US State Law Privacy Notice (CA Privacy Notice)

Legal Rights & Agreement Rules · Context

Additional state-law notice for residents of 19 listed states, supplementing the Privacy Policy

This document is an additional notice for residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. It supplements the information in the Privacy Policy and applies to residents of those states whose data Roku processes as a business or controller. It is dated July 1, 2026. The Privacy Policy it supplements is linked but not supplied, so its contents are not described here.

Supporting quotations

Last updated: July 1, 2026

US State Law Privacy Notice

This additional notice (“Notice”) is for residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and supplements the information contained in the Privacy Policy and applies to residents of those states whose data we process as a business or controller.

Qualifications & exceptions

• applies to residents of those states whose data we process as a business or controller

Not stated here

• The Privacy Policy that this Notice supplements is not supplied by this source, so the combined effect of the two documents is not stated.

Legal Rights & Agreement Rules · Context

Notice describes rights under the 20 named state laws it calls the “U.S. State Privacy Laws”

The Notice says it describes how residents exercise rights under a named list of state laws: the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Delaware Personal Data Privacy Act, the Florida Digital Bill of Rights, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the New Hampshire Data Privacy Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act and the Virginia Consumer Data Protection Act, collectively the “U.S. State Privacy Laws”. Those laws are external instruments; this Notice does not restate their requirements.

Supporting quotations

It also describes how you exercise the rights under the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Delaware Personal Data Privacy Act, the Florida Digital Bill of Rights, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the New Hampshire Data Privacy Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act (collectively the “U.S. State Privacy Laws”).

Data Access & Collection · Context

“Personal Information” takes the listed state laws’ meaning, minus publicly available, deidentified or out-of-scope data

For this Notice, “Personal Information” means information that the laws listed in this Part VI define as “Personal Information” or “Personal Data”, and where applicable it has the same meaning as those same terms or similar terms under the U.S. State Privacy Laws of the state where the resident lives. The Notice excludes three kinds of information from that definition: publicly available information as the applicable state laws define it, deidentified or aggregated information, and information otherwise excluded from the scope of those laws.

Supporting quotations

For the purpose of this Notice, “Personal Information” means information that the laws listed in this Part VI define as “Personal Information or “Personal Data”.

Where applicable, Personal Information has the same meaning as those same terms or similar terms under the U.S. State Privacy Laws of the state in which you reside.

Publicly available, as defined by the applicable U.S. State Privacy Laws.

Deidentified or aggregated.

Otherwise excluded from the scope of the applicable U.S. State Privacy Laws.

Qualifications & exceptions

• Publicly available, as defined by the applicable U.S. State Privacy Laws.
• Deidentified or aggregated.
• Otherwise excluded from the scope of the applicable U.S. State Privacy Laws.

Legal Rights & Agreement Rules · Context

A term defined differently across the state laws takes the meaning of the resident’s own state law

Where a term used in the Notice has a different meaning under different U.S. State Privacy Laws, the term takes the meaning given by the law of the state where the reader resides. This is an interpretive rule for reading the Notice; it does not itself describe a practice.

Supporting quotations

In the event that a term used in this Notice has a different meaning under different U.S. State Privacy Laws, such term shall have the meaning under the laws of the state in which you reside.

Data Access & Collection · Company practice

California sources: information you provide, automatic collection through the Roku Services, and listed third parties

For California, Roku says it collects Personal Information from the reader when the reader provides it, and automatically through the Roku Services. It may also obtain information about the reader from other sources: third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts the reader links to a Roku account, participating merchants and their partners, and other users who referred the reader or provided the reader’s information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services.

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• when you provide it to us or automatically through the Roku Services
• if they have referred you to the Roku Services or provided your information to us

Data Access & Collection · Company practice

California table row A: identifiers, including device identifiers, IP addresses and browser cookies

In the California section, the Notice presents a three-column table headed “Categories of Personal Information Being Collected and Processed”, “The Purposes for Processing” and the categories of third parties to whom information is shared or sold. Row A of that table lists identifiers as a collected and processed category, including device identifiers, internet protocol addresses, browser cookies and other unique online identifiers. The same row sets out, in separate cells, the purposes and the third-party recipients.

Supporting quotations

Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing

Categories of Personal Information Being Collected and Processed

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

Use & Processing · Company practice

Identifiers used to run the Roku Services, fulfil orders, analyse use and personalise recommendations

For the identifiers category, the table lists these purposes: to provide and maintain the Roku Services and to process and fulfil requests or orders; to understand and analyse the user base and how the Roku Services are used, to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve advertisers) and to develop new products, services, features and functionality; and to personalise the experience on the Roku Services, including suggesting and offering relevant content and recommendations.

Supporting quotations

The Purposes for Processing

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers
• on the Roku Services

Use & Processing · Company practice

Identifiers used to show targeted ads on the Roku Services, Third-Party Channels and third-party sites, apps and devices

For the identifiers category, the table states that Roku uses the information to show the reader ads, including targeted ads, through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices. Roku also uses it to measure and understand the reach, viewership and effectiveness of advertising and to provide advertising analytics and reporting, and to help advertisers and advertising partners reach the desired audience and understand, measure and improve their ad campaigns.

Supporting quotations

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

We use your information to measure and understand the reach, viewership, and effectiveness of advertising, and provide advertising analytics and reporting.

Qualifications & exceptions

• including targeted ads
• through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices

Use & Processing · Company practice

Identifiers used for marketing alerts, notifications, emails and texts, including offers from Roku’s partners

For the identifiers category, the table lists marketing as a purpose: to send alerts, notifications, emails and text messages about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of that marketing. The Notice does not state in this cell whether recipients can opt out of those messages; the choices section is separate.

Supporting quotations

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

Qualifications & exceptions

• from Roku or its partners

Use & Processing · Company practice

Identifiers used for performance metrics, service messages, enforcing terms and tackling fraud or illegal activity

For the identifiers category, the remaining listed purposes are: to measure performance and analyse key metrics relevant to Roku’s business; to communicate with the reader, including service information such as confirmations, invoices, notices, updates, security alerts, user surveys and support and administrative messages, and to respond to comments and questions and provide customer service; to enforce Roku’s terms and conditions or protect its business, partners or users and comply with contractual and legal obligations; and to protect, investigate and deter fraudulent, unauthorised, infringing or illegal activity, including click fraud.

Supporting quotations

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Identifiers shared for cross-context behavioural advertising or sold to advertisers and ad measurement providers

For the identifiers category, the table’s third column lists the categories of third parties to whom Personal Information is “shared” for cross-context behavioural advertising or “sold”: advertisers, ad networks, advertising partners, and ad measurement providers. The stated purpose attached to that cell is to bring the reader more relevant ads and to report on the effectiveness of ad campaigns. The column heading covers both sharing for cross-context behavioural advertising and selling, and the cell does not say which recipients fall on which side of that line.

Supporting quotations

Categories of Third Parties to Whom the Personal Information is "Shared" for Cross-Context Behavioral Advertising or "Sold" and the Purpose

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Categories of Third Parties to Whom the Personal Information is "Shared" for Cross-Context Behavioral Advertising or "Sold" and the Purpose

Not stated here

• The table groups recipients that receive information for cross-context behavioural advertising and recipients that buy it in one column, and does not state which individual recipients are a “sale” rather than a “share”.

Cross-references

• contrast (model-proposed): Multistate identifiers are “sold” to advertisers, app and content providers, and third-party platforms and devices — The same three recipient cells for identifiers appear under a California column labelled “Shared” for cross-context behavioural advertising or “Sold” and under a multistate column labelled only “Sold”. The readers of each chart see a different label for the same recipients.

Sharing & Disclosure · Company practice

Identifiers also shared with app and content providers and with third-party platforms and devices

Still in row A (identifiers) of the California table, two further recipient cells list, for the “shared” for cross-context behavioural advertising or “sold” column: app providers, where the app is installed on the reader’s Roku Device, and content providers from whom the reader purchases or subscribes to content, to help the reader discover content and provide a more tailored experience on the Roku Services, for analytics and reporting by those providers, or to bring more relevant ads and report on campaign effectiveness; and third-party platforms and devices the reader uses to access the Roku Services, to help them bring more relevant ads and report on ad effectiveness.

Supporting quotations

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• where the app is installed on your Roku Device
• Third party platforms and devices you use to access the Roku Services

Data Access & Collection · Company practice

Account registration information collected: name, address, email, telephone and payment card details

Row B of the California table lists account registration information as a category of Personal Information collected and processed: name, address, email address, telephone number, and payment method and card number. The table does not distinguish which of those elements are required to register an account.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

Not stated here

• The table does not say which of these fields are mandatory to create an account.

Use & Processing · Company practice

Account registration information used to run the service, analyse use, personalise, advertise, market and prevent fraud

Row B of the California table attaches the same set of purposes to account registration information that it attaches to identifiers: provide and maintain the Roku Services and process and fulfil requests or orders; understand and analyse the user base and improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve advertisers) and develop new products and features; personalise the experience on the Roku Services, including relevant content and recommendations; marketing alerts, notifications, emails and texts about products, events, promotions and offers from Roku or its partners and measuring marketing effectiveness; measure performance and analyse key business metrics; communicate service information, respond to comments and questions and provide customer service; enforce terms and protect the business, partners or users and comply with contractual and legal obligations; and protect, investigate and deter fraudulent, unauthorised, infringing or illegal activity, including click fraud.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Data Access & Collection · Company practice

Characteristics of protected classifications under California or federal law collected as a category

Row C of the California table lists “Characteristics of protected classifications under California or Federal law” as a category of Personal Information collected and processed. It does not say which specific characteristics Roku collects or from which source; that detail is not supplied in this row.

Supporting quotations

C. Characteristics of protected classifications under California or Federal law

Not stated here

• The table does not identify which protected characteristics Roku collects or how it obtains them.

Use & Processing · Company practice

Protected-classification characteristics used for service delivery, analytics, personalisation, ads and enforcement

Row C attaches to protected-classification characteristics the purposes listed in its purpose column: provide and maintain the Roku Services and fulfil requests or orders; analyse the user base and improve and enhance the Roku Services (including building correlations for Roku’s advertising services) and develop new features; personalise the experience; show ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices and measure advertising; marketing messages and marketing measurement; measure performance; and enforce terms and comply with contractual and legal obligations. Row C does not list a service-communications or fraud-prevention purpose in this packet’s cells.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices

Sharing & Disclosure · Company practice

Protected-classification characteristics shared with advertisers, ad networks and ad measurement providers

For row C, the third column lists advertisers, ad networks, advertising partners and ad measurement providers as the categories of third parties to whom the information is “shared” for cross-context behavioural advertising or “sold”, for the purpose of bringing more relevant ads and reporting on ad campaign effectiveness. This is the same recipient list the table gives for identifiers in this column.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• for cross-context behavioural advertising or “sold”

Not stated here

• The table gives the same recipient categories as for identifiers and does not say whether protected-classification characteristics are shared or sold to each of them.

Data Access & Collection · Company practice

Commercial information collected: purchase, obtained or considered records and purchasing or consuming histories

Row D of the California table lists commercial information as a collected and processed category: records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Use & Processing · Company practice

Commercial information used to run the service, analyse use, personalise, advertise, market and communicate

Row D attaches to commercial information: provide and maintain the Roku Services and fulfil requests or orders; analyse the user base and improve and enhance the Roku Services (including building correlations for Roku’s advertising services) and develop new features; personalise the experience; show ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices and measure advertising reach, viewership and effectiveness; marketing messages from Roku or its partners and marketing measurement; measure performance and key business metrics; and communicate with the reader, including service information and customer service responses. Row D does not attach an enforcement or fraud-prevention purpose in this packet’s cells.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Use & Processing · Company practice

Commercial information also used to enforce terms, meet legal obligations and deter fraud

Row D of the California table continues in this section with two further purposes for commercial information: to enforce Roku’s terms and conditions or protect its business, partners or users and comply with contractual and legal obligations; and to protect, investigate and deter fraudulent, unauthorised, infringing or illegal activity, including click fraud. Together with the cells carded earlier for the same row, this completes the purpose list the table gives for commercial information.

Supporting quotations

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Commercial information shared with advertisers, ad networks, advertising partners and ad measurement providers

For row D, the table’s third column lists advertisers, ad networks, advertising partners and ad measurement providers as the categories of third parties to whom commercial information is “shared” for cross-context behavioural advertising or “sold”, to bring the reader more relevant ads and report on ad campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• for cross-context behavioural advertising or “sold”

Not stated here

• The table does not say which of these recipients receive commercial information as a “share” and which as a “sale”.

Data Access & Collection · Company practice

Internet or network activity collected: browsing and search history and interaction with sites, apps and ads

Row E of the California table lists internet or other electronic network activity information as a collected and processed category, including, but not limited to, browsing history, search history, and information about a consumer’s interaction with an internet website, application or advertisement. The row does not say how long that activity information is kept.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

Not stated here

• The row does not state a retention period for the activity information.

Use & Processing · Company practice

Network activity used for service delivery, analytics, personalisation, ads, marketing, enforcement and fraud

Row E attaches the table’s full set of purposes to network activity information: provide and maintain the Roku Services and fulfil requests or orders; understand and analyse the user base and improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve advertisers) and develop new products and features; personalise the experience on the Roku Services; show ads, including targeted ads, through the Roku Services, on Third-Party Channels and on third-party websites, apps, platforms and devices, and measure advertising; marketing messages and marketing measurement; measure performance and key business metrics; communicate service information and provide customer service; enforce terms and comply with contractual and legal obligations; and protect, investigate and deter fraudulent, unauthorised, infringing or illegal activity, including click fraud.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Network activity shared with advertisers, app and content providers, and third-party platforms and devices

For row E, the table lists three recipient cells for the column covering categories of third parties to whom information is “shared” for cross-context behavioural advertising or “sold”: advertisers, ad networks, advertising partners and ad measurement providers; app providers, where the app is installed on the reader’s Roku Device, and content providers from whom the reader purchases or subscribes to content, for content discovery and a tailored experience, provider analytics and reporting, or more relevant ads and campaign-effectiveness reporting; and third-party platforms and devices the reader uses to access the Roku Services, for more relevant ads and ad-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• where the app is installed on your Roku Device
• Third party platforms and devices you use to access the Roku Services

Not stated here

• The table does not say which recipients receive network activity as a “share” and which as a “sale”.

Data Access & Collection · Company practice

General geolocation collected: designated market area, country, province, state, city and postal code

Row F of the California table lists general geolocation data as a collected and processed category, such as general location and geographical information, including designated market area, country, province, state, city and postal code. This is described as general geolocation; precise geolocation is a separate row G.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

Use & Processing · Company practice

General geolocation used across service delivery, analytics, personalisation, ads, marketing and enforcement

Row F attaches the table’s full set of purposes to general geolocation: provide and maintain the Roku Services and fulfil requests or orders; analyse the user base and improve and enhance the Roku Services (including building correlations for Roku’s advertising services) and develop new features; personalise the experience; show ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices and measure advertising; marketing messages and marketing measurement; measure performance; communicate service information and provide customer service; enforce terms and comply with obligations; and protect against and investigate fraud and illegal activity.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices

Sharing & Disclosure · Company practice

General geolocation shared with advertisers, ad networks and ad measurement providers

For row F, the third column lists advertisers, ad networks, advertising partners and ad measurement providers as the categories of third parties to whom general geolocation data is “shared” for cross-context behavioural advertising or “sold”, to bring more relevant ads and report on ad campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• for cross-context behavioural advertising or “sold”

Not stated here

• The table does not say which recipients receive general geolocation as a “share” and which as a “sale”.

Data Access & Collection · Company practice

Precise geolocation collected; the supplied cells list running the service and personalising the experience

Row G of the California table lists precise geolocation as a collected and processed category. The purpose cells supplied in this section list two purposes: to provide and maintain the Roku Services and process and fulfil requests or orders, and to personalise the experience on the Roku Services. This card states only the cells present here; the notice does not say how precise geolocation is obtained or whether the row continues with further purposes.

Supporting quotations

G. Precise geolocation

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

Qualifications & exceptions

• To personalize your experience on the Roku Services.

Not stated here

• The supplied cells do not say how precise geolocation is collected or whether the row has further purposes beyond these two.

Use & Processing · Company practice

Precise geolocation also used to protect against and investigate fraud; no analytics, ad or marketing purpose listed

Row G of the California table closes with a fraud purpose: precise geolocation is used to protect, investigate and deter against fraudulent, unauthorised, infringing or illegal activity, including click fraud. Taken with the two cells carded earlier, the row lists only three purposes — providing and maintaining the Roku Services and fulfilling requests or orders, personalising the experience, and this fraud purpose — and does not list analytics, advertising or marketing purposes for precise geolocation.

Supporting quotations

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Data Access & Collection · Company practice

Audio, electronic, visual, thermal, olfactory or similar information collected as a category

Row H of the California table lists audio, electronic, visual, thermal, olfactory or similar information as a collected and processed category of Personal Information. The row does not say which of those sensory or similar types Roku actually collects or in what settings.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

Not stated here

• The row does not say which of the listed information types Roku collects or where it is captured.

Use & Processing · Company practice

Audio and similar information used for service delivery, analytics, performance measurement, enforcement and fraud

Row H attaches these purposes to audio, electronic, visual, thermal, olfactory or similar information: provide and maintain the Roku Services and fulfil requests or orders; analyse the user base and improve and enhance the Roku Services (including building correlations for Roku’s advertising services) and develop new features; measure performance and key business metrics; communicate service information and provide customer service; enforce terms and comply with contractual and legal obligations; and protect against and investigate fraud and illegal activity. The row does not list personalisation, advertising or marketing purposes for this information in the supplied cells.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Inference & Profiling · Company practice

Inferences drawn from Personal Information, including preferences and interests, collected as a category

Row I of the California table lists inferences drawn from Personal Information as a collected and processed category, including preferences, interests and other information used to personalise the reader’s experience.

Supporting quotations

I. Inferences drawn from Personal Information, including your preferences, interests, and other information used to personalize your experience

Use & Processing · Company practice

Inferences used across service delivery, analytics, personalisation, ads, marketing, communications and enforcement

Row I attaches the table’s full set of purposes to inferences: provide and maintain the Roku Services and fulfil requests or orders; analyse the user base and improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve advertisers) and develop new features; personalise the experience on the Roku Services, including relevant content and recommendations; show ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices and measure advertising; marketing messages and marketing measurement; measure performance; communicate service information and provide customer service; enforce terms and comply with obligations; and protect against and investigate fraud and illegal activity.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Inferences shared with advertisers, ad networks and ad measurement providers

For row I, the third column lists advertisers, ad networks, advertising partners and ad measurement providers as the categories of third parties to whom inferences are “shared” for cross-context behavioural advertising or “sold”, to bring more relevant ads and report on ad campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• for cross-context behavioural advertising or “sold”

Not stated here

• The table does not say which recipients receive inferences as a “share” and which as a “sale”.

Data Access & Collection · Company practice

Professional or employment information collected as a category

Row J of the California table lists professional or employment information as a collected and processed category. The row does not describe which employment details Roku collects or how it obtains them.

Supporting quotations

J. Professional or Employment Information

Not stated here

• The row does not describe the specific employment details collected or their source.

Use & Processing · Company practice

Professional or employment information used for analytics, personalisation, ads, marketing, performance and enforcement

Row J attaches these purposes to professional or employment information: analyse the user base and improve and enhance the Roku Services (including building correlations for Roku’s advertising services) and develop new features; personalise the experience on the Roku Services; show ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices and measure advertising; marketing messages and marketing measurement; measure performance; and enforce terms and comply with contractual and legal obligations. The supplied cells for this row do not list service delivery or fraud-prevention purposes.

Supporting quotations

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices

Sharing & Disclosure · Company practice

Professional or employment information shared with advertisers, ad networks and ad measurement providers

For row J, the third column lists advertisers, ad networks, advertising partners and ad measurement providers as the categories of third parties to whom professional or employment information is “shared” for cross-context behavioural advertising or “sold”, to bring more relevant ads and report on ad campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• for cross-context behavioural advertising or “sold”

Not stated here

• The table does not say which recipients receive professional or employment information as a “share” and which as a “sale”.

Data Access & Collection · Company practice

Education information collected; supplied cells list analytics and personalisation purposes

Row K of the California table lists education information as a collected and processed category. The purpose cells supplied in this section list two purposes: analysing the user base and improving and enhancing the Roku Services (including building correlations for Roku’s advertising services) and developing new features, and personalising the experience on the Roku Services with relevant content and recommendations. This card states only the cells present here; the row may continue with further purposes.

Supporting quotations

K. Education Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Qualifications & exceptions

• on the Roku Services

Not stated here

• Only part of row K is supplied in this section; the card does not say whether further purposes or recipients follow.

Use & Processing · Company practice

Education information also used for ads, marketing, performance measurement and enforcement

Row K continues with further purposes for education information: show ads, including targeted ads, through the Roku Services, on Third-Party Channels and on third-party websites, apps, platforms and devices, and measure advertising reach, viewership and effectiveness; marketing alerts, notifications, emails and texts about products, events, promotions and offers from Roku or its partners and marketing measurement; measure performance and key business metrics; and enforce terms and comply with contractual and legal obligations. With the two cells carded earlier, this completes the purposes listed for education information.

Supporting quotations

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices

Sharing & Disclosure · Company practice

Education information shared with advertisers, ad networks and ad measurement providers

For row K, the third column lists advertisers, ad networks, advertising partners and ad measurement providers as the categories of third parties to whom education information is “shared” for cross-context behavioural advertising or “sold”, to bring more relevant ads and report on ad campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• for cross-context behavioural advertising or “sold”

Not stated here

• The table does not say which recipients receive education information as a “share” and which as a “sale”.

Data Access & Collection · Company practice

Sensitive categories collected: racial or ethnic origin, religious beliefs, union membership, health and wellness

Row L of the California table lists Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, and health and wellness information as a collected and processed category. The row does not say how Roku obtains this information or how it keeps it apart from other categories.

Supporting quotations

L. Personal Information that reveals racial or ethnic origin, religious or philosophical beliefs, union membership, health, and wellness information

Not stated here

• The row does not state the source of these sensitive details or any separate handling beyond the purposes listed.

Use & Processing · Company practice

Sensitive beliefs and health data used for analytics, personalisation, targeted ads, marketing and enforcement

Row L attaches these purposes to the sensitive categories it lists: analyse the user base and improve and enhance the Roku Services (including building correlations for Roku’s advertising services) and develop new features; personalise the experience on the Roku Services; show ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices and measure advertising; marketing messages and marketing measurement; measure performance; and enforce terms and comply with obligations. The supplied cells do not list a service-delivery or fraud-prevention purpose for this row.

Supporting quotations

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Sensitive beliefs and health data shared with advertisers, ad networks and ad measurement providers

For row L, the third column lists advertisers, ad networks, advertising partners and ad measurement providers as the categories of third parties to whom this sensitive information is “shared” for cross-context behavioural advertising or “sold”, to bring more relevant ads and report on ad campaign effectiveness. The table thus places the sensitive categories in the same recipient column as the other rows.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• for cross-context behavioural advertising or “sold”

Not stated here

• The table does not say which recipients receive these sensitive categories as a “share” and which as a “sale”, or whether any consent step applies before that sharing.

Security & Safeguards · Company practice

Account credentials, card numbers with access codes, SSN and licence or passport numbers collected as a category

Row M of the California table lists Personal Information that reveals: (a) account log-in, financial account, debit card or credit card number in combination with any required security or access code, password or credentials allowing access to an account; (b) social security, driver’s licence, state identification card or passport number; and (c) content of consumer emails, texts and messages where Roku is not the intended recipient.

Supporting quotations

M. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

Qualifications & exceptions

• in combination with any required security or access code, password, or credentials allowing access to an account
• where we are not the intended recipient

Use & Processing · Company practice

Account credentials and government identifiers used to run the service, enforce terms and prevent fraud

Row M lists only three purposes for this category: provide and maintain the Roku Services and process and fulfil requests or orders; enforce Roku’s terms and conditions or protect its business, partners or users and comply with contractual and legal obligations; and protect, investigate and deter fraudulent, unauthorised, infringing or illegal activity, including click fraud. The row does not list analytics, personalisation, advertising or marketing purposes.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Over the past 12 months, every listed category was disclosed for a business purpose to service providers and contractors

Below the table, Roku states that over the past 12 months it has disclosed for a business purpose each of the categories of Personal Information described in the chart to service providers and contractors. The statement does not give a per-category breakdown of those disclosures.

Supporting quotations

Over the past 12 months, Roku has disclosed for a business purpose each of the categories of Personal Information as described in the chart above to service providers and contractors.

Qualifications & exceptions

• Over the past 12 months
• to service providers and contractors

Not stated here

• The Notice does not itemise which service providers or contractors received which category.

Sharing & Disclosure · Company practice

Roku reports collecting, processing, disclosing, sharing and selling every category over 12 months

Roku states that over the past 12 months it has collected, processed, disclosed, shared for cross-context behavioural advertising, and sold each of the categories of Personal Information described in the chart above. The statement covers every category in the chart equally and gives no per-category figures, volumes or recipients beyond those in the chart.

Supporting quotations

Over the past 12 months, Roku has collected, processed, disclosed, shared for cross-context behavioral advertising, and sold each of the categories of Personal Information as described in the chart above.

Qualifications & exceptions

• Over the past 12 months

Not stated here

• The statement gives no per-category figures or identification of recipients for the sale or sharing.

Sharing & Disclosure · Company commitment

Roku states it has no actual knowledge that it sells or shares the Personal Information of consumers under 16

Roku states that it does not have actual knowledge that it sells Personal Information, or shares Personal Information for cross-context behavioural advertising, of consumers under 16 years of age. This is a statement about Roku’s knowledge; the sentence does not say that no such sale or sharing occurs.

Supporting quotations

Roku does not have actual knowledge that it sells Personal Information or shares for cross-context behavioral advertising the Personal Information of consumers under 16 years of age.

Qualifications & exceptions

• does not have actual knowledge

Not stated here

• The statement does not describe what checks Roku runs to establish that knowledge.

Data Access & Collection · Company practice

Roku says it does not collect genetic or biometric information, neural data, sex-life data or citizenship status

Roku states that it does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status. This negative statement sits beside the table that lists other sensitive categories, such as protected classifications and health and wellness information, which Roku does describe collecting.

Supporting quotations

Roku does not collect genetic or biometric information, neural data, information on sex life or sexual orientation, or citizenship or citizenship status.

Retention & Deletion · Company practice

Personal Information kept as long as needed for legitimate business purposes or as law requires or allows

The Retention paragraph says Personal Information Roku collects may be retained for as long as needed to fulfil legitimate business purposes, including the purposes outlined in Section 2 of the Notice, which is the collections, purposes and disclosures table carded above. It may also be kept for a time period specifically required or allowed by applicable regulations or laws. No fixed retention period is stated for any category.

Supporting quotations

Retention

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• for as long as needed to fulfill legitimate business purposes
• or for a time period specifically required or allowed by applicable regulations or laws

Not stated here

• No fixed or maximum retention period is given for any category of Personal Information.

Legal Rights & Agreement Rules · User right or choice

California residents may exercise the listed privacy rights, subject to certain exceptions

For California residents, the Notice says the following rights may be exercised, subject to certain exceptions. The list that follows covers the rights to know, access, correct, delete, opt out of sale or sharing for cross-context behavioural advertising, limit use or disclosure of sensitive Personal Information where permitted by law, be free from retaliation and appeal a decision on a privacy request. The Notice does not enumerate the exceptions in this sentence.

Supporting quotations

If you are a California resident, subject to certain exceptions, you may exercise the following rights:

Qualifications & exceptions

• subject to certain exceptions
• If you are a California resident

Not stated here

• The Notice does not list the exceptions that apply to these rights at this point; later sections may qualify individual rights.

Legal Rights & Agreement Rules · User right or choice

Right to know the categories collected, sources, purposes, recipients, and what was sold, shared or disclosed

The right to know covers what Personal Information Roku has collected about the reader, including the categories of Personal Information, the categories of sources, the business or commercial purpose for collecting, selling or sharing it, the categories of third parties to whom Roku discloses it, the categories sold or shared and the categories of third parties for each, and the categories disclosed for a business purpose with the categories of service providers or contractors for each.

Supporting quotations

The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, the categories of Personal Information that the business sold or shared, and for each category identified, the categories of third parties to whom it sold or shared that particular category of Personal Information, and the categories of Personal Information that the business disclosed for a business purpose, and for each category identified, the categories of service providers or contractors to whom it disclosed that particular category of Personal Information.

Legal Rights & Agreement Rules · User right or choice

Rights to access specific pieces in portable form, correct inaccurate information and request deletion

The Notice lists three further rights: access to the specific pieces of Personal Information Roku has collected, in a portable and, to the extent technically feasible, readily usable format; correction of inaccurate Personal Information Roku maintains; and request of deletion of Personal Information Roku has collected.

Supporting quotations

The right to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.

The right to correct inaccurate Personal Information that we maintain about you.

The right to request deletion of the Personal Information that we have collected about you.

Qualifications & exceptions

• to the extent technically feasible

Legal Rights & Agreement Rules · User right or choice

Rights to opt out of sale or sharing for cross-context behavioural advertising and to limit sensitive data use

The Notice lists the right to opt out of the sale of Personal Information, or the sharing of Personal Information for cross-context behavioural advertising, and the right to limit Roku’s use or disclosure of sensitive Personal Information where permitted by law.

Supporting quotations

The right to opt out of the sale of Personal Information, or the sharing of Personal Information for cross-context behavioral advertising.

The right to limit our use or disclosure of your sensitive Personal Information, where permitted by law.

Qualifications & exceptions

• where permitted by law

Cross-references

• contrast (model-proposed): Multistate rights to opt out of processing for targeted advertising and opt out of sale — The California list states one opt-out right covering sale and sharing for cross-context behavioural advertising; the multistate list splits the opt-out into sale and processing for targeted advertising. The two formulations describe overlapping but differently named practices.

Legal Rights & Agreement Rules · User right or choice

Rights not to be retaliated against for exercising privacy rights and to appeal a request decision

The Notice lists the right not to be retaliated against for the exercise of privacy rights and the right to appeal any decision regarding a privacy request.

Supporting quotations

The right to not be retaliated against for the exercise of your privacy rights.

The right to appeal any decision with regard to your privacy request

Legal Rights & Agreement Rules · Procedure

Know, access, correct and delete requests through the online form, with identity verification

Requests to know or access, correct and delete can be submitted through Roku’s online form. Roku says such requests are subject to its ability to reasonably verify the requester’s identity where it has the right or obligation to do so under applicable law: account holders are verified by being asked to log into the account, and people without a Roku account are asked to provide data elements Roku may have collected, such as device type, device ID and cookie ID, through the online form or by email to privacy@roku.com.

Supporting quotations

You can submit a right to know/access, correct, and deletion request to through our online form.

Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.

If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.

Qualifications & exceptions

• Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.
• If you have a Roku account, we will verify your identity by asking you to log into your account.

Not stated here

• The Notice does not say what happens if identity cannot be verified or how long verification takes.

Legal Rights & Agreement Rules · Procedure

Opt-out through Your Privacy Choices page or Roku settings, and Global Privacy Control signals

The reader can opt out of the “sale” of Personal Information or the “sharing” of it for cross-context behavioural advertising, and limit Roku’s use of sensitive Personal Information where permitted by law, through Roku’s Your Privacy Choices page or the Privacy section of the Settings menu on Roku players and Roku TV models. A browser sending the Global Privacy Control signal on any Roku Site is treated as a “sale” and “sharing” opt-out request. When the reader is logged into a Roku account, a GPC signal is honoured for that account; when not logged in or without an account, it is honoured for the browser the signal comes from, subject to Roku’s ability to associate the signal with the reader’s information.

Supporting quotations

You can exercise your right to opt out of the “sale” of your Personal Information, or the “sharing” of your Personal Information for cross-context behavioral advertising, and limit our use of your sensitive Personal Information, where permitted by law, by visiting Roku’s Your Privacy Choices page or visiting the Privacy section of the Settings menu of your Roku players and Roku TV models.

If you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a “sale” and “sharing” opt-out request.

When you are logged into your Roku account, we honor a GPC signal as a request to opt out of the “sale” and “sharing” of personal information for that account.

When you are not logged into a Roku account or you do not have a Roku account, we honor a GPC signal as a request to opt out of the “sale” and “sharing” of personal information for the browser from which the signal is received, subject to our ability to associate the signal with your information.

Qualifications & exceptions

• where permitted by law
• subject to our ability to associate the signal with your information

Not stated here

• The Notice does not say how a GPC signal is associated with a person when they are not logged in, beyond the stated limit.

Cross-references

• contrast (model-proposed): Multistate opt-out of targeted advertising or sale, with Global Privacy Control where the law requires it — California treats a Global Privacy Control signal as a “sale” and “sharing” opt-out and states how it applies to a logged-in account versus a browser; the multistate paragraph applies the signal to targeted advertising and sale only “Where required by law” and states no account-scope rule.

Legal Rights & Agreement Rules · Procedure

An authorised agent may submit a privacy request with signed permission, but Roku may verify the person directly

Where permitted by applicable law, the reader may authorise another person as an “Authorized Agent” to submit a request through the methods described. The agent should submit proof of the reader’s signed permission. Roku may still require the reader to verify their identity directly and to confirm directly that the agent was given permission. The section ends by inviting questions to privacy@roku.com.

Supporting quotations

Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above.

Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request.

We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Qualifications & exceptions

• Where permitted by applicable law
• We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Legal Rights & Agreement Rules · Procedure

Shine the Light: yearly free request about sharing for third parties’ own direct marketing

Under California’s Shine the Light law, California residents may ask and receive, once per calendar year and free of charge, information about Roku’s sharing of their Personal Information, if any, with third parties for those third parties’ own direct marketing use. Requests go to privacy@roku.com and should include the reader’s name and an attestation that they are a California resident, plus a current California address; Roku may ask for more information to confirm identity before responding.

Supporting quotations

California’s Shine-the-Light Law.

California’s Shine the Light law permits California residents to request and receive, once per calendar year and free of charge, information about our sharing of your Personal Information (if any) with third parties for their own direct marketing use.

In your request, please include your name and attest to the fact that you are a California resident and provide a current California address.

Qualifications & exceptions

• once per calendar year and free of charge
• for their own direct marketing use
• please include your name and attest to the fact that you are a California resident and provide a current California address

Legal Rights & Agreement Rules · Context

Section B repeats the state-law notice for Colorado, Connecticut and 14 other listed states

After the California section, the Notice opens a section “B.” for residents of Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas and Virginia. The section then repeats the same topics as the California section — sources of Personal Information, the categories and purposes chart, and rights. California is not repeated in this list because it has its own section A.

Supporting quotations

B. Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia

Not stated here

• This section lists 16 states, while the introduction names 20; whether Iowa, Maryland and Utah are covered in a further section is not established by this packet.

Data Access & Collection · Company practice

The same collection sources are stated for the multistate group

Section B repeats the sources statement: Personal Information is collected from the reader when provided and automatically through the Roku Services, and may be obtained from third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts the reader links to a Roku account, participating merchants and their partners, and other users who referred the reader or provided the reader’s information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services.

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• if they have referred you to the Roku Services or provided your information to us

Data Access & Collection · Context

The multistate chart repeats the category and purpose column headings

Section B repeats the chart heading “Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing” and supplies its first two column headings: “Categories of Personal Information Being Collected and Processed” and “The Purposes for Processing”. The remaining columns of this multistate chart appear later in the source and are not supplied in this packet.

Supporting quotations

Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing

Categories of Personal Information Being Collected and Processed

The Purposes for Processing

Not stated here

• Only the first two column headings of the multistate chart are supplied here; the later columns are described in following packets.

Sharing & Disclosure · Context

The multistate chart separates third parties a category is disclosed to from those it is “sold” to

The multistate chart has four columns: categories of Personal Information being collected and processed, the purposes for processing, “Categories of Third Parties to Whom the Personal Information Is Disclosed”, and “Categories of Third Parties to Whom the Personal Information is "Sold" and the Purpose”. Unlike the California chart, which combines sharing for cross-context behavioural advertising and selling in one column, this chart keeps disclosure recipients and sale recipients in separate columns, and only the sale column states a purpose.

Supporting quotations

Categories of Third Parties to Whom the Personal Information Is Disclosed

Categories of Third Parties to Whom the Personal Information is "Sold" and the Purpose

Not stated here

• The chart does not define “disclosed” or “sold” itself, and neither column says whether a particular recipient receives a category for a business purpose only.

Use & Processing · Company practice

Multistate identifiers: the same nine purposes listed for identifiers in the California chart

Row A of the multistate chart lists identifiers — device identifiers, internet protocol addresses, browser cookies and other unique online identifiers — and attaches the same nine purposes the California chart lists for identifiers: running and maintaining the Roku Services and fulfilling requests or orders; analytics and improvement, including building correlations for Roku’s advertising services, and development; personalisation with content and recommendations; ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices; marketing messages and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Multistate identifiers are disclosed to service providers, platforms, advertisers, affiliates, authorities and merchants

For row A, the disclosure column names ten recipient groups to whom identifiers are disclosed: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; other users of the Roku Services; and merchants and their partners the reader transacts with on the Roku Services. The column does not describe what each recipient receives or the purpose of each disclosure.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Third party platforms and devices you use to access the Roku Services
• Merchants and their partners you transact with on Roku Services

Not stated here

• The disclosure column does not attach a purpose to each recipient or say what each one receives.

Sharing & Disclosure · Company practice

Multistate identifiers are “sold” to advertisers, app and content providers, and third-party platforms and devices

In the sale column of the multistate chart, three recipient groups are named for identifiers, each with its purpose: advertisers, ad networks, advertising partners and ad measurement providers, to bring more relevant ads and report on campaign effectiveness; app providers where the app is installed on the reader’s Roku Device, and content providers the reader purchases or subscribes to content from, for content discovery, a tailored experience, provider analytics and reporting, or relevant ads and campaign reporting; and third-party platforms and devices used to access the Roku Services, for relevant ads and ad-effectiveness reporting. The same three groups appear in the California chart under a combined “shared” for cross-context behavioural advertising or “sold” heading.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• where the app is installed on your Roku Device

Cross-references

• contrast (model-proposed): Identifiers shared for cross-context behavioural advertising or sold to advertisers and ad measurement providers — The same three recipient cells for identifiers appear under a California column labelled “Shared” for cross-context behavioural advertising or “Sold” and under a multistate column labelled only “Sold”. The readers of each chart see a different label for the same recipients.

Use & Processing · Company practice

Multistate account registration information: eight purposes, the same set as the California chart

Row B of the multistate chart lists account registration information — name, address, email address, telephone number, and payment method and card number — and attaches eight purposes: running and maintaining the Roku Services and fulfilling requests or orders; analytics and improvement, including building correlations for advertising, and development; personalisation; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention. As in the California chart, no advertising purpose is listed for this row.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Multistate account registration information disclosed to providers, affiliates, authorities and merchants

For row B, the disclosure column names five recipient groups: service providers and vendors; app and content providers from whom the reader is purchasing or subscribing; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and merchants and their partners the reader transacts with on the Roku Services. The chart as supplied lists no “sold” recipients for account registration information.

Supporting quotations

Service providers and vendors

App and content providers from whom you are purchasing or subscribing

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• App and content providers from whom you are purchasing or subscribing
• Merchants and their partners you transact with on Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure of account registration information.

Data Access & Collection · Company practice

Multistate protected classifications cover federal law only, and only where not “sensitive data”

Row C of the multistate chart lists “Characteristics of protected classifications under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws”. Two limits are stated in the category itself: it covers classifications under federal law rather than California or federal law as the California chart says, and it applies only to the extent those characteristics are not “sensitive data” under the applicable state laws. The chart does not say which characteristics Roku collects within that limit.

Supporting quotations

C. Characteristics of protected classifications under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws

Qualifications & exceptions

• under Federal law to the extent they are not "sensitive data" under applicable U.S. State Privacy Laws

Not stated here

• The row does not identify which federal-law protected characteristics Roku collects, or which are treated as “sensitive data” and therefore outside this row.

Use & Processing · Company practice

Multistate protected classifications used for service delivery, analytics, personalisation, ads and enforcement

For row C (characteristics of protected classifications under federal law, to the extent not “sensitive data”), the multistate chart lists seven purposes: running and maintaining the Roku Services and fulfilling requests or orders; analytics and improvement, including building correlations for Roku’s advertising services, and development; personalisation; ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices; marketing messages and marketing measurement; performance measurement; and enforcement and legal obligations. Unlike some other rows, no service-communications or fraud-prevention purpose appears for this row.

Supporting quotations

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Multistate protected classifications disclosed to providers, advertisers, affiliates and law enforcement

For row C, the disclosure column names six recipient groups: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests. The column states no purpose for these disclosures.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure of these characteristics.

Sharing & Disclosure · Company practice

Multistate protected classifications also appear in the “sold” column with six groups and no stated purpose

For row C, the “Sold” column repeats the same six recipient groups as the disclosure column: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests. Although the column heading says “and the Purpose”, these cells state no purpose, and the chart does not say which of these groups buys the information, which only receives it, or on what basis a service provider or law enforcement agency counts as a sale recipient.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Qualifications & exceptions

• Categories of Third Parties to Whom the Personal Information is "Sold" and the Purpose

Not stated here

• The cells state no purpose for the sale, and the chart does not explain how service providers and vendors or law enforcement recipients come within a “sold” column.

Use & Processing · Company practice

Multistate commercial information: the same nine purposes as the California chart

Row D of the multistate chart lists commercial information — records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies — and attaches the full nine purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Multistate commercial information disclosed to providers, advertisers, affiliates, authorities and merchants

For row D, the disclosure column names seven recipient groups: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and merchants and their partners the reader transacts with on the Roku Services.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Merchants and their partners you transact with on Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure of commercial information.

Sharing & Disclosure · Company practice

Multistate commercial information sold to advertisers, ad networks and ad measurement providers

For row D, the sale column names advertisers, ad networks, advertising partners and ad measurement providers, with the purpose of bringing more relevant ads and reporting on ad campaign effectiveness. This is the only recipient cell in that column for this row.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Data Access & Collection · Company practice

Multistate network activity information: category plus the first three purposes supplied

Row E of the multistate chart lists internet or other electronic network activity information, including browsing history, search history and information about a consumer’s interaction with an internet website, application or advertisement, and begins its purpose column with service delivery and order fulfilment, analytics and improvement (including building correlations for Roku’s advertising services) and development, and personalisation with relevant content and recommendations. The remaining purposes and recipient columns for this row are supplied in following packets.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

Not stated here

• Only the first three purposes for row E are supplied in this packet; the card does not state the rest of the row.

Use & Processing · Company practice

Multistate network activity: the remaining six purposes complete the same nine-purpose list

Row E of the multistate chart continues its purpose column with ads, including targeted ads, across the Roku Services, Third-Party Channels and third-party sites, apps and devices, with advertising analytics; marketing messages and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention, including click fraud. With the three purposes carded earlier, this completes the same nine purposes the California chart lists for network activity information.

Supporting quotations

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• including targeted ads
• through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices

Sharing & Disclosure · Company practice

Multistate network activity disclosed to nine recipient groups, including other users for community features

For row E, the disclosure column names nine recipient groups: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and other users of the Roku services when the reader uses certain features, such as posting on Roku Community or uploading product reviews or content.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku services when you use certain features of our service (e.g., when you post on Roku Community, upload product reviews or content)

Qualifications & exceptions

• when you use certain features of our service (e.g., when you post on Roku Community, upload product reviews or content)

Not stated here

• The chart does not attach a purpose to each disclosure of network activity information.

Sharing & Disclosure · Company practice

Multistate network activity sold to advertisers, app and content providers, and third-party platforms and devices

For row E, the sale column names the same three recipient groups as the other sold rows: advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign reporting; app providers where the app is installed on the reader’s Roku Device, and content providers the reader purchases or subscribes to content from, for content discovery, tailored experience, provider analytics and reporting, or relevant ads; and third-party platforms and devices used to access the Roku Services, for relevant ads and ad-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• where the app is installed on your Roku Device

Use & Processing · Company practice

Multistate general geolocation data used across the full nine purposes

Row F of the multistate chart lists general geolocation data — designated market area, country, province, state, city and postal code — and attaches nine purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Multistate general geolocation data disclosed to providers, advertisers, affiliates and law enforcement

For row F, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests. The column does not include app and content providers or merchant recipients for this row.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure of general geolocation data.

Sharing & Disclosure · Company practice

Multistate general geolocation sold to advertisers, ad networks and ad measurement providers

For row F, the sale column names advertisers, ad networks, advertising partners and ad measurement providers, with the purpose of bringing more relevant ads and reporting on ad campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Use & Processing · Company practice

Multistate precise geolocation used to run the service, personalise it and prevent fraud

Row G of the multistate chart lists precise geolocation and attaches three purposes: providing and maintaining the Roku Services and processing and fulfilling requests or orders; personalising the experience on the Roku Services; and protecting against, investigating and deterring fraudulent, unauthorised, infringing or illegal activity, including click fraud. As in the California chart, no analytics, advertising or marketing purpose is listed for precise geolocation.

Supporting quotations

G. Precise geolocation

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Multistate precise geolocation disclosed to service providers and affiliates

The disclosure cells supplied for row G name two recipient groups: service providers and vendors, and Roku’s affiliates. This packet supplies only those two disclosure cells for precise geolocation; the rest of that row is not stated here.

Supporting quotations

Service providers and vendors

Our affiliates

Not stated here

• Only two disclosure recipients are supplied for row G in this packet; the card does not say whether further recipients or a sale column entry follow.

Sharing & Disclosure · Company practice

Precise geolocation also disclosed to law enforcement and safety recipients; no sale entry for this row

Row G of the multistate chart closes its disclosure column with law enforcement or others involved with legal, security and safety matters, processes and requests. Together with service providers and vendors and Roku’s affiliates, that gives three disclosure recipients for precise geolocation, and the chart as supplied has no “sold” entry for this row.

Supporting quotations

Law enforcement or others involved with legal, security and safety matters, processes and requests.

Not stated here

• The chart as supplied has no sale-column entry for precise geolocation, and does not say why this category is absent from that column.

Use & Processing · Company practice

Multistate audio and similar information: six purposes, without ads or personalisation

Row H of the multistate chart lists audio, electronic, visual, thermal, olfactory or similar information as a collected and processed category and attaches six purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for Roku’s advertising services, and development; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention. The row lists no personalisation, advertising or marketing purpose.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Multistate audio and similar information disclosed to providers, voice assistants, affiliates and others

For row H, the disclosure column names six recipient groups: service providers and vendors; app and content providers; voice assistant providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and other users of the Roku Services. The chart as supplied shows no “sold” entry for this row.

Supporting quotations

Service providers and vendors

App and content providers

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure, and shows no sale entry for this row.

Inference & Profiling · Company practice

Multistate inferences used across the full nine purposes

Row I of the multistate chart lists inferences drawn from Personal Information — preferences, interests and other information used to personalise the experience — and attaches nine purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

I. Inferences drawn from Personal Information, including your preferences, interests, and other information used to personalize your experience

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Multistate inferences disclosed to providers, advertisers, measurement services, affiliates and authorities

For row I, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers and services; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers and services

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests.

Not stated here

• The chart does not attach a purpose to each disclosure of inferences.

Sharing & Disclosure · Company practice

Multistate inferences sold to advertisers, ad networks and ad measurement providers

For row I, the sale column names advertisers, ad networks, advertising partners and ad measurement providers, for the purpose of bringing more relevant ads and reporting on ad campaign effectiveness.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns).

Use & Processing · Company practice

Multistate professional or employment information: six purposes, starting with analytics

Row J of the multistate chart lists professional or employment information and attaches six purposes: analytics and improvement, including building correlations for Roku’s advertising services, and development; personalisation with relevant content and recommendations; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; and enforcement and legal obligations. The row lists no service-delivery or fraud-prevention purpose.

Supporting quotations

J. Professional or Employment Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Multistate professional or employment information disclosed to service providers, advertisers and measurement providers

The disclosure cells supplied for row J in this section name three recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; and advertising measurement providers. This packet supplies only those three disclosure cells for this row.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Not stated here

• Only three disclosure recipients are supplied for row J here; the card does not say whether further recipients or a sale entry follow.

Sharing & Disclosure · Company practice

Multistate professional information also disclosed to affiliates and authorities, and sold to advertisers

Row J closes its disclosure column with Roku’s affiliates and law enforcement or others involved with legal, security and safety matters, processes and requests, and its sale column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. With the three cells carded earlier, that gives five disclosure recipients and one sale recipient group for professional or employment information.

Supporting quotations

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Use & Processing · Company practice

Multistate education information used for analytics, personalisation, ads, marketing, performance and enforcement

Row K of the multistate chart lists education information and attaches six purposes: analytics and improvement, including building correlations for Roku’s advertising services, and development; personalisation with relevant content and recommendations; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; and enforcement and legal obligations. The row lists no service-delivery or fraud-prevention purpose.

Supporting quotations

K. Education Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• including building correlations for use in Roku’s advertising services in order to better serve our advertisers

Sharing & Disclosure · Company practice

Multistate education information disclosed to providers, advertisers, measurement providers, affiliates and authorities

For row K, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure of education information.

Sharing & Disclosure · Company practice

Multistate education information sold to advertisers, ad networks and ad measurement providers

For row K, the sale column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Security & Safeguards · Company practice

Multistate credentials and government identifiers: only service delivery, enforcement and fraud purposes

Row L of the multistate chart lists Personal Information revealing account log-in, financial account, debit or credit card number with any required security or access code, password or credentials allowing access to an account; social security, driver’s licence, state identification card or passport number; and content of consumer emails, texts and messages where Roku is not the intended recipient. It attaches only three purposes: service delivery and order fulfilment, enforcement of terms and legal obligations, and fraud and illegal-activity prevention.

Supporting quotations

L. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient.

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• in combination with any required security or access code, password, or credentials allowing access to an account
• where we are not the intended recipient

Sharing & Disclosure · Company practice

Multistate credentials and government identifiers disclosed to providers, affiliates, authorities and merchants

For row L, the disclosure column names four recipient groups: service providers and vendors; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and merchants and their partners the reader transacts with on the Roku Services. The chart as supplied has no sale-column entry for this row.

Supporting quotations

Service providers and vendors.

Our affiliates.

Law enforcement or others involved with legal, security and safety matters, processes and requests.

Merchants and their partners you transact with on Roku Services.

Qualifications & exceptions

• Merchants and their partners you transact with on Roku Services.

Not stated here

• The chart does not attach a purpose to each disclosure, and shows no sale entry for these credentials.

Use & Processing · Company practice

Collected data may train Roku’s internal machine-learning models to recommend content and apps

Unless prohibited by applicable law, data collected from the reader or their devices may be used to improve Roku’s internal machine learning models, which are used for purposes such as recommending content and apps. The Notice adds that this may constitute “training” of “large language models” under certain applicable laws. The paragraph does not state a separate opt-out for this use in the supplied text.

Supporting quotations

Unless prohibited by applicable law, data collected from you or your devices may be used to improve Roku's internal machine learning models, which are used for purposes such as recommending content and apps to you.

This may constitute "training" of "large language models" under certain applicable laws.

Qualifications & exceptions

• Unless prohibited by applicable law
• which are used for purposes such as recommending content and apps to you

Not stated here

• The paragraph does not say which laws treat this as model training, and the supplied text states no separate opt-out for it.

Sharing & Disclosure · Company commitment

Roku states it has no actual knowledge that it sells the Personal Information of consumers under 16

For the multistate group, Roku states that it does not have actual knowledge that it sells Personal Information of consumers under 16 years of age. This sentence is narrower than the California statement, which covers both selling and sharing for cross-context behavioural advertising. It is a statement about Roku’s knowledge, not a statement that no such sale occurs.

Supporting quotations

Roku does not have actual knowledge that it sells Personal Information of consumers under 16 years of age.

Qualifications & exceptions

• does not have actual knowledge

Not stated here

• The Notice does not describe the checks Roku uses to establish that knowledge.

Data Access & Collection · Company commitment

Deidentified data from third parties will not be reidentified where the law forbids it

Roku states that if it processes deidentified data provided to it by third parties, it will not attempt to reidentify that data where applicable law prohibits it from doing so. The commitment is conditional on that legal prohibition; the text does not describe other safeguards for deidentified data.

Supporting quotations

If we process deidentified data provided to us by third parties, we will not attempt to reidentify it if we are prohibited by applicable law from doing so.

Qualifications & exceptions

• if we are prohibited by applicable law from doing so

Not stated here

• The Notice does not describe what Roku does with deidentified data where reidentification is not legally prohibited.

Retention & Deletion · Company practice

Multistate retention: as long as needed for business purposes or as regulations require or allow

For the multistate group, the Retention paragraph repeats the California wording: Personal Information may be retained for as long as needed to fulfil legitimate business purposes, including those outlined in Section 2 of the Notice, which is the categories, purposes and disclosures chart; or for a time period specifically required or allowed by applicable regulations or laws. No fixed retention period is stated.

Supporting quotations

Retention

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• for as long as needed to fulfill legitimate business purposes
• or for a time period specifically required or allowed by applicable regulations or laws

Not stated here

• No fixed or maximum retention period is given for any category.

Legal Rights & Agreement Rules · User right or choice

Multistate rights: some states provide rights, depending on residence and subject to exceptions

Section B’s “Your Privacy Rights” heading introduces a statement that some states provide consumers certain rights regarding their Personal Information, and that, depending on where the reader lives and subject to certain exceptions, the listed rights may be exercised. The list that follows covers confirmation and access, correction, deletion, opt out of targeted advertising, opt out of sale, limiting sensitive Personal Information, freedom from discriminatory treatment and appeal.

Supporting quotations

Your Privacy Rights

Some states provide consumers certain rights regarding their Personal Information. Depending on where you live and subject to certain exceptions, you may exercise the following rights:

Qualifications & exceptions

• Depending on where you live and subject to certain exceptions

Not stated here

• The Notice does not list which right applies in which of the sixteen states, or which exceptions apply.

Legal Rights & Agreement Rules · User right or choice

Multistate rights to confirm processing, access specific pieces, correct and delete

The multistate list gives the right to confirm whether Roku is processing the reader’s Personal Information and to access the specific pieces collected in a portable and, to the extent technically feasible, readily usable format; the right to correct inaccurate Personal Information Roku maintains; and the right to request deletion of Personal Information Roku has collected.

Supporting quotations

The right to confirm whether we are processing your Personal Information and to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.

The right to correct inaccurate Personal Information that we maintain about you.

The right to request deletion of the Personal Information that we have collected about you.

Qualifications & exceptions

• to the extent technically feasible

Legal Rights & Agreement Rules · User right or choice

Multistate rights to opt out of processing for targeted advertising and opt out of sale

The multistate list separates two opt-out rights: the right to opt out of the processing of Personal Information for targeted advertising, and the right to opt out of the sale of Personal Information. It does not use the California formulation of opting out of “sharing” for cross-context behavioural advertising.

Supporting quotations

The right to opt out of the processing of your Personal Information for targeted advertising.

The right to opt out of the sale of your Personal Information.

Cross-references

• contrast (model-proposed): Rights to opt out of sale or sharing for cross-context behavioural advertising and to limit sensitive data use — The California list states one opt-out right covering sale and sharing for cross-context behavioural advertising; the multistate list splits the opt-out into sale and processing for targeted advertising. The two formulations describe overlapping but differently named practices.

Legal Rights & Agreement Rules · User right or choice

Multistate rights to limit sensitive Personal Information and to be free from discriminatory treatment

The multistate list gives the right to limit Roku’s collection, use or disclosure of sensitive Personal Information where permitted by law, and the right to be free from discriminatory treatment for exercising privacy rights. The California section instead frames the second right as freedom from retaliation.

Supporting quotations

The right to limit our collection, use or disclosure of your sensitive Personal Information, where permitted by law.

The right to be free from discriminatory treatment for the exercise of your privacy rights.

Qualifications & exceptions

• where permitted by law

Legal Rights & Agreement Rules · User right or choice

Multistate right to appeal any decision on a privacy request

The multistate list gives the right to appeal any decision with regard to the reader’s privacy request, using the same wording as the California list.

Supporting quotations

The right to appeal any decision with regard to your privacy request.

Legal Rights & Agreement Rules · User right or choice

Profiling rights are listed, but Roku says it does not engage in that profiling

The multistate rights list includes the right to opt out of profiling in furtherance of producing legal or significant decisions about the reader, to query the decision, to be informed of the reasons for it and of what actions would secure a different decision, to review and correct inaccurate Personal Information used to make it, and to have it re-evaluated. The same paragraph states: “We do not engage in such profiling.” The rights are therefore stated as available in principle while Roku denies the practice they address.

Supporting quotations

The right to opt-out of profiling in furtherance of producing legal or significant decisions concerning you, query the decision, be informed of reasons for the decision and what actions would secure a different decision, review and correct any inaccurate personal information used to make the decision, and have the decision re-evaluated.

We do not engage in such profiling.

Qualifications & exceptions

• in furtherance of producing legal or significant decisions concerning you

Legal Rights & Agreement Rules · User right or choice

Right to opt out of any voice or facial recognition features

The multistate rights list includes the right to opt out of any voice or facial recognition features. The Notice does not say here whether such features exist on any Roku product or how this opt-out is exercised.

Supporting quotations

The right to opt out of any voice or facial recognition features.

Not stated here

• The Notice does not identify which voice or facial recognition features the right applies to or how the opt-out is submitted.

Legal Rights & Agreement Rules · User right or choice

Right to obtain a list of specific third parties that received Personal Information

The multistate rights list includes the right to obtain a list of specific third parties, other than natural persons, to which Roku has disclosed Personal Information. The right is framed in terms of named third parties rather than the categories used in the disclosure chart.

Supporting quotations

The right to obtain a list of specific third parties, other than natural persons, to which we have disclosed Personal Information.

Qualifications & exceptions

• other than natural persons

Legal Rights & Agreement Rules · Procedure

Multistate access, correction, deletion and appeal requests, with the same identity verification

For the multistate group, access, correction, deletion and appeal requests can be submitted through Roku’s online form or by email to privacy@roku.com. Roku says such requests are subject to its ability to reasonably verify identity where it has the right or obligation to do so under applicable law: account holders are verified by logging into the account, and people without an account are asked to provide data elements Roku may have collected, such as device type, device ID and cookie ID.

Supporting quotations

access, correction, deletion, and appeal request

Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.

If you have a Roku account, we will verify your identity by asking you to log into your account.

If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.

Qualifications & exceptions

• Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.

Legal Rights & Agreement Rules · Procedure

Multistate opt-out of targeted advertising or sale, with Global Privacy Control where the law requires it

For the multistate group, the reader can opt out of processing Personal Information for targeted advertising or of the “sale” of Personal Information through Roku’s Your Privacy Choices page or the Privacy section of the Settings menu on Roku players and Roku TV models. Where required by law, a browser sending the Global Privacy Control signal on any Roku Site is treated as a request to opt out of both the use of Personal Information for targeted advertising and its “sale”. The multistate paragraph states no logged-in or browser-scope limits for the signal, and couples it to a legal requirement, unlike the California paragraph.

Supporting quotations

You can exercise your right to opt out of the processing of your Personal Information for targeted advertising or the “sale” of your Personal Information by visiting Roku’s Your Privacy Choices page or Privacy section of the Settings menu of your Roku players and Roku TV models.

Where required by law, if you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a request to opt out of the use of your Personal Information for targeted advertising and the “sale” of your Personal Information.

Qualifications & exceptions

• Where required by law

Not stated here

• The Notice does not say which of the sixteen states’ laws trigger the Global Privacy Control treatment, or how the signal is associated with a person.

Cross-references

• contrast (model-proposed): Opt-out through Your Privacy Choices page or Roku settings, and Global Privacy Control signals — California treats a Global Privacy Control signal as a “sale” and “sharing” opt-out and states how it applies to a logged-in account versus a browser; the multistate paragraph applies the signal to targeted advertising and sale only “Where required by law” and states no account-scope rule.

Legal Rights & Agreement Rules · Procedure

Multistate authorised agent may submit a request, subject to direct verification

Where permitted by applicable law, the reader may authorise another person as an “Authorized Agent” to submit a request through the methods described. The agent should submit proof of signed permission, and Roku may still require the reader to verify their identity directly and confirm directly that the agent was authorised. Questions go to privacy@roku.com.

Supporting quotations

Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above.

Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request.

We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Qualifications & exceptions

• Where permitted by applicable law
• We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Legal Rights & Agreement Rules · Context

A separate short section covers Iowa and Utah residents

After the sixteen-state section B, the Notice opens a section “C. Iowa and Utah”. The subsection supplies a sensitive-data opt-out for those two states and then repeats the sources statement and the categories, purposes and disclosures chart. This explains why the introduction’s twenty-state list is covered by three sections — California, the sixteen states in B, and Iowa and Utah — rather than by two.

Supporting quotations

C. Iowa and Utah

Legal Rights & Agreement Rules · User right or choice

Iowa and Utah residents can opt out of processing that those states’ law treats as sensitive

Iowa and Utah residents can opt out of Roku’s processing of Personal Information that Iowa and Utah law considers sensitive, by visiting the Your Privacy Choices page or the privacy settings on their Roku device. The paragraph does not list which information those state laws treat as sensitive or describe any other opt-out method.

Supporting quotations

Iowa and Utah Residents: You can opt out of our processing of Personal Information that Iowa and Utah law considers to be sensitive by visiting Your Privacy Choices page or the privacy settings on your Roku device.

Qualifications & exceptions

• that Iowa and Utah law considers to be sensitive

Not stated here

• The paragraph does not identify the information Iowa and Utah treat as sensitive, or say what happens to a request submitted by another route.

Data Access & Collection · Company practice

Iowa and Utah section repeats the same collection sources

The Iowa and Utah section repeats the sources statement used in the earlier sections: Personal Information is collected from the reader when provided and automatically through the Roku Services, and may be obtained from third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts linked to a Roku account, participating merchants and their partners, and other users who referred the reader or provided the reader’s information.

Supporting quotations

Sources of Personal Information We Collect and Process

We collect Personal Information from you when you provide it to us or automatically through the Roku Services.

We may also obtain information about you from other sources, such as third-party platforms, devices and services used to access the Roku Services, Third Party Channels, content providers, data providers, ad networks and advertising partners, advertisers, service providers (including payment service providers), providers of accounts you link to your Roku account, participating merchants and their partners, and other users if they have referred you to the Roku Services or provided your information to us.

Qualifications & exceptions

• if they have referred you to the Roku Services or provided your information to us

Sharing & Disclosure · Context

Iowa and Utah chart: four columns, with targeted advertising and “sold” combined in the last column

The Iowa and Utah section repeats the categories, purposes and disclosures chart with four column headings: “Categories of Personal Information Being Collected and Processed”, “The Purposes for Processing”, “Categories of Third Parties to Whom the Personal Information Is Disclosed”, and “Categories of Third Parties to Whom the Personal Information is Disclosed for Targeted Advertising or "Sold" and the Purpose”. The heading of the last column combines disclosure for targeted advertising with selling, which differs from the multistate chart’s separate disclosure and sale columns.

Supporting quotations

Categories of Personal Information We Collect, Process and Disclose to Third Parties; and the Purposes of Processing

Categories of Personal Information Being Collected and Processed

The Purposes for Processing

Categories of Third Parties to Whom the Personal Information Is Disclosed

Categories of Third Parties to Whom the Personal Information is Disclosed for Targeted Advertising or "Sold" and the Purpose

Data Access & Collection · Company practice

Iowa and Utah identifiers: category plus the first seven purposes supplied

Row A of the Iowa and Utah chart lists identifiers — device identifiers, internet protocol addresses, browser cookies and other unique online identifiers — and begins its purpose column with service delivery and order fulfilment, analytics and improvement including building correlations for advertising, personalisation, targeted advertising and advertising measurement, marketing and marketing measurement, performance measurement, and service communications and customer service. The remaining purposes and the recipient columns for this row are supplied in following packets.

Supporting quotations

A. Identifiers, including, device identifiers, internet protocol addresses, browser cookies, and other unique online identifiers

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

Not stated here

• Only the first seven purposes for this row are supplied here; the card does not state the rest of the row.

Use & Processing · Company practice

Iowa and Utah identifiers: enforcement and fraud purposes complete the nine-purpose list

Row A of the Iowa and Utah chart adds two purposes to the seven carded earlier for identifiers: enforcement of terms, protection of the business, partners or users and compliance with contractual and legal obligations; and protection against, investigation of and deterrence of fraudulent, unauthorised, infringing or illegal activity, including click fraud. With those, the row lists the same nine purposes as the California and multistate charts for identifiers.

Supporting quotations

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah identifiers disclosed to ten recipient groups, from providers to merchants

For row A, the disclosure column names ten recipient groups: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; other users of the Roku Services; and merchants and their partners the reader transacts with on the Roku Services.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Third party platforms and devices you use to access the Roku Services
• Merchants and their partners you transact with on Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure of identifiers.

Sharing & Disclosure · Company practice

Iowa and Utah identifiers disclosed for targeted advertising or sold to three recipient groups

For row A, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign reporting; app providers where the app is installed on the reader’s Roku Device, and content providers the reader purchases or subscribes to content from, for content discovery, tailored experience, provider analytics and reporting, or relevant ads; and third-party platforms and devices used to access the Roku Services, for relevant ads and ad-effectiveness reporting. The heading merges targeted advertising and sale, so the cells do not say which activity applies to which recipient.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• where the app is installed on your Roku Device

Not stated here

• The column heading combines disclosure for targeted advertising with sale, and the cells do not say which recipients receive identifiers for which of the two.

Use & Processing · Company practice

Iowa and Utah account registration information: eight purposes

Row B of the Iowa and Utah chart lists account registration information — name, address, email address, telephone number, and payment method and card number — with eight purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention. As in the other charts, no advertising purpose is listed for this row.

Supporting quotations

B. Account registration Information, i.e., name, address, email address, telephone number, and payment method and card number

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah account registration information disclosed to providers, affiliates, authorities and merchants

For row B, the disclosure column names five recipient groups: service providers and vendors; app and content providers from whom the reader is purchasing or subscribing; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and merchants and their partners the reader transacts with on the Roku Services. The chart shows no combined targeted advertising or sale entry for this row.

Supporting quotations

Service providers and vendors

App and content providers from whom you are purchasing or subscribing

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• App and content providers from whom you are purchasing or subscribing
• Merchants and their partners you transact with on Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure, and shows no targeted advertising or sale entry for this row.

Use & Processing · Company practice

Iowa and Utah protected classifications: federal law only, with seven purposes

Row C of the Iowa and Utah chart lists characteristics of protected classifications under federal law — with no “sensitive data” carve-out, unlike the multistate chart’s row C — and attaches seven purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; and enforcement and legal obligations.

Supporting quotations

C. Characteristics of protected classifications under Federal law

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Qualifications & exceptions

• under Federal law

Sharing & Disclosure · Company practice

Iowa and Utah protected classifications disclosed to providers, advertisers, affiliates and authorities

For row C, the disclosure column names six recipient groups: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure of these characteristics.

Sharing & Disclosure · Company practice

Iowa and Utah protected classifications disclosed for targeted advertising or sold to advertisers

For row C, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. The heading does not say which recipients receive the characteristics for targeted advertising and which buy them.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive these characteristics for targeted advertising and which as a sale.

Use & Processing · Company practice

Iowa and Utah commercial information: the same nine purposes as the other charts

Row D of the Iowa and Utah chart lists commercial information — records of personal property, products or services purchased, obtained or considered, and purchasing or consuming histories or tendencies — with nine purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah commercial information disclosed to seven recipient groups, including merchants

For row D, the disclosure column names seven recipient groups: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and merchants and their partners the reader transacts with on the Roku Services.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Merchants and their partners you transact with on Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure of commercial information.

Sharing & Disclosure · Company practice

Iowa and Utah commercial information disclosed for targeted advertising or sold to advertisers

For row D, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. The heading does not say which recipients receive the information for targeted advertising and which buy it.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive commercial information for targeted advertising and which as a sale.

Use & Processing · Company practice

Iowa and Utah network activity: the same nine purposes, including ads, marketing and fraud prevention

Row E of the Iowa and Utah chart lists internet or other electronic network activity information, including browsing history, search history and interaction with websites, applications or advertisements, and attaches nine purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

E. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah network activity disclosed to nine recipient groups, including other users for community features

For row E, the disclosure column names nine recipient groups: service providers and vendors; app and content providers; advertisers, ad networks and advertising partners; advertising measurement providers; third-party platforms and devices used to access the Roku Services; voice assistant providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and other users of the Roku services when the reader uses certain features, such as posting on Roku Community or uploading product reviews or content.

Supporting quotations

Service providers and vendors

App and content providers

Advertisers, ad networks and advertising partners

Advertising measurement providers

Third party platforms and devices you use to access the Roku Services

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku services when you use certain features of our service (e.g., when you post on Roku Community, upload product reviews or content)

Qualifications & exceptions

• when you use certain features of our service (e.g., when you post on Roku Community, upload product reviews or content)

Not stated here

• The chart does not attach a purpose to each disclosure of network activity information.

Sharing & Disclosure · Company practice

Iowa and Utah network activity disclosed for targeted advertising or sold to advertisers

For row E, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive network activity for targeted advertising and which as a sale.

Sharing & Disclosure · Company practice

Iowa and Utah network activity: app and content providers and platforms complete the combined column

The combined “Disclosed for Targeted Advertising or "Sold"” column for row E also names app providers, where the app is installed on the reader’s Roku Device, and content providers the reader purchases or subscribes to content from, for content discovery, tailored experience, provider analytics and reporting, or relevant ads; and third-party platforms and devices used to access the Roku Services, for relevant ads and ad-effectiveness reporting. With the advertisers carded earlier, that gives three recipient groups in that column for this row.

Supporting quotations

App providers, where the app is installed on your Roku Device, and content providers from whom you purchase or subscribe to content (to help you discover content and provide a more tailored experience on the Roku Services, for analytics and reporting purposes by the providers, or to bring you more relevant ads and report on effectiveness of ad campaigns)

Third party platforms and devices you use to access the Roku Services (to help them bring you more relevant ads and report on the effectiveness of ad campaigns)

Qualifications & exceptions

• where the app is installed on your Roku Device

Not stated here

• The combined heading still does not say which recipients receive network activity for targeted advertising and which as a sale.

Use & Processing · Company practice

Iowa and Utah general geolocation: the full nine purposes

Row F of the Iowa and Utah chart lists general geolocation data — designated market area, country, province, state, city and postal code — with nine purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

F. General geolocation data, such as general location and geographical information, including designated market area, country, province, state, city, and postal code

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah general geolocation disclosed to providers, advertisers, affiliates and authorities

For row F, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure of general geolocation data.

Sharing & Disclosure · Company practice

Iowa and Utah general geolocation disclosed for targeted advertising or sold to advertisers

For row F, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive general geolocation for targeted advertising and which as a sale.

Use & Processing · Company practice

Iowa and Utah precise geolocation: service delivery, personalisation and fraud prevention only

Row G of the Iowa and Utah chart lists precise geolocation with three purposes: service delivery and order fulfilment, personalisation of the experience on the Roku Services, and protection against, investigation of and deterrence of fraud and illegal activity. No analytics, advertising or marketing purpose is listed for this row.

Supporting quotations

G. Precise geolocation

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To personalize your experience on the Roku Services.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah precise geolocation disclosed to providers, affiliates and authorities

For row G, the disclosure column names three recipient groups: service providers and vendors; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests. The chart shows no combined targeted advertising or sale entry for this row.

Supporting quotations

Service providers and vendors

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart shows no targeted advertising or sale entry for precise geolocation and does not explain why.

Use & Processing · Company practice

Iowa and Utah audio and similar information: six purposes, without ads, personalisation or marketing

Row H of the Iowa and Utah chart lists audio, electronic, visual, thermal, olfactory or similar information with six purposes: service delivery and order fulfilment; analytics and improvement, including building correlations for advertising, and development; performance measurement; service communications and customer service; enforcement and legal obligations; and fraud and illegal-activity prevention.

Supporting quotations

H. Audio, electronic, visual, thermal, olfactory, or similar information

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah audio and similar information disclosed to providers, voice assistants, affiliates, authorities and users

For row H, the disclosure column names six recipient groups: service providers and vendors; app and content providers; voice assistant providers; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and other users of the Roku Services. The chart shows no combined targeted advertising or sale entry for this row.

Supporting quotations

Service providers and vendors

App and content providers

Voice assistant providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Other users of the Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure, and shows no targeted advertising or sale entry for this row.

Inference & Profiling · Company practice

Iowa and Utah inferences: category plus the first two purposes supplied

Row I of the Iowa and Utah chart lists inferences drawn from Personal Information — preferences, interests and other information used to personalise the experience — and begins its purpose column with service delivery and order fulfilment and with analytics and improvement, including building correlations for Roku’s advertising services, and development. The remaining purposes and the recipient columns are supplied in following packets.

Supporting quotations

I. Inferences drawn from Personal Information, including your preferences, interests, and other information used to personalize your experience

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

Not stated here

• Only two purposes are supplied for row I here; the card does not state the rest of the row.

Use & Processing · Company practice

Iowa and Utah inferences: seven further purposes complete the full list

Row I of the Iowa and Utah chart adds personalisation, targeted advertising and advertising measurement, marketing and marketing measurement, performance measurement, service communications and customer service, enforcement and legal obligations, and fraud and illegal-activity prevention. With service delivery and analytics carded earlier, the row lists the same nine purposes as the California and multistate charts for inferences.

Supporting quotations

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages; and to respond to your comments and questions and provide customer service.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Sharing & Disclosure · Company practice

Iowa and Utah inferences disclosed to providers, advertisers, measurement services, affiliates and authorities

For row I, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers and services; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers and services

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure of inferences.

Sharing & Disclosure · Company practice

Iowa and Utah inferences disclosed for targeted advertising or sold to advertisers

For row I, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive inferences for targeted advertising and which as a sale.

Use & Processing · Company practice

Iowa and Utah professional or employment information: six purposes

Row J of the Iowa and Utah chart lists professional or employment information with six purposes: analytics and improvement, including building correlations for Roku’s advertising services, and development; personalisation with relevant content and recommendations; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; and enforcement and legal obligations. No service-delivery or fraud-prevention purpose is listed for this row.

Supporting quotations

J. Professional or Employment Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Sharing & Disclosure · Company practice

Iowa and Utah professional or employment information disclosed to providers, advertisers, affiliates and authorities

For row J, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure of professional or employment information.

Sharing & Disclosure · Company practice

Iowa and Utah professional or employment information disclosed for targeted advertising or sold

For row J, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive professional or employment information for targeted advertising and which as a sale.

Use & Processing · Company practice

Iowa and Utah education information: six purposes

Row K of the Iowa and Utah chart lists education information with six purposes: analytics and improvement, including building correlations for Roku’s advertising services, and development; personalisation with relevant content and recommendations; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; and enforcement and legal obligations.

Supporting quotations

K. Education Information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Sharing & Disclosure · Company practice

Iowa and Utah education information disclosed to providers, advertisers, affiliates and authorities

For row K, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests. The packet supplies these five disclosure cells for the row; any next cell is not stated here.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• Only these five disclosure recipients and no combined targeted advertising or sale entry are supplied for row K in this packet.

Sharing & Disclosure · Company practice

Iowa and Utah education information disclosed for targeted advertising or sold to advertisers

Row K’s combined “Disclosed for Targeted Advertising or "Sold"” cell names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. With this cell, row K is complete in the chart.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive education information for targeted advertising and which as a sale.

Use & Processing · Company practice

Iowa and Utah sensitive beliefs and health data: six purposes, without service delivery or fraud prevention

Row L of the Iowa and Utah chart lists Personal Information that reveals racial or ethnic origin, religious beliefs, and health and wellness information, with six purposes: analytics and improvement, including building correlations for Roku’s advertising services, and development; personalisation; targeted advertising and advertising measurement; marketing and marketing measurement; performance measurement; and enforcement and legal obligations. No service-delivery or fraud-prevention purpose is listed for this row.

Supporting quotations

L. Personal Information that reveals racial or ethnic origin, religious beliefs, health, and wellness information

To understand and analyze our user base and how you use the Roku Services, and to improve and enhance the Roku Services (including building correlations for use in Roku’s advertising services in order to better serve our advertisers), and to develop new products, services, features and functionality.

To personalize your experience on the Roku Services, including suggesting and offering you relevant content and recommendations.

To show you ads (including targeted ads) through the Roku Services, on Third-Party Channels, and on third-party websites, mobile apps, platforms and devices.

For marketing purposes, including to send you alerts, notifications, emails and text messages, about products, events, promotions and offers from Roku or its partners, and to measure and understand the effectiveness of our marketing.

To measure performance and analyze key metrics relevant to our business.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

Sharing & Disclosure · Company practice

Iowa and Utah sensitive beliefs and health data disclosed to providers, advertisers, affiliates and authorities

For row L, the disclosure column names five recipient groups: service providers and vendors; advertisers, ad networks and advertising partners; advertising measurement providers; Roku’s affiliates; and law enforcement or others involved with legal, security and safety matters, processes and requests.

Supporting quotations

Service providers and vendors

Advertisers, ad networks and advertising partners

Advertising measurement providers

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Not stated here

• The chart does not attach a purpose to each disclosure, or state any consent step before these disclosures of sensitive information.

Sharing & Disclosure · Company practice

Iowa and Utah sensitive beliefs and health data disclosed for targeted advertising or sold

For row L, the combined “Disclosed for Targeted Advertising or "Sold"” column names advertisers, ad networks, advertising partners and ad measurement providers, for relevant ads and campaign-effectiveness reporting. The chart therefore places these sensitive categories in the same combined column as the other rows.

Supporting quotations

Advertisers, ad networks, advertising partners, and ad measurement providers (to bring you more relevant ads and report on effectiveness of ad campaigns)

Qualifications & exceptions

• Disclosed for Targeted Advertising or "Sold"

Not stated here

• The combined heading leaves open which recipients receive these sensitive categories for targeted advertising and which as a sale.

Security & Safeguards · Company practice

Iowa and Utah credentials and government identifiers used only for service delivery, enforcement and fraud

Row M of the Iowa and Utah chart lists Personal Information revealing account log-in, financial account, debit or credit card number with any required security or access code, password or credentials; social security, driver’s licence, state identification card or passport number; and content of consumer emails, texts and messages where Roku is not the intended recipient. It attaches three purposes: service delivery and order fulfilment, enforcement of terms and legal obligations, and fraud and illegal-activity prevention.

Supporting quotations

M. Personal Information that reveals (a) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, (b) social security, driver’s license, state identification card, or passport number, and (c) content of consumer emails, texts and messages where we are not the intended recipient

To provide and maintain the Roku Services, and to process and fulfill your requests or orders.

To enforce our terms and conditions or protect our business, partners or users, and comply with our contractual and legal obligations.

To protect, investigate, and deter against fraudulent, unauthorized, infringing or illegal activity, including click fraud.

Qualifications & exceptions

• in combination with any required security or access code, password, or credentials allowing access to an account
• where we are not the intended recipient

Sharing & Disclosure · Company practice

Iowa and Utah credentials disclosed to providers, affiliates, authorities and merchants

For row M, the disclosure column names four recipient groups: service providers and vendors; Roku’s affiliates; law enforcement or others involved with legal, security and safety matters, processes and requests; and merchants and their partners the reader transacts with on the Roku Services. The chart shows no combined targeted advertising or sale entry for this row.

Supporting quotations

Service providers and vendors

Our affiliates

Law enforcement or others involved with legal, security and safety matters, processes and requests

Merchants and their partners you transact with on Roku Services

Qualifications & exceptions

• Merchants and their partners you transact with on Roku Services

Not stated here

• The chart does not attach a purpose to each disclosure, and shows no targeted advertising or sale entry for these credentials.

Data Access & Collection · Company commitment

Iowa and Utah statement: no actual knowledge of processing Personal Information of consumers under 13

For the Iowa and Utah section, Roku states that it does not have actual knowledge that it processes the Personal Information of consumers under 13 years of age. The statement addresses age 13 and processing, whereas the multistate statement addresses under-16 consumers and selling or sharing. It is a statement about Roku’s knowledge, not a statement that no such processing occurs.

Supporting quotations

Roku does not have actual knowledge that it processes the Personal Information of consumers under 13 years of age.

Qualifications & exceptions

• does not have actual knowledge

Not stated here

• The Notice does not describe the checks Roku uses to establish that knowledge, or any age-verification step.

Retention & Deletion · Company practice

Iowa and Utah retention: business need or regulatory period, with no fixed term

The Iowa and Utah section repeats the retention statement: Personal Information may be retained as long as needed to fulfil legitimate business purposes, including those outlined in Section 2 of the Notice, which is the categories, purposes and disclosures chart for this section, or for a period specifically required or allowed by applicable regulations or laws. No fixed retention period is given.

Supporting quotations

Retention

Personal Information we collect may be retained for as long as needed to fulfill legitimate business purposes, including the purposes outlined in Section 2, “Categories of Personal Information We Collect, Process, and Disclose to Third Parties; and the Purposes of Processing” of this Supplemental U.S. State Law Privacy Notice, or for a time period specifically required or allowed by applicable regulations or laws.

Qualifications & exceptions

• for as long as needed to fulfill legitimate business purposes
• or for a time period specifically required or allowed by applicable regulations or laws

Not stated here

• No fixed or maximum retention period is given for any category.

Legal Rights & Agreement Rules · User right or choice

A subsection headed for Iowa and Utah opens with rights said to belong to Utah residents

The heading reads “Your Iowa and Utah Privacy Rights”, but the sentence that introduces the list says: “If you are a Utah resident, subject to certain exceptions, you may exercise the following rights”. The supplied text in this packet does not include a separate Iowa rights list; only the earlier Iowa and Utah sensitive-data opt-out is stated specifically for both states. The apparent gap is reported as it stands in the source rather than filled in.

Supporting quotations

Your Iowa and Utah Privacy Rights

If you are a Utah resident, subject to certain exceptions, you may exercise the following rights:

Qualifications & exceptions

• If you are a Utah resident, subject to certain exceptions

Not stated here

• The heading names Iowa and Utah, but this rights list is introduced only for Utah residents; the supplied text does not state which of these rights are offered to Iowa residents, apart from the earlier sensitive-data opt-out.

Legal Rights & Agreement Rules · User right or choice

Utah right to know categories, sources, purposes and third-party categories

The Utah list gives the right to know what Personal Information Roku has collected, including the categories of Personal Information, the categories of sources, the business or commercial purpose for collecting, selling or sharing it, and the categories of third parties to whom Roku discloses it. Compared with the California right to know, this wording does not separately list the categories sold or shared per third party, or the service providers and contractors per disclosed category.

Supporting quotations

The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, and the categories of third parties to whom we disclose Personal Information.

Legal Rights & Agreement Rules · User right or choice

Utah rights to access specific pieces, correct inaccurate information and request deletion

The Utah list gives the right to access the specific pieces of Personal Information collected, in a portable and, to the extent technically feasible, readily usable format; the right to correct inaccurate Personal Information Roku maintains; and the right to request deletion of Personal Information Roku has collected.

Supporting quotations

The right to access the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format.

The right to correct inaccurate Personal Information that we maintain about you.

The right to request deletion of the Personal Information that we have collected about you.

Qualifications & exceptions

• to the extent technically feasible

Legal Rights & Agreement Rules · User right or choice

Utah right to opt out of the sale of Personal Information or processing for targeted advertising

The Utah list gives the right to opt out of the sale of Personal Information, or the processing of Personal Information for targeted advertising. This is the same combined formulation used in the multistate rights list.

Supporting quotations

The right to opt out of the sale of Personal Information, or the processing of Personal Information for targeted advertising.

Legal Rights & Agreement Rules · User right or choice

Utah rights to limit sensitive Personal Information and to be free from discriminatory treatment

The Utah list gives the right to limit Roku’s use or disclosure of sensitive Personal Information where permitted by law, and the right to be free from discriminatory treatment for exercising privacy rights.

Supporting quotations

The right to limit our use or disclosure of your sensitive Personal Information, where permitted by law.

The right to be free from discriminatory treatment for the exercise of your privacy rights.

Qualifications & exceptions

• where permitted by law

Legal Rights & Agreement Rules · User right or choice

Utah right to appeal any decision on a privacy request

The Utah list gives the right to appeal any decision with regard to the reader’s privacy request.

Supporting quotations

The right to appeal any decision with regard to your privacy request

Legal Rights & Agreement Rules · Procedure

Iowa and Utah know, access, correct and delete requests through the online form, with verification

For the Iowa and Utah section, a right to know or access, correct and deletion request can be submitted through Roku’s online form. Such requests are subject to Roku’s ability to reasonably verify identity where it has the right or obligation to do so under applicable law: account holders are verified by logging into the account, and people without an account are asked to provide data elements Roku may have collected, such as device type, device ID and cookie ID.

Supporting quotations

You can submit a right to know/access, correct, and deletion request to through our online form.

Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.

If you don’t have a Roku account, we will attempt to verify your identity by asking you to provide (through the online form or via privacy@roku.com) data elements that we may have collected about you, such as your device type, device ID, and cookie ID.

Qualifications & exceptions

• Such requests are subject to our ability to reasonably verify your identity, where Roku has the right or obligation to do so under applicable law.

Legal Rights & Agreement Rules · Procedure

Iowa and Utah opt-out: Global Privacy Control treated only as a sale opt-out

For the Iowa and Utah section, the reader can opt out of the “sale” of Personal Information or the processing of it for targeted advertising, and limit Roku’s use of sensitive Personal Information where permitted by law, through Roku’s Your Privacy Choices page or the Privacy section of the Settings menu on Roku players and Roku TV models. A browser sending the Global Privacy Control signal on any Roku Site is treated as a “sale” opt-out request only; this paragraph does not extend the signal to targeted advertising, unlike the multistate paragraph, and does not state scope limits for logged-in accounts.

Supporting quotations

You can exercise your right to opt out of the “sale” of your Personal Information, or the processing of your Personal Information for targeted advertising, and limit our use of your sensitive Personal Information, where permitted by law, by visiting Roku’s Your Privacy Choices page or visiting the Privacy section of the Settings menu of your Roku players and Roku TV models.

If you are visiting any Roku Site using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a “sale” opt-out request.

Qualifications & exceptions

• where permitted by law

Not stated here

• The paragraph does not say how the signal is associated with a person, or whether it affects targeted advertising for this section’s states.

Legal Rights & Agreement Rules · Procedure

Iowa and Utah authorised agent may submit a request, subject to direct verification

Where permitted by applicable law, the reader may authorise another person as an “Authorized Agent” to submit a request through the methods described. The agent should submit proof of signed permission, and Roku may still require the reader to verify their identity directly and confirm directly that the agent was authorised. Questions go to privacy@roku.com.

Supporting quotations

Where permitted by applicable law, you may authorize another person (your “Authorized Agent”) to submit a request on your behalf through the methods described above.

Your Authorized Agent should submit proof that you gave the agent signed permission to submit the request.

We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.

Qualifications & exceptions

• Where permitted by applicable law
• We may still require you to directly verify your identity and directly confirm that you have provided the Authorized Agent permission to submit the request.