Additional state-law notice for residents of 19 listed states, supplementing the Privacy Policy
This document is an additional notice for residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. It supplements the information in the Privacy Policy and applies to residents of those states whose data Roku processes as a business or controller. It is dated July 1, 2026. The Privacy Policy it supplements is linked but not supplied, so its contents are not described here.
Details
Where
California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia
When
Last updated July 1, 2026
Condition
residents of those states whose data we process as a business or controller
Supporting quotations
Last updated: July 1, 2026
US State Law Privacy Notice
This additional notice (“Notice”) is for residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and supplements the information contained in the Privacy Policy and applies to residents of those states whose data we process as a business or controller.
Qualifications & exceptions
applies to residents of those states whose data we process as a business or controller
Not stated here
The Privacy Policy that this Notice supplements is not supplied by this source, so the combined effect of the two documents is not stated.
Notice describes rights under the 20 named state laws it calls the “U.S. State Privacy Laws”
The Notice says it describes how residents exercise rights under a named list of state laws: the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Delaware Personal Data Privacy Act, the Florida Digital Bill of Rights, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the New Hampshire Data Privacy Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act and the Virginia Consumer Data Protection Act, collectively the “U.S. State Privacy Laws”. Those laws are external instruments; this Notice does not restate their requirements.
Details
What it covers
rights under 20 named state privacy laws, collectively the “U.S. State Privacy Laws”
Supporting quotations
It also describes how you exercise the rights under the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Delaware Personal Data Privacy Act, the Florida Digital Bill of Rights, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the New Hampshire Data Privacy Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act (collectively the “U.S. State Privacy Laws”).
A term defined differently across the state laws takes the meaning of the resident’s own state law
Where a term used in the Notice has a different meaning under different U.S. State Privacy Laws, the term takes the meaning given by the law of the state where the reader resides. This is an interpretive rule for reading the Notice; it does not itself describe a practice.
Details
Condition
a term used in this Notice has a different meaning under different U.S. State Privacy Laws
Where
the state in which the resident resides
Supporting quotations
In the event that a term used in this Notice has a different meaning under different U.S. State Privacy Laws, such term shall have the meaning under the laws of the state in which you reside.
Legal Rights & Agreement Rules · User right or choice
California residents may exercise the listed privacy rights, subject to certain exceptions
For California residents, the Notice says the following rights may be exercised, subject to certain exceptions. The list that follows covers the rights to know, access, correct, delete, opt out of sale or sharing for cross-context behavioural advertising, limit use or disclosure of sensitive Personal Information where permitted by law, be free from retaliation and appeal a decision on a privacy request. The Notice does not enumerate the exceptions in this sentence.
Details
Where
California residents
Condition
subject to certain exceptions
Supporting quotations
If you are a California resident, subject to certain exceptions, you may exercise the following rights:
Qualifications & exceptions
subject to certain exceptions
If you are a California resident
Not stated here
The Notice does not list the exceptions that apply to these rights at this point; later sections may qualify individual rights.
Legal Rights & Agreement Rules · User right or choice
Right to know the categories collected, sources, purposes, recipients, and what was sold, shared or disclosed
The right to know covers what Personal Information Roku has collected about the reader, including the categories of Personal Information, the categories of sources, the business or commercial purpose for collecting, selling or sharing it, the categories of third parties to whom Roku discloses it, the categories sold or shared and the categories of third parties for each, and the categories disclosed for a business purpose with the categories of service providers or contractors for each.
Details
What it does
know the categories, sources, purposes, recipients and sale, sharing or business-purpose disclosure details
Supporting quotations
The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, the categories of Personal Information that the business sold or shared, and for each category identified, the categories of third parties to whom it sold or shared that particular category of Personal Information, and the categories of Personal Information that the business disclosed for a business purpose, and for each category identified, the categories of service providers or contractors to whom it disclosed that particular category of Personal Information.
Legal Rights & Agreement Rules · User right or choice
Rights to access specific pieces in portable form, correct inaccurate information and request deletion
The Notice lists three further rights: access to the specific pieces of Personal Information Roku has collected, in a portable and, to the extent technically feasible, readily usable format; correction of inaccurate Personal Information Roku maintains; and request of deletion of Personal Information Roku has collected.
Details
What it does
access, correct and delete Personal Information
Supporting quotations
The right to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.
The right to correct inaccurate Personal Information that we maintain about you.
The right to request deletion of the Personal Information that we have collected about you.
Qualifications & exceptions
to the extent technically feasible
Legal Rights & Agreement Rules · User right or choice
Rights to opt out of sale or sharing for cross-context behavioural advertising and to limit sensitive data use
The Notice lists the right to opt out of the sale of Personal Information, or the sharing of Personal Information for cross-context behavioural advertising, and the right to limit Roku’s use or disclosure of sensitive Personal Information where permitted by law.
Details
What it does
opt out of sale or sharing and limit use or disclosure of sensitive Personal Information
Supporting quotations
The right to opt out of the sale of Personal Information, or the sharing of Personal Information for cross-context behavioral advertising.
The right to limit our use or disclosure of your sensitive Personal Information, where permitted by law.
Qualifications & exceptions
where permitted by law
Cross-references
contrast (model-proposed): Multistate rights to opt out of processing for targeted advertising and opt out of sale — The California list states one opt-out right covering sale and sharing for cross-context behavioural advertising; the multistate list splits the opt-out into sale and processing for targeted advertising. The two formulations describe overlapping but differently named practices.
Legal Rights & Agreement Rules · User right or choice
Rights not to be retaliated against for exercising privacy rights and to appeal a request decision
The Notice lists the right not to be retaliated against for the exercise of privacy rights and the right to appeal any decision regarding a privacy request.
Details
What it does
be free from retaliation and appeal a privacy-request decision
Supporting quotations
The right to not be retaliated against for the exercise of your privacy rights.
The right to appeal any decision with regard to your privacy request
Legal Rights & Agreement Rules · Procedure
Know, access, correct and delete requests through the online form, with identity verification
Requests to know or access, correct and delete can be submitted through Roku’s online form. Roku says such requests are subject to its ability to reasonably verify the requester’s identity where it has the right or obligation to do so under applicable law: account holders are verified by being asked to log into the account, and people without a Roku account are asked to provide data elements Roku may have collected, such as device type, device ID and cookie ID, through the online form or by email to privacy@roku.com.
Details
What it does
submit know, access, correct and delete requests and verify identity
Condition
Roku’s ability to reasonably verify identity where it has the right or obligation to do so
Supporting quotations
You can submit a right to know/access, correct, and deletion request to through our online form.
Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.
If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.
Qualifications & exceptions
Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.
If you have a Roku account, we will verify your identity by asking you to log into your account.
Not stated here
The Notice does not say what happens if identity cannot be verified or how long verification takes.
Legal Rights & Agreement Rules · Procedure
Opt-out through Your Privacy Choices page or Roku settings, and Global Privacy Control signals
The reader can opt out of the “sale” of Personal Information or the “sharing” of it for cross-context behavioural advertising, and limit Roku’s use of sensitive Personal Information where permitted by law, through Roku’s Your Privacy Choices page or the Privacy section of the Settings menu on Roku players and Roku TV models. A browser sending the Global Privacy Control signal on any Roku Site is treated as a “sale” and “sharing” opt-out request. When the reader is logged into a Roku account, a GPC signal is honoured for that account; when not logged in or without an account, it is honoured for the browser the signal comes from, subject to Roku’s ability to associate the signal with the reader’s information.
Details
What it does
opt out of sale or sharing and limit sensitive data use through the choices page, device settings or a GPC signal
Where
Roku Sites (for the GPC signal) and Roku players and Roku TV models (for the settings menu)
Supporting quotations
You can exercise your right to opt out of the “sale” of your Personal Information, or the “sharing” of your Personal Information for cross-context behavioral advertising, and limit our use of your sensitive Personal Information, where permitted by law, by visiting Roku’s Your Privacy Choices page or visiting the Privacy section of the Settings menu of your Roku players and Roku TV models.
If you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a “sale” and “sharing” opt-out request.
When you are logged into your Roku account, we honor a GPC signal as a request to opt out of the “sale” and “sharing” of personal information for that account.
When you are not logged into a Roku account or you do not have a Roku account, we honor a GPC signal as a request to opt out of the “sale” and “sharing” of personal information for the browser from which the signal is received, subject to our ability to associate the signal with your information.
Qualifications & exceptions
where permitted by law
subject to our ability to associate the signal with your information
Not stated here
The Notice does not say how a GPC signal is associated with a person when they are not logged in, beyond the stated limit.
Cross-references
contrast (model-proposed): Multistate opt-out of targeted advertising or sale, with Global Privacy Control where the law requires it — California treats a Global Privacy Control signal as a “sale” and “sharing” opt-out and states how it applies to a logged-in account versus a browser; the multistate paragraph applies the signal to targeted advertising and sale only “Where required by law” and states no account-scope rule.
Legal Rights & Agreement Rules · Procedure
An authorised agent may submit a privacy request with signed permission, but Roku may verify the person directly
Where permitted by applicable law, the reader may authorise another person as an “Authorized Agent” to submit a request through the methods described. The agent should submit proof of the reader’s signed permission. Roku may still require the reader to verify their identity directly and to confirm directly that the agent was given permission. The section ends by inviting questions to privacy@roku.com.
Details
Who
the reader and their Authorized Agent
Condition
proof of signed permission, and Roku may still require direct verification and confirmation
Supporting quotations
Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above.
Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request.
We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.
Qualifications & exceptions
Where permitted by applicable law
We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.
Legal Rights & Agreement Rules · Procedure
Shine the Light: yearly free request about sharing for third parties’ own direct marketing
Under California’s Shine the Light law, California residents may ask and receive, once per calendar year and free of charge, information about Roku’s sharing of their Personal Information, if any, with third parties for those third parties’ own direct marketing use. Requests go to privacy@roku.com and should include the reader’s name and an attestation that they are a California resident, plus a current California address; Roku may ask for more information to confirm identity before responding.
Details
Where
California residents
Condition
once per calendar year and free of charge
Supporting quotations
California’s Shine-the-Light Law.
California’s Shine the Light law permits California residents to request and receive, once per calendar year and free of charge, information about our sharing of your Personal Information (if any) with third parties for their own direct marketing use.
In your request, please include your name and attest to the fact that you are a California resident and provide a current California address.
Qualifications & exceptions
once per calendar year and free of charge
for their own direct marketing use
please include your name and attest to the fact that you are a California resident and provide a current California address
Legal Rights & Agreement Rules · Context
Section B repeats the state-law notice for Colorado, Connecticut and 14 other listed states
After the California section, the Notice opens a section “B.” for residents of Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas and Virginia. The section then repeats the same topics as the California section — sources of Personal Information, the categories and purposes chart, and rights. California is not repeated in this list because it has its own section A.
Details
Where
Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas and Virginia
Supporting quotations
B. Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia
Not stated here
This section lists 16 states, while the introduction names 20; whether Iowa, Maryland and Utah are covered in a further section is not established by this packet.
Legal Rights & Agreement Rules · User right or choice
Multistate rights: some states provide rights, depending on residence and subject to exceptions
Section B’s “Your Privacy Rights” heading introduces a statement that some states provide consumers certain rights regarding their Personal Information, and that, depending on where the reader lives and subject to certain exceptions, the listed rights may be exercised. The list that follows covers confirmation and access, correction, deletion, opt out of targeted advertising, opt out of sale, limiting sensitive Personal Information, freedom from discriminatory treatment and appeal.
Details
Where
the states listed in section B
Condition
depending on where the reader lives and subject to certain exceptions
Supporting quotations
Your Privacy Rights
Some states provide consumers certain rights regarding their Personal Information. Depending on where you live and subject to certain exceptions, you may exercise the following rights:
Qualifications & exceptions
Depending on where you live and subject to certain exceptions
Not stated here
The Notice does not list which right applies in which of the sixteen states, or which exceptions apply.
Legal Rights & Agreement Rules · User right or choice
Multistate rights to confirm processing, access specific pieces, correct and delete
The multistate list gives the right to confirm whether Roku is processing the reader’s Personal Information and to access the specific pieces collected in a portable and, to the extent technically feasible, readily usable format; the right to correct inaccurate Personal Information Roku maintains; and the right to request deletion of Personal Information Roku has collected.
Details
What it does
confirm processing, access, correct and delete Personal Information
Supporting quotations
The right to confirm whether we are processing your Personal Information and to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.
The right to correct inaccurate Personal Information that we maintain about you.
The right to request deletion of the Personal Information that we have collected about you.
Qualifications & exceptions
to the extent technically feasible
Legal Rights & Agreement Rules · User right or choice
Multistate rights to opt out of processing for targeted advertising and opt out of sale
The multistate list separates two opt-out rights: the right to opt out of the processing of Personal Information for targeted advertising, and the right to opt out of the sale of Personal Information. It does not use the California formulation of opting out of “sharing” for cross-context behavioural advertising.
Details
What it does
opt out of targeted advertising and of sale
Supporting quotations
The right to opt out of the processing of your Personal Information for targeted advertising.
The right to opt out of the sale of your Personal Information.
Legal Rights & Agreement Rules · User right or choice
Multistate rights to limit sensitive Personal Information and to be free from discriminatory treatment
The multistate list gives the right to limit Roku’s collection, use or disclosure of sensitive Personal Information where permitted by law, and the right to be free from discriminatory treatment for exercising privacy rights. The California section instead frames the second right as freedom from retaliation.
Details
What it does
limit sensitive Personal Information handling and be free from discriminatory treatment
Supporting quotations
The right to limit our collection, use or disclosure of your sensitive Personal Information, where permitted by law.
The right to be free from discriminatory treatment for the exercise of your privacy rights.
Qualifications & exceptions
where permitted by law
Legal Rights & Agreement Rules · User right or choice
Multistate right to appeal any decision on a privacy request
The multistate list gives the right to appeal any decision with regard to the reader’s privacy request, using the same wording as the California list.
Details
What it does
appeal a privacy-request decision
Supporting quotations
The right to appeal any decision with regard to your privacy request.
Legal Rights & Agreement Rules · User right or choice
Profiling rights are listed, but Roku says it does not engage in that profiling
The multistate rights list includes the right to opt out of profiling in furtherance of producing legal or significant decisions about the reader, to query the decision, to be informed of the reasons for it and of what actions would secure a different decision, to review and correct inaccurate Personal Information used to make it, and to have it re-evaluated. The same paragraph states: “We do not engage in such profiling.” The rights are therefore stated as available in principle while Roku denies the practice they address.
Details
What it does
opt out of, query, correct and have re-evaluated profiling decisions
Condition
Roku states it does not engage in such profiling
Supporting quotations
The right to opt-out of profiling in furtherance of producing legal or significant decisions concerning you, query the decision, be informed of reasons for the decision and what actions would secure a different decision, review and correct any inaccurate personal information used to make the decision, and have the decision re-evaluated.
We do not engage in such profiling.
Qualifications & exceptions
in furtherance of producing legal or significant decisions concerning you
Legal Rights & Agreement Rules · User right or choice
Right to opt out of any voice or facial recognition features
The multistate rights list includes the right to opt out of any voice or facial recognition features. The Notice does not say here whether such features exist on any Roku product or how this opt-out is exercised.
Details
What it does
opt out of voice or facial recognition features
Supporting quotations
The right to opt out of any voice or facial recognition features.
Not stated here
The Notice does not identify which voice or facial recognition features the right applies to or how the opt-out is submitted.
Legal Rights & Agreement Rules · User right or choice
Right to obtain a list of specific third parties that received Personal Information
The multistate rights list includes the right to obtain a list of specific third parties, other than natural persons, to which Roku has disclosed Personal Information. The right is framed in terms of named third parties rather than the categories used in the disclosure chart.
Details
What it covers
a list of specific third parties, other than natural persons, that received Personal Information
Supporting quotations
The right to obtain a list of specific third parties, other than natural persons, to which we have disclosed Personal Information.
Qualifications & exceptions
other than natural persons
Legal Rights & Agreement Rules · Procedure
Multistate access, correction, deletion and appeal requests, with the same identity verification
For the multistate group, access, correction, deletion and appeal requests can be submitted through Roku’s online form or by email to privacy@roku.com. Roku says such requests are subject to its ability to reasonably verify identity where it has the right or obligation to do so under applicable law: account holders are verified by logging into the account, and people without an account are asked to provide data elements Roku may have collected, such as device type, device ID and cookie ID.
Details
What it does
submit access, correction, deletion and appeal requests and verify identity
Condition
Roku’s ability to reasonably verify identity where it has the right or obligation to do so
Supporting quotations
access, correction, deletion, and appeal request
Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.
If you have a Roku account, we will verify your identity by asking you to log into your account.
If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.
Qualifications & exceptions
Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.
Legal Rights & Agreement Rules · Procedure
Multistate opt-out of targeted advertising or sale, with Global Privacy Control where the law requires it
For the multistate group, the reader can opt out of processing Personal Information for targeted advertising or of the “sale” of Personal Information through Roku’s Your Privacy Choices page or the Privacy section of the Settings menu on Roku players and Roku TV models. Where required by law, a browser sending the Global Privacy Control signal on any Roku Site is treated as a request to opt out of both the use of Personal Information for targeted advertising and its “sale”. The multistate paragraph states no logged-in or browser-scope limits for the signal, and couples it to a legal requirement, unlike the California paragraph.
Details
What it does
opt out of targeted advertising or sale through the choices page, device settings or a GPC signal
Condition
where required by law, for the GPC signal
Supporting quotations
You can exercise your right to opt out of the processing of your Personal Information for targeted advertising or the “sale” of your Personal Information by visiting Roku’s Your Privacy Choices page or Privacy section of the Settings menu of your Roku players and Roku TV models.
Where required by law, if you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a request to opt out of the use of your Personal Information for targeted advertising and the “sale” of your Personal Information.
Qualifications & exceptions
Where required by law
Not stated here
The Notice does not say which of the sixteen states’ laws trigger the Global Privacy Control treatment, or how the signal is associated with a person.
Cross-references
contrast (model-proposed): Opt-out through Your Privacy Choices page or Roku settings, and Global Privacy Control signals — California treats a Global Privacy Control signal as a “sale” and “sharing” opt-out and states how it applies to a logged-in account versus a browser; the multistate paragraph applies the signal to targeted advertising and sale only “Where required by law” and states no account-scope rule.
Legal Rights & Agreement Rules · Procedure
Multistate authorised agent may submit a request, subject to direct verification
Where permitted by applicable law, the reader may authorise another person as an “Authorized Agent” to submit a request through the methods described. The agent should submit proof of signed permission, and Roku may still require the reader to verify their identity directly and confirm directly that the agent was authorised. Questions go to privacy@roku.com.
Details
Who
the reader and their Authorized Agent
Condition
proof of signed permission, and possible direct verification and confirmation
Supporting quotations
Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above.
Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request.
We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.
Qualifications & exceptions
Where permitted by applicable law
We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.
Legal Rights & Agreement Rules · Context
A separate short section covers Iowa and Utah residents
After the sixteen-state section B, the Notice opens a section “C. Iowa and Utah”. The subsection supplies a sensitive-data opt-out for those two states and then repeats the sources statement and the categories, purposes and disclosures chart. This explains why the introduction’s twenty-state list is covered by three sections — California, the sixteen states in B, and Iowa and Utah — rather than by two.
Details
Where
Iowa and Utah
Supporting quotations
C. Iowa and Utah
Legal Rights & Agreement Rules · User right or choice
Iowa and Utah residents can opt out of processing that those states’ law treats as sensitive
Iowa and Utah residents can opt out of Roku’s processing of Personal Information that Iowa and Utah law considers sensitive, by visiting the Your Privacy Choices page or the privacy settings on their Roku device. The paragraph does not list which information those state laws treat as sensitive or describe any other opt-out method.
Details
Where
Iowa and Utah residents
What it does
opt out of processing of sensitive Personal Information
Supporting quotations
Iowa and Utah Residents: You can opt out of our processing of Personal Information that Iowa and Utah law considers to be sensitive by visiting Your Privacy Choices page or the privacy settings on your Roku device.
Qualifications & exceptions
that Iowa and Utah law considers to be sensitive
Not stated here
The paragraph does not identify the information Iowa and Utah treat as sensitive, or say what happens to a request submitted by another route.
Legal Rights & Agreement Rules · User right or choice
A subsection headed for Iowa and Utah opens with rights said to belong to Utah residents
The heading reads “Your Iowa and Utah Privacy Rights”, but the sentence that introduces the list says: “If you are a Utah resident, subject to certain exceptions, you may exercise the following rights”. The supplied text in this packet does not include a separate Iowa rights list; only the earlier Iowa and Utah sensitive-data opt-out is stated specifically for both states. The apparent gap is reported as it stands in the source rather than filled in.
Details
Where
Utah residents (under a heading naming Iowa and Utah)
Condition
subject to certain exceptions
Supporting quotations
Your Iowa and Utah Privacy Rights
If you are a Utah resident, subject to certain exceptions, you may exercise the following rights:
Qualifications & exceptions
If you are a Utah resident, subject to certain exceptions
Not stated here
The heading names Iowa and Utah, but this rights list is introduced only for Utah residents; the supplied text does not state which of these rights are offered to Iowa residents, apart from the earlier sensitive-data opt-out.
Legal Rights & Agreement Rules · User right or choice
Utah right to know categories, sources, purposes and third-party categories
The Utah list gives the right to know what Personal Information Roku has collected, including the categories of Personal Information, the categories of sources, the business or commercial purpose for collecting, selling or sharing it, and the categories of third parties to whom Roku discloses it. Compared with the California right to know, this wording does not separately list the categories sold or shared per third party, or the service providers and contractors per disclosed category.
Details
What it does
know the categories collected, sources, purposes and third-party categories
Supporting quotations
The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, and the categories of third parties to whom we disclose Personal Information.
Legal Rights & Agreement Rules · User right or choice
Utah rights to access specific pieces, correct inaccurate information and request deletion
The Utah list gives the right to access the specific pieces of Personal Information collected, in a portable and, to the extent technically feasible, readily usable format; the right to correct inaccurate Personal Information Roku maintains; and the right to request deletion of Personal Information Roku has collected.
Details
What it does
access, correct and delete Personal Information
Supporting quotations
The right to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.
The right to correct inaccurate Personal Information that we maintain about you.
The right to request deletion of the Personal Information that we have collected about you.
Qualifications & exceptions
to the extent technically feasible
Legal Rights & Agreement Rules · User right or choice
Utah right to opt out of the sale of Personal Information or processing for targeted advertising
The Utah list gives the right to opt out of the sale of Personal Information, or the processing of Personal Information for targeted advertising. This is the same combined formulation used in the multistate rights list.
Details
What it does
opt out of sale or processing for targeted advertising
Supporting quotations
The right to opt out of the sale of Personal Information, or the processing of Personal Information for targeted advertising.
Legal Rights & Agreement Rules · User right or choice
Utah rights to limit sensitive Personal Information and to be free from discriminatory treatment
The Utah list gives the right to limit Roku’s use or disclosure of sensitive Personal Information where permitted by law, and the right to be free from discriminatory treatment for exercising privacy rights.
Details
What it does
limit sensitive Personal Information handling and be free from discriminatory treatment
Supporting quotations
The right to limit our use or disclosure of your sensitive Personal Information, where permitted by law.
The right to be free from discriminatory treatment for the exercise of your privacy rights.
Qualifications & exceptions
where permitted by law
Legal Rights & Agreement Rules · User right or choice
Utah right to appeal any decision on a privacy request
The Utah list gives the right to appeal any decision with regard to the reader’s privacy request.
Details
What it does
appeal a privacy-request decision
Supporting quotations
The right to appeal any decision with regard to your privacy request
Legal Rights & Agreement Rules · Procedure
Iowa and Utah know, access, correct and delete requests through the online form, with verification
For the Iowa and Utah section, a right to know or access, correct and deletion request can be submitted through Roku’s online form. Such requests are subject to Roku’s ability to reasonably verify identity where it has the right or obligation to do so under applicable law: account holders are verified by logging into the account, and people without an account are asked to provide data elements Roku may have collected, such as device type, device ID and cookie ID.
Details
What it does
submit know, access, correct and delete requests and verify identity
Condition
Roku’s ability to reasonably verify identity where it has the right or obligation to do so
Supporting quotations
You can submit a right to know/access, correct, and deletion request to through our online form.
Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.
If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.
Qualifications & exceptions
Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.
Legal Rights & Agreement Rules · Procedure
Iowa and Utah opt-out: Global Privacy Control treated only as a sale opt-out
For the Iowa and Utah section, the reader can opt out of the “sale” of Personal Information or the processing of it for targeted advertising, and limit Roku’s use of sensitive Personal Information where permitted by law, through Roku’s Your Privacy Choices page or the Privacy section of the Settings menu on Roku players and Roku TV models. A browser sending the Global Privacy Control signal on any Roku Site is treated as a “sale” opt-out request only; this paragraph does not extend the signal to targeted advertising, unlike the multistate paragraph, and does not state scope limits for logged-in accounts.
Details
What it does
opt out of sale or processing for targeted advertising and limit sensitive data use
Condition
a GPC signal is treated only as a sale opt-out
Supporting quotations
You can exercise your right to opt out of the “sale” of your Personal Information, or the processing of your Personal Information for targeted advertising, and limit our use of your sensitive Personal Information, where permitted by law, by visiting Roku’s Your Privacy Choices page or visiting the Privacy section of the Settings menu of your Roku players and Roku TV models.
If you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a “sale” opt-out request.
Qualifications & exceptions
where permitted by law
Not stated here
The paragraph does not say how the signal is associated with a person, or whether it affects targeted advertising for this section’s states.
Legal Rights & Agreement Rules · Procedure
Iowa and Utah authorised agent may submit a request, subject to direct verification
Where permitted by applicable law, the reader may authorise another person as an “Authorized Agent” to submit a request through the methods described. The agent should submit proof of signed permission, and Roku may still require the reader to verify their identity directly and confirm directly that the agent was authorised. Questions go to privacy@roku.com.
Details
Who
the reader and their Authorized Agent
Condition
proof of signed permission, and possible direct verification and confirmation
Supporting quotations
Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above.
Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request.
We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.
Qualifications & exceptions
Where permitted by applicable law
We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.