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The row names no app, content, platform, voice-assistant or other-user recipient.
• The stated purpose of the sale is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Credentials and others' messages are used for service, enforcement and fraud only

Category L covers information that reveals account log-in or financial account and card numbers with security codes, passwords or credentials; social security, driver's license, state identification card or passport numbers; and the content of consumer emails, texts and messages where Roku is not the intended recipient. The purposes column has three entries: service operation and order fulfilment, enforcement of terms and legal obligations, and fraud prevention. The disclosure column names service providers and vendors, Roku's affiliates, law enforcement or others involved in legal, security and safety matters, processes and requests, and merchants and their partners the person transacts with on the Roku Services, and the row lists no recipients in the sold column.

Supporting quotations

L. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Service providers and vendors.

Our affiliates.

Law enforcement or others involved with legal, security and safety matters, processes and requests.

Merchants and their partners you transact with on Roku Services.

Qualifications & exceptions

• Card numbers count only in combination with a required security or access code, password or credential.
• Message content is limited to messages where Roku is not the intended recipient.
• No advertising, marketing, personalisation or metrics purpose appears in this row.
• The row's sale column contains no entries.

Use & Processing · Company practice

Roku says user data may train its internal machine learning models unless the law forbids it

After the general state chart, Roku states that, unless prohibited by applicable law, data collected from the user or the user's devices may be used to improve Roku's internal machine learning models, which are used for purposes such as recommending content and apps, and that this may constitute "training" of "large language models" under certain applicable laws. The statement is qualified by law and describes internal models, not models belonging to third parties.

Supporting quotations

Unless prohibited by applicable law, data collected from you or your devices may be used to improve Roku’s internal machine learning models, which are used for purposes such as recommending content and apps to you. This may constitute “training” of “large language models” under certain applicable laws.

Qualifications & exceptions

• "Unless prohibited by applicable law" makes the practice conditional on the applicable legal regime.
• The models are described as Roku's internal models.
• The stated example purpose is recommending content and apps.

Not stated here

• The notice does not say which data categories are used for training or whether users can opt out of training.

Legal Rights & Agreement Rules · Company practice

The under-16 statement after the general chart addresses sale only

After the general state chart, Roku states that it does not have actual knowledge that it sells the Personal Information of consumers under 16 years of age. This sentence mentions sale but not sharing for cross-context behavioral advertising, which the earlier California-part statement named alongside sale.

Supporting quotations

Roku does not have actual knowledge that it sells Personal Information of consumers under 16 years of age.

Qualifications & exceptions

• The statement is framed as absence of actual knowledge rather than a guarantee.
• Only sale is named in this sentence.

Not stated here

• Whether the omission of sharing here is deliberate is not stated.

Retention & Deletion · Company commitment

Roku will not reidentify third-party deidentified data where the law forbids it

The general state part states that if Roku processes deidentified data provided by third parties, it will not attempt to reidentify it where applicable law prohibits doing so. The commitment is conditional on the legal prohibition, so it does not describe a general promise never to reidentify.

Supporting quotations

If we process deidentified data provided to us by third parties, we will not attempt to reidentify it if we are prohibited by applicable law from doing so.

Qualifications & exceptions

• The undertaking is limited to deidentified data provided by third parties.
• It applies only where applicable law prohibits reidentification.

Not stated here

• The notice does not describe any technical or contractual safeguards against reidentification.

Retention & Deletion · Company practice

The general state part repeats the retention rule with the same Section 2 reference

The general state part's retention item repeats that Personal Information may be retained as long as needed for legitimate business purposes, including the purposes outlined in Section 2 of the Supplemental U.S. State Law Privacy Notice, or for a period specifically required or allowed by applicable regulations or laws. The same phrasing recurs across the notice's state parts, and each occurrence points back to its own Section 2 rather than to a fixed schedule.

Supporting quotations

Retention

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• No fixed retention period is stated.
• Both mandatory and permissive statutory periods are included.

Legal Rights & Agreement Rules · User right or choice

Rights in the general part depend on where the person lives

The general part introduces the rights by saying that some states provide consumers certain rights over their Personal Information and that, depending on where the person lives and subject to certain exceptions, the listed rights may be exercised. The list is therefore offered conditionally rather than as a nationwide guarantee.

Supporting quotations

Your Privacy Rights

Some states provide consumers certain rights regarding their Personal Information. Depending on where you live and subject to certain exceptions, you may exercise the following rights:

Qualifications & exceptions

• Availability depends on the person's state of residence.
• All listed rights are subject to certain exceptions.

Not stated here

• The introduction does not map each right to the states that provide it.

Account & Service Control · User right or choice

The general rights list covers access, correction, deletion and the advertising opt-outs

The list includes a right to confirm whether Roku is processing Personal Information and to access the specific pieces collected in a portable and readily usable format to the extent technically feasible; a right to correct inaccurate information; a right to request deletion; a right to opt out of processing for targeted advertising; a right to opt out of the sale of Personal Information; and a right to limit collection, use or disclosure of sensitive Personal Information where permitted by law.

Supporting quotations

The right to confirm whether we are processing your Personal Information and to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.

The right to correct inaccurate Personal Information that we maintain about you.

The right to request deletion of the Personal Information that we have collected about you.

The right to opt out of the processing of your Personal Information for targeted advertising.

The right to opt out of the sale of your Personal Information.

The right to limit our collection, use or disclosure of your sensitive Personal Information, where permitted by law.

Qualifications & exceptions

• Portable access is required only to the extent technically feasible.
• The sensitive-information limit applies where permitted by law.
• Targeted-advertising and sale opt-outs are separate rights in the list.

Account & Service Control · User right or choice

The list adds non-discrimination, appeal, a third-party list and a voice-and-face opt-out

The remaining rights in the list are freedom from discriminatory treatment for exercising privacy rights; the right to appeal any decision on a privacy request; the right to obtain a list of specific third parties, other than natural persons, to which Personal Information has been disclosed; and the right to opt out of any voice or facial recognition features.

Supporting quotations

The right to be free from discriminatory treatment for the exercise of your privacy rights.

The right to appeal any decision with regard to your privacy request.

The right to opt out of any voice or facial recognition features.

The right to obtain a list of specific third parties, other than natural persons, to which we have disclosed Personal Information.

Qualifications & exceptions

• The third-party list is limited to recipients other than natural persons.

Not stated here

• The list does not say how the voice and facial recognition opt-out is operated.

Account & Service Control · User right or choice

A profiling opt-out right is listed and Roku says it does not engage in that profiling

The list includes the right to opt out of profiling that furthers legal or significant decisions about the person, to query such a decision, be informed of the reasons and of what actions would secure a different outcome, review and correct inaccurate information used, and have the decision re-evaluated. The same entry then states that Roku does not engage in such profiling.

Supporting quotations

The right to opt-out of profiling in furtherance of producing legal or significant decisions concerning you, query the decision, be informed of reasons for the decision and what actions would secure a different decision, review and correct any inaccurate personal information used to make the decision, and have the decision re-evaluated. We do not engage in such profiling.

Qualifications & exceptions

• The right is described in detail and immediately followed by a denial that such profiling occurs.

Not stated here

• The notice does not say what happens to a profiling opt-out request if Roku considers that it does no such profiling.

Account & Service Control · Procedure

Access, correction, deletion and appeal requests go to a form or email with verification

Requests to access, correct, delete or appeal are submitted through Roku's online form or by email to privacy@roku.com, subject to Roku's ability to reasonably verify identity where it has the right or obligation to do so. Account holders verify by logging in; people without an account are asked for data elements Roku may hold, such as device type, device ID and cookie ID.

Supporting quotations

You can submit an access, correction, deletion, and appeal request through our online form or via e-mail at privacy@roku.com. Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law. If you have a Roku account, we will verify your identity by asking you to log into your account. If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.

Qualifications & exceptions

• Verification applies where Roku has the right or obligation under applicable law.

Account & Service Control · Procedure

Targeted-advertising and sale opt-outs use the choices page, device settings and required GPC

Opting out of processing for targeted advertising or of the sale of Personal Information is done at Roku's Your Privacy Choices page or in the Privacy section of the Settings menu of Roku players and Roku TV models. Where required by law, a browser Global Privacy Control signal on a Roku Site is treated as a request to opt out of targeted advertising and sale of Personal Information.

Supporting quotations

You can exercise your right to opt out of the processing of your Personal Information for targeted advertising or the “sale” of your Personal Information by visiting Roku’s Your Privacy Choices page or Privacy section of the Settings menu of your Roku players and Roku TV models. Where required by law, if you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a request to opt out of the use of your Personal Information for targeted advertising and the “sale” of your Personal Information.

Qualifications & exceptions

• The Global Privacy Control treatment is stated only where required by law, unlike the California part's unconditional treatment for Roku Sites.
• The opt-out covers targeted advertising and sale, with no separate sharing opt-out wording here.

Account & Service Control · Procedure

The general part also allows an authorized agent with signed permission

The general part repeats the authorized-agent mechanism: where permitted by applicable law, another person may submit a request on the consumer's behalf using the same methods, with proof of signed permission, and Roku may still require direct verification and direct confirmation from the consumer.

Supporting quotations

Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above. Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request. We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Qualifications & exceptions

• Availability depends on applicable law permitting an agent.
• Direct verification of the consumer remains available to Roku.

Account & Service Control · User right or choice

Iowa and Utah residents get a separate sensitive-data opt-out sub-part

A short sub-part headed Iowa and Utah states that Iowa and Utah residents can opt out of Roku's processing of Personal Information that Iowa and Utah law consider sensitive, by visiting the Your Privacy Choices page or the privacy settings on a Roku device. This sub-part accounts for the two states that the general part's own list of seventeen states did not name.

Supporting quotations

C. Iowa and Utah

Iowa and Utah Residents: You can opt out of our processing of Personal Information that Iowa and Utah law considers to be sensitive by visiting Your Privacy Choices page or the privacy settings on your Roku device.

Qualifications & exceptions

• The opt-out is limited to information Iowa and Utah law treat as sensitive.
• Two routes are offered: the choices page and device privacy settings.

Not stated here

• The sub-part does not extend the general list of rights to Iowa and Utah residents in terms.

Cross-references

• qualified by (model-proposed): The general state part names seventeen states, without Iowa or Utah — The general state part lists seventeen states and leaves Iowa and Utah unnamed, and the later Iowa and Utah sub-part supplies the treatment for those two states: a sensitive-data opt-out rather than the general rights list. The two cards together account for the twenty states the notice's introduction names.

Data Access & Collection · Context

The Iowa and Utah part repeats the collection-sources statement

The Iowa and Utah part restates the sources item: Personal Information is collected directly or automatically through the Roku Services and may also be obtained from third-party platforms, devices and services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers including payment service providers, linked-account providers, merchants and their partners, and other users who referred the person or supplied the information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services. We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• Third-party sources are described as possibilities rather than an exhaustive list.

Sharing & Disclosure · Context

A third chart names recipients of targeted advertising or sale separately

The Iowa and Utah part opens another categories chart with four headers: categories of Personal Information collected and processed; the purposes for processing; categories of third parties to whom Personal Information is disclosed; and categories of third parties to whom it is disclosed for targeted advertising or sold, together with the purpose. The fourth header uses the targeted-advertising wording instead of the earlier chart's sale wording.

Supporting quotations

Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing

Categories of Personal Information Being Collected and Processed

The Purposes for Processing

Categories of Third Parties to Whom the Personal Information Is Disclosed

Categories of Third Parties to Whom the Personal Information is Disclosed for Targeted Advertising or "Sold" and the Purpose

Qualifications & exceptions

• The disclosure column and the targeted-advertising-or-sale column are separate.
• The sale column header pairs the recipient with a purpose.

Use & Processing · Context

The targeted-advertising chart lists nine purposes for identifiers

In the Iowa and Utah part's chart, category A is identifiers: device identifiers, internet protocol addresses, browser cookies and other unique online identifiers. Its purposes column lists service operation and order fulfilment, improvement with advertising correlations and new products, personalisation, targeted advertising across Roku and third-party properties with measurement and reporting, marketing, business metrics, service communications and customer care, enforcement and fraud prevention.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• The examples of identifiers are network and device level rather than account details.

Sharing & Disclosure · Context

Ten recipient groups receive identifiers under the targeted-advertising chart

The disclosure column for identifiers names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; other users of the Roku Services; and merchants and their partners the person transacts with on the Roku Services.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• This is the disclosure column, separate from the targeted-advertising-or-sale column.
• The law-enforcement entry is limited to legal, security and safety matters, processes and requests.

Sharing & Disclosure · Context

Identifiers are disclosed for targeted advertising or sold to ad partners and platforms

Under the fourth header, which covers recipients of information disclosed for targeted advertising or sold together with the purpose, the row names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign reporting; app providers where the app is installed on the Roku Device, and content providers from whom content is purchased or subscribed, for discovery, a tailored experience, the providers' own analytics and reporting, or relevant ads and campaign reporting; and third-party platforms and devices used to access the Roku Services, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Categories of Third Parties to Whom the Personal Information is Disclosed for Targeted Advertising or "Sold" and the Purpose

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• The column covers both disclosure for targeted advertising and sale, without distinguishing which recipient receives which.
• The app-provider entry is limited to apps installed on the Roku Device.
• Content providers are recipients only where the person purchases or subscribes to their content.

Not stated here

• The chart does not say which of these recipients receive the identifiers by sale and which for targeted advertising.

Use & Processing · Context

Registration information's purposes include advertising in the Iowa and Utah chart

Category B is account registration information: name, address, email address, telephone number, and payment method and card number. Its purposes column lists service operation and order fulfilment, improvement with advertising correlations and new products, personalisation, marketing, business metrics, service communications and customer care, enforcement and fraud prevention. The row as printed here does not repeat the targeted-advertising entry that appears in the identifiers row above it.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Payment method and card number are treated as registration information.
• Advertising appears in a neighbouring row but not in this purposes list.

Sharing & Disclosure · Context

Registration information goes to five groups and has no targeted-advertising entries

The disclosure column for category B names service providers and vendors; channel and content providers from whom the person is purchasing or subscribing; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and merchants and their partners the person transacts with on the Roku Services. The row contains no entries under the targeted-advertising-or-sale header.

Supporting quotations

Service providers and vendors

Channel and content providers from whom you are purchasing or subscribing

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Channel and content providers are recipients only where the person is purchasing or subscribing.
• The targeted-advertising-or-sale column contains no entries for this row.

Data Access & Collection · Context

The Iowa and Utah chart's protected-classification row has no sensitive-data carve-out

Category C in this chart is characteristics of protected classifications under Federal law, stated without the earlier general-part qualifier that limits the category to data that is not sensitive data under applicable state privacy laws. The row's purposes column opens with service operation and order fulfilment and continues below in the same chart.

Supporting quotations

C. Characteristics of protected classifications under Federal law

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

Qualifications & exceptions

• The row is stated without the "to the extent they are not sensitive data" wording used in the general part's category C.
• The purposes list continues below the quoted entries.

Not stated here

• The chart does not say whether the sensitive-data carve-out applies in Iowa and Utah by operation of the listed state laws.

Use & Processing · Context

The Iowa and Utah chart lists personalisation, ads, marketing and metrics for protected-classification data

The rest of category C's purposes column adds improvement with advertising correlations and new products, personalisation, targeted advertising across Roku and third-party properties with measurement and reporting, marketing, business metrics and enforcement of terms and legal obligations. With the opening service purpose, the row carries seven purposes and no service-communication or fraud entry.

Supporting quotations

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• Targeted advertising and marketing are listed for this category in this chart.
• No service-communication or fraud-prevention purpose appears in this row.

Not stated here

• The chart does not say whether Iowa or Utah law treats any of these characteristics as sensitive, which the earlier general chart excluded from its category C.

Sharing & Disclosure · Context

Protected-classification data is disclosed to six groups and listed for targeted advertising or sale

The disclosure column for category C names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. Under the targeted-advertising-or-sale header, the row names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The row is stated without the earlier general-part sensitive-data limitation.
• The stated purpose in the sale column is relevant ads and campaign-effectiveness reporting.

Use & Processing · Context

Commercial information repeats the full purpose list in the Iowa and Utah chart

Category D is commercial information, including records of personal property, products or services purchased, obtained or considered, and other purchasing or consuming histories. Its purposes column is the full nine entries: service operation and order fulfilment, improvement with advertising correlations and new products, personalisation, targeted advertising with measurement and reporting, marketing, business metrics, service communications and customer care, enforcement and fraud prevention.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Items considered but not purchased are included in the category.

Sharing & Disclosure · Context

Commercial information reaches seven disclosure groups and ad recipients in the sale column

The disclosure column for category D names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and merchants and their partners the person transacts with on the Roku Services. Under the targeted-advertising-or-sale header, the row names advertisers, ad networks, advertising partners and ad measurement providers.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Merchant recipients are limited to merchants the person transacts with on the Roku Services.

Data Access & Collection · Context

Internet activity in the Iowa and Utah chart opens with service, improvement and personalisation

Category E is internet or other electronic network activity information, including browsing history, search history and information about a consumer's interaction with an internet website, application or advertisement. The row's purposes column opens with service operation and order fulfilment, improvement with advertising correlations and new products, and personalisation with suggested content; further purposes follow in the same chart.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• The examples of the category are introduced as non-exhaustive.
• The purposes list continues below the quoted entries.

Use & Processing · Context

Internet activity's purposes in the Iowa and Utah chart add ads, marketing and security

The rest of category E's purposes column adds targeted advertising across Roku and third-party properties with measurement and reporting; marketing; business metrics; service communications and customer care; enforcement of terms and legal obligations; and fraud prevention including click fraud. With the opening entries, the row carries all nine purposes.

Supporting quotations

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Targeted advertising here extends to third-party websites, apps, platforms and devices.

Sharing & Disclosure · Context

Internet activity reaches nine groups in the Iowa and Utah disclosure column

The disclosure column for category E names service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and other users of the Roku services when the person uses certain features, with Roku Community posts and uploaded product reviews or content as examples.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku services when you use certain features of our service (e.g., when you post on Roku Community, upload product reviews or content)

Qualifications & exceptions

• The other-users entry is limited to certain features.
• The law-enforcement entry is limited to legal, security and safety matters, processes and requests.

Sharing & Disclosure · Context

Internet activity is also listed for targeted advertising or sale to ad partners and platforms

Under the targeted-advertising-or-sale header, the category E row names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign reporting; app providers where the app is installed on the Roku Device, and content providers from whom content is purchased or subscribed, for discovery, a tailored experience, the providers' own analytics and reporting, or relevant ads and campaign reporting; and third-party platforms and devices used to access the Roku Services, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• The header does not distinguish targeted-advertising disclosure from sale for a named recipient.
• The app-provider entry is limited to apps installed on the Roku Device.

Use & Processing · Context

General geolocation carries the nine purposes in the Iowa and Utah chart

Category F is general geolocation data, described as general location and geographical information including designated market area, country, province, state, city and postal code. Its purposes column lists service operation and order fulfilment, improvement with advertising correlations and new products, personalisation, targeted advertising with measurement and reporting, marketing, business metrics, service communications and customer care, enforcement and fraud prevention.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• The described data is coarse geographic information rather than precise coordinates.

Sharing & Disclosure · Context

General geolocation reaches five disclosure groups and ad recipients in the sale column

The disclosure column for category F names service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. Under the targeted-advertising-or-sale header the row names advertisers, ad networks, advertising partners and ad measurement providers.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• App and content providers, platforms, voice assistants and other users do not appear in this row.

Data Access & Collection · Context

Precise geolocation stays narrow in the Iowa and Utah chart too

For category G the chart lists only three purposes: service operation and order fulfilment, personalisation of the experience, and fraud prevention including click fraud. Its disclosure column begins with service providers and vendors and Roku's affiliates, and the row continues below without advertising entries in the columns read here.

Supporting quotations

G. Precise geolocation

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Service providers and vendors

Our affiliates

Qualifications & exceptions

• No advertising or marketing purpose appears in the entries quoted.
• The row continues below the quoted entries.

Not stated here

• Whether the remainder of the row adds advertising recipients is not visible in these entries.

Sharing & Disclosure · Context

Precise geolocation's recipient list closes with law enforcement and has no ad column

The last entry in the category G disclosure column is law enforcement or others involved with legal, security and safety matters, processes and requests. With service providers and vendors and Roku's affiliates, that completes a three-group recipient list, and the row has no entries under the targeted-advertising-or-sale header.

Supporting quotations

Law enforcement or others involved with legal, security and safety matters, processes and requests

Qualifications & exceptions

• The row names no advertising, measurement, platform, voice-assistant or other-user recipient.
• The targeted-advertising-or-sale column contains no entries for this row.

Use & Processing · Context

Audio and visual data is used for service, improvement, metrics and security here

Category H is audio, electronic, visual, thermal, olfactory or similar information. Its purposes column lists service operation and order fulfilment, improvement with advertising correlations and new products, business metrics, service communications and customer care, enforcement and fraud prevention. Personalisation, targeted advertising and marketing do not appear in this row.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• The improvement entry names advertising correlations although the row lists no advertising purpose.

Sharing & Disclosure · Context

Audio and visual data is disclosed to six groups and carries no ad-sale entries

The disclosure column for category H names service providers and vendors; app and content providers; voice assistant providers; Roku's affiliates; law enforcement or others involved in legal, security and safety matters, processes and requests; and other users of the Roku Services. The row lists no recipients under the targeted-advertising-or-sale header.

Supporting quotations

Service providers and vendors

App and content providers

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Qualifications & exceptions

• Voice assistant providers appear even though the row lists no advertising purpose.
• The targeted-advertising-or-sale column contains no entries for this row.

Use & Processing · Context

Inferences carry the nine purposes in the Iowa and Utah chart

Category I is inferences drawn from Personal Information, including preferences, interests and other information used to personalise the experience. The purposes column lists service operation, improvement with advertising correlations, personalisation, targeted advertising with measurement and reporting, marketing, business metrics, service communications and customer care, enforcement and fraud prevention.

Supporting quotations

I. Inferences drawn from Personal Information, including your preferences, interests, and other information used to personalize your experience

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• Targeted advertising and marketing apply to derived preferences and interests.

Sharing & Disclosure · Context

Inferences go to five disclosure groups and are listed for targeted advertising or sale

The disclosure column for category I names service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers and services; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. Under the targeted-advertising-or-sale header the row names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers and services

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The measurement entry is worded "advertising measurement providers and services" rather than providers only.
• The stated purpose in the sale column is relevant ads and campaign-effectiveness reporting.

Use & Processing · Context

Employment information in the Iowa and Utah chart opens with improvement and personalisation

Category J is professional or employment information. Its purposes column begins with improvement of the services including advertising correlations and new products, personalisation with suggested content, targeted advertising with measurement and reporting, marketing, business metrics and enforcement of terms and legal obligations, and its disclosure column begins with service providers and vendors, advertisers, ad networks and advertising partners, and advertising measurement providers.

Supporting quotations

J. Professional or Employment Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Qualifications & exceptions

• No service-operation, service-communication or fraud-prevention purpose appears in the quoted entries.
• The row continues below the entries quoted here.

Sharing & Disclosure · Context

Employment information reaches affiliates, law enforcement and ad recipients

The employment row's disclosure column closes with Roku's affiliates and law enforcement or others involved in legal, security and safety matters, processes and requests. Under the targeted-advertising-or-sale header, the row names advertisers, ad networks, advertising partners and ad measurement providers for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The stated purpose in the sale column is relevant ads and campaign-effectiveness reporting.

Use & Processing · Context

Education information is listed for six purposes in the Iowa and Utah chart

Category K is education information. Its purposes column lists improvement with advertising correlations and new products, personalisation, targeted advertising with measurement and reporting, marketing, business metrics and enforcement of terms and legal obligations, without service operation, service communications or fraud prevention.

Supporting quotations

K. Education Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• No service-operation, service-communication or fraud-prevention purpose appears in this row.

Sharing & Disclosure · Context

Education information goes to five disclosure groups and ad recipients for sale

The disclosure column for category K names service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. Under the targeted-advertising-or-sale header the row names advertisers, ad networks, advertising partners and ad measurement providers.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The row names no app, content, platform, voice-assistant or other-user recipient.

Data Access & Collection · Context

The Iowa and Utah sensitive row is narrower: race, religion, health and wellness

Category L in this chart is Personal Information that reveals racial or ethnic origin, religious beliefs, health, and wellness information. Unlike the California chart's category L, it does not name philosophical beliefs or union membership. Its purposes column lists improvement with advertising correlations, personalisation, targeted advertising with measurement and reporting, marketing, business metrics and enforcement.

Supporting quotations

L. Personal Information that reveals racial or ethnic origin, religious beliefs, health, and wellness information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting. We also help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• The category omits philosophical beliefs and union membership that the California chart includes.
• Targeted advertising and marketing are listed for these attributes in this chart.

Not stated here

• The chart does not say why the attribute list differs between the two state parts.

Cross-references

• contrast (model-proposed): Racial origin, religion, union membership and health form a sensitive category — Both charts have a separate sensitive-attribute row, but the attribute lists differ: the California row names racial or ethnic origin, religious or philosophical beliefs, union membership, health and wellness, while the Iowa and Utah row names racial or ethnic origin, religious beliefs, health and wellness. Philosophical beliefs and union membership appear only in the California version.

Sharing & Disclosure · Context

Those sensitive attributes are disclosed to five groups and listed for ad sale

The disclosure column for category L names service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku's affiliates; and law enforcement or others involved in legal, security and safety matters, processes and requests. Under the targeted-advertising-or-sale header the row names advertisers, ad networks, advertising partners and ad measurement providers.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• The row carries no sensitive-data carve-out of its own.
• The stated purpose in the sale column is relevant ads and campaign-effectiveness reporting.

Data Access & Collection · Context

Credentials and others' messages carry service, enforcement and fraud purposes here

Category M covers information that reveals account log-in or financial account and card numbers with security codes, passwords or credentials; social security, driver's license, state identification card or passport numbers; and the content of consumer emails, texts and messages where Roku is not the intended recipient. The purposes column has three entries, and the disclosure column names service providers and vendors, Roku's affiliates, law enforcement or others involved in legal, security and safety matters, processes and requests, and merchants and their partners the person transacts with on the Roku Services. The row has no entries under the targeted-advertising-or-sale header.

Supporting quotations

M. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Service providers and vendors

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Card numbers count only in combination with a required security or access code, password or credential.
• Message content is limited to messages where Roku is not the intended recipient.
• The targeted-advertising-or-sale column contains no entries for this row.

Legal Rights & Agreement Rules · Company practice

After the Iowa and Utah chart Roku disclaims knowledge of processing under-13 data

Directly after the chart, Roku states that it does not have actual knowledge that it processes the Personal Information of consumers under 13 years of age. The statement is about processing rather than sale or sharing, and is framed as absence of actual knowledge.

Supporting quotations

Roku does not have actual knowledge that it processes the Personal Information of consumers under 13 years of age.

Qualifications & exceptions

• Framed as absence of actual knowledge, not as an absolute prohibition.
• The statement addresses processing generally rather than sale or sharing.

Not stated here

• The notice does not describe how Roku would respond if it learned that it processed a child's information.

Retention & Deletion · Context

The Iowa and Utah part closes its chart with a retention item

The chart is followed by a Retention item label, and the retention statement that follows repeats the same business-purpose and statutory-period formula used in the notice's other state parts.

Supporting quotations

Retention

Qualifications & exceptions

• The item is a label whose statement follows in the next section of the notice.

Retention & Deletion · Company practice

The Iowa and Utah retention statement repeats the business-purpose formula

The statement under the retention item says Personal Information may be retained as long as needed to fulfil legitimate business purposes, including the purposes outlined in Section 2 of the Supplemental U.S. State Law Privacy Notice, or for a period specifically required or allowed by applicable regulations or laws. No fixed period or schedule is given for Iowa or Utah residents.

Supporting quotations

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• The reference point is the purposes listed in Section 2 of the same notice.
• Both mandatory and permissive statutory periods are included.

Not stated here

• No concrete retention period is stated.

Legal Rights & Agreement Rules · User right or choice

Iowa and Utah residents get their own rights list subject to exceptions

The part states that if a person is an Iowa or Utah resident, subject to certain exceptions, the listed rights may be exercised. The exceptions are not enumerated in this introduction.

Supporting quotations

Your Iowa and Utah Privacy Rights

If you are an Iowa or Utah resident, subject to certain exceptions, you may exercise the following rights:

Qualifications & exceptions

• The rights are addressed to Iowa and Utah residents.
• All listed rights are subject to certain exceptions.

Not stated here

• The introduction does not say what the exceptions are.

Account & Service Control · User right or choice

The Iowa and Utah list is shorter than the general rights list

The list contains rights to know what Personal Information has been collected, including categories, sources, business or commercial purposes and the categories of third parties to whom it is disclosed; to access specific pieces in a portable and readily usable format to the extent technically feasible; to correct inaccurate information; to request deletion; to opt out of the sale of Personal Information or of processing for targeted advertising; to limit use or disclosure of sensitive Personal Information where permitted by law; to be free from discriminatory treatment; and to appeal any decision on a privacy request. The profiling, voice-and-facial-recognition and specific-third-party-list rights that appear in the notice's general part are not repeated here.

Supporting quotations

The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, and the categories of third parties to whom we disclose Personal Information.

The right to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.

The right to correct inaccurate Personal Information that we maintain about you.

The right to request deletion of the Personal Information that we have collected about you.

The right to opt out of the sale of Personal Information, or the processing of Personal Information for targeted advertising.

The right to limit our use or disclosure of your sensitive Personal Information, where permitted by law.

The right to be free from discriminatory treatment for the exercise of your privacy rights.

The right to appeal any decision with regard to your privacy request

Qualifications & exceptions

• Portable access is required only to the extent technically feasible.
• The sensitive-information limit applies where permitted by law.
• The right to know here does not extend to per-category sale and sharing recipients as the California list does.

Not stated here

• The part does not say whether the profiling and recognition rights from the general part also apply to Iowa and Utah residents.

Account & Service Control · Procedure

Iowa and Utah access, correction and deletion requests go through the online form

Requests to know, access, correct or delete are submitted through Roku's online form and are subject to Roku's ability to reasonably verify identity where it has the right or obligation to do so. Account holders verify by logging in; people without an account are asked for data elements Roku may already hold, such as device type, device ID and cookie ID.

Supporting quotations

You can submit a right to know/access, correct, and deletion request to through our online form. Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law. If you have a Roku account, we will verify your identity by asking you to log into your account. If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.

Qualifications & exceptions

• Verification applies where Roku has the right or obligation under applicable law.
• The quoted sentence refers to the online form only, without the email alternative used in the California part.

Account & Service Control · Procedure

Iowa and Utah opt-outs and sensitive-data limits use the choices page or device settings

Opting out of the sale of Personal Information or of processing for targeted advertising, and limiting use of sensitive Personal Information where permitted by law, are done at Roku's Your Privacy Choices page or in the Privacy section of the Settings menu of Roku players and Roku TV models.

Supporting quotations

You can exercise your right to opt out of the “sale” of your Personal Information, or the processing of your Personal Information for targeted advertising, and limit our use of your sensitive Personal Information, where permitted by law, by visiting Roku’s Your Privacy Choices page or visiting the Privacy section of the Settings menu of your Roku players and Roku TV models. If you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a “sale” opt-out request.

Qualifications & exceptions

• The sensitive-information limit is offered where permitted by law.
• No Global Privacy Control treatment is stated in this paragraph, unlike the California and general parts.

Account & Service Control · Procedure

The Iowa and Utah part repeats the authorized-agent requirements

Where permitted by applicable law, an authorized agent may submit a request on the consumer's behalf using the same methods, with proof of signed permission, and Roku may still require the consumer to verify identity directly and confirm the agent's permission directly.

Supporting quotations

Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above. Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request. We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Qualifications & exceptions

• Availability depends on applicable law permitting an agent.
• Direct verification of the consumer remains available to Roku.

Legal Rights & Agreement Rules · Company practice

Roku may amend the policy at any time by posting it or giving required notice

Part VIII states that Roku may amend the Privacy Policy at any time by posting the amended version on the applicable Roku Site, or by providing notice about the changes or obtaining consent where applicable law requires it. The policy therefore offers no fixed notice period of its own; the notice or consent step is tied to what the law requires.

Supporting quotations

Part VIII. Modifications

We may amend this Privacy Policy at any time by posting the amended version on the applicable Roku Site or by providing such notice about or obtaining consent to changes as may be required by applicable law.

Qualifications & exceptions

• Posting the amended version on the applicable Roku Site is stated as a sufficient route.
• Notice or consent applies as may be required by applicable law.

Not stated here

• The policy does not state how far in advance changes take effect.