Roblox updated its Privacy and Cookie Policy effective April 23, 2026 to add detailed language about how it collects and uses persistent identifiers (IP addresses and device identifiers) from all users, including children, for internal operations such as authentication, ad frequency capping, security, and legal compliance. The policy previously included a summary of changes section describing updates to ad personalization and authority-sharing practices; this summary was removed and replaced with specific disclosures about persistent identifier collection and the role of service providers. The operational change clarifies what data Roblox collects from minors and establishes technical and contractual measures limiting persistent identifier use to the listed internal purposes.
Consumers: The company has committed in writing that device identifiers and IP addresses will be used only for specific purposes like authentication and ad frequency capping, not for other secondary uses.
The updated policy adds explicit language disclosing that Roblox collects persistent identifiers (IP addresses and unique device identifiers) from all users, including children, for purposes including account authentication, ad frequency capping, network communications, and security. The policy states Roblox implements technical, contractual, and other measures to ensure these identifiers are not used for purposes outside the listed scope. This represents a clarification and formalization of practices rather than a change to what data is collected, but it does establish contractual limits on how that data may be used. You can review the full updated Privacy Policy to understand which persistent identifiers are collected and the specific operational purposes for which they are retained.
→ Review the full updated Privacy Policy to understand which persistent identifiers are collected and for which specific operational purposes
ConductAtlas has recorded 2 material changes to this document over 45 days of monitoring (since March 2026). An additional minor or cosmetic changes were excluded.
Across all monitored documents, Roblox has made 4 significant changes.
Added contractual statement that persistent identifiers are collected from all users including children and are limited to enumerated internal operations through technical and contractual measures.
Specified six categories of internal operations for which persistent identifiers may be used: maintaining functioning, network communications, authentication, contextual ad serving with frequency capping, security, and regulatory compliance.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Roblox added approximately 19 sentences detailing its collection and use of persistent identifiers from all users including minors. The new language discloses specific internal operational purposes (authentication, ad frequency capping, security, regulatory compliance) and states …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001396.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.