US State Law Privacy Notice (CA Privacy Notice)

Data Access & Collection · Context

“Personal Information” takes the listed state laws’ meaning, minus publicly available, deidentified or out-of-scope data

For this Notice, “Personal Information” means information that the laws listed in this Part VI define as “Personal Information” or “Personal Data”, and where applicable it has the same meaning as those same terms or similar terms under the U.S. State Privacy Laws of the state where the resident lives. The Notice excludes three kinds of information from that definition: publicly available information as the applicable state laws define it, deidentified or aggregated information, and information otherwise excluded from the scope of those laws.

Supporting quotations

For the purpose of this Notice, “Personal Information” means information that the laws listed in this Part VI define as “Personal Information or “Personal Data”.

Where applicable, Personal Information has the same meaning as those same terms or similar terms under the U.S. State Privacy Laws of the state in which you reside.

Publicly available, as defined by the applicable U.S. State Privacy Laws.

Deidentified or aggregated.

Otherwise excluded from the scope of the applicable U.S. State Privacy Laws.

Qualifications & exceptions

• Publicly available, as defined by the applicable U.S. State Privacy Laws.
• Deidentified or aggregated.
• Otherwise excluded from the scope of the applicable U.S. State Privacy Laws.

Data Access & Collection · Company practice

California sources: information you provide, automatic collection through the Roku Services, and listed third parties

For California, Roku says it collects Personal Information from the reader when the reader provides it, and automatically through the Roku Services. It may also obtain information about the reader from other sources: third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts the reader links to a Roku account, participating merchants and their partners, and other users who referred the reader or provided the reader’s information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services.

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• when you provide it to us or automatically through the Roku Services
• if they have referred you to the Roku Services or provided your information to us

Data Access & Collection · Company practice

California table row A: identifiers, including device identifiers, IP addresses and browser cookies

In the California section, the Notice presents a three-column table headed “Categories of Personal Information Being Collected and Processed”, “The Purposes for Processing” and the categories of third parties to whom information is shared or sold. Row A of that table lists identifiers as a collected and processed category, including device identifiers, internet protocol addresses, browser cookies and other unique online identifiers. The same row sets out, in separate cells, the purposes and the third-party recipients.

Supporting quotations

Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing

Categories of Personal Information Being Collected and Processed

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

Data Access & Collection · Company practice

Account registration information collected: name, address, email, telephone and payment card details

Row B of the California table lists account registration information as a category of Personal Information collected and processed: name, address, email address, telephone number, and payment method and card number. The table does not distinguish which of those elements are required to register an account.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

Not stated here

• The table does not say which of these fields are mandatory to create an account.

Data Access & Collection · Company practice

Characteristics of protected classifications under California or federal law collected as a category

Row C of the California table lists “Characteristics of protected classifications under California or Federal law” as a category of Personal Information collected and processed. It does not say which specific characteristics Roku collects or from which source; that detail is not supplied in this row.

Supporting quotations

C. Characteristics of protected classifications under California or Federal law

Not stated here

• The table does not identify which protected characteristics Roku collects or how it obtains them.

Data Access & Collection · Company practice

Commercial information collected: purchase, obtained or considered records and purchasing or consuming histories

Row D of the California table lists commercial information as a collected and processed category: records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Data Access & Collection · Company practice

Internet or network activity collected: browsing and search history and interaction with sites, apps and ads

Row E of the California table lists internet or other electronic network activity information as a collected and processed category, including, but not limited to, browsing history, search history, and information about a consumer’s interaction with an internet website, application or advertisement. The row does not say how long that activity information is kept.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

Not stated here

• The row does not state a retention period for the activity information.

Data Access & Collection · Company practice

General geolocation collected: designated market area, country, province, state, city and postal code

Row F of the California table lists general geolocation data as a collected and processed category, such as general location and geographical information, including designated market area, country, province, state, city and postal code. This is described as general geolocation; precise geolocation is a separate row G.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

Data Access & Collection · Company practice

Precise geolocation collected; the supplied cells list running the service and personalising the experience

Row G of the California table lists precise geolocation as a collected and processed category. The purpose cells supplied in this section list two purposes: to provide and maintain the Roku Services and process and fulfil requests or orders, and to personalise the experience on the Roku Services. This card states only the cells present here; the notice does not say how precise geolocation is obtained or whether the row continues with further purposes.

Supporting quotations

G. Precise geolocation

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

Qualifications & exceptions

• To personalize your experience on the Roku Services.

Not stated here

• The supplied cells do not say how precise geolocation is collected or whether the row has further purposes beyond these two.

Data Access & Collection · Company practice

Audio, electronic, visual, thermal, olfactory or similar information collected as a category

Row H of the California table lists audio, electronic, visual, thermal, olfactory or similar information as a collected and processed category of Personal Information. The row does not say which of those sensory or similar types Roku actually collects or in what settings.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

Not stated here

• The row does not say which of the listed information types Roku collects or where it is captured.

Data Access & Collection · Company practice

Professional or employment information collected as a category

Row J of the California table lists professional or employment information as a collected and processed category. The row does not describe which employment details Roku collects or how it obtains them.

Supporting quotations

J. Professional or Employment Information

Not stated here

• The row does not describe the specific employment details collected or their source.

Data Access & Collection · Company practice

Education information collected; supplied cells list analytics and personalisation purposes

Row K of the California table lists education information as a collected and processed category. The purpose cells supplied in this section list two purposes: analysing the user base and improving and enhancing the Roku Services (including building correlations for Roku’s advertising services) and developing new features, and personalising the experience on the Roku Services with relevant content and recommendations. This card states only the cells present here; the row may continue with further purposes.

Supporting quotations

K. Education Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• on the Roku Services

Not stated here

• Only part of row K is supplied in this section; the card does not say whether further purposes or recipients follow.

Data Access & Collection · Company practice

Sensitive categories collected: racial or ethnic origin, religious beliefs, union membership, health and wellness

Row L of the California table lists Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, and health and wellness information as a collected and processed category. The row does not say how Roku obtains this information or how it keeps it apart from other categories.

Supporting quotations

L. Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, health, and wellness information

Not stated here

• The row does not state the source of these sensitive details or any separate handling beyond the purposes listed.

Data Access & Collection · Company practice

Roku says it does not collect genetic or biometric information, neural data, sex-life data or citizenship status

Roku states that it does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status. This negative statement sits beside the table that lists other sensitive categories, such as protected classifications and health and wellness information, which Roku does describe collecting.

Supporting quotations

Roku does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status.

Data Access & Collection · Company practice

The same collection sources are stated for the multistate group

Section B repeats the sources statement: Personal Information is collected from the reader when provided and automatically through the Roku Services, and may be obtained from third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts the reader links to a Roku account, participating merchants and their partners, and other users who referred the reader or provided the reader’s information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services.

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• if they have referred you to the Roku Services or provided your information to us

Data Access & Collection · Context

The multistate chart repeats the category and purpose column headings

Section B repeats the chart heading “Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing” and supplies its first two column headings: “Categories of Personal Information Being Collected and Processed” and “The Purposes for Processing”. The remaining columns of this multistate chart appear later in the source and are not supplied in this packet.

Supporting quotations

Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing

Categories of Personal Information Being Collected and Processed

The Purposes for Processing

Not stated here

• Only the first two column headings of the multistate chart are supplied here; the later columns are described in following packets.

Data Access & Collection · Company practice

Multistate protected classifications cover federal law only, and only where not “sensitive data”

Row C of the multistate chart lists “Characteristics of protected classifications under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws”. Two limits are stated in the category itself: it covers classifications under federal law rather than California or federal law as the California chart says, and it applies only to the extent those characteristics are not “sensitive data” under the applicable state laws. The chart does not say which characteristics Roku collects within that limit.

Supporting quotations

C. Characteristics of protected classifications under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws

Qualifications & exceptions

• under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws

Not stated here

• The row does not identify which federal-law protected characteristics Roku collects, or which are treated as “sensitive data” and therefore outside this row.

Data Access & Collection · Company practice

Multistate network activity information: category plus the first three purposes supplied

Row E of the multistate chart lists internet or other electronic network activity information, including browsing history, search history and information about a consumer’s interaction with an internet website, application or advertisement, and begins its purpose column with service delivery and order fulfilment, analytics and improvement (including building correlations for Roku’s advertising services) and development, and personalisation with relevant content and recommendations. The remaining purposes and recipient columns for this row are supplied in following packets.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Not stated here

• Only the first three purposes for row E are supplied in this packet; the card does not state the rest of the row.

Data Access & Collection · Company commitment

Deidentified data from third parties will not be reidentified where the law forbids it

Roku states that if it processes deidentified data provided to it by third parties, it will not attempt to reidentify that data where applicable law prohibits it from doing so. The commitment is conditional on that legal prohibition; the text does not describe other safeguards for deidentified data.

Supporting quotations

If we process deidentified data provided to us by third parties, we will not attempt to reidentify it if we are prohibited by applicable law from doing so.

Qualifications & exceptions

• if we are prohibited by applicable law from doing so

Not stated here

• The Notice does not describe what Roku does with deidentified data where reidentification is not legally prohibited.

Data Access & Collection · Company practice

Iowa and Utah section repeats the same collection sources

The Iowa and Utah section repeats the sources statement used in the earlier sections: Personal Information is collected from the reader when provided and automatically through the Roku Services, and may be obtained from third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts linked to a Roku account, participating merchants and their partners, and other users who referred the reader or provided the reader’s information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services.

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• if they have referred you to the Roku Services or provided your information to us

Data Access & Collection · Company practice

Iowa and Utah identifiers: category plus the first seven purposes supplied

Row A of the Iowa and Utah chart lists identifiers — device identifiers, internet protocol addresses, browser cookies and other unique online identifiers — and begins its purpose column with service delivery and order fulfilment, analytics and improvement including building correlations for advertising, personalisation, targeted advertising and advertising measurement, marketing and marketing measurement, performance measurement, and service communications and customer service. The remaining purposes and the recipient columns for this row are supplied in following packets.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

Not stated here

• Only the first seven purposes for this row are supplied here; the card does not state the rest of the row.

Data Access & Collection · Company commitment

Iowa and Utah statement: no actual knowledge of processing Personal Information of consumers under 13

For the Iowa and Utah section, Roku states that it does not have actual knowledge that it processes the Personal Information of consumers under 13 years of age. The statement addresses age 13 and processing, whereas the multistate statement addresses under-16 consumers and selling or sharing. It is a statement about Roku’s knowledge, not a statement that no such processing occurs.

Supporting quotations

Roku does not have actual knowledge that it processes the Personal Information of consumers under 13 years of age.

Qualifications & exceptions

• does not have actual knowledge

Not stated here

• The Notice does not describe the checks Roku uses to establish that knowledge, or any age-verification step.