Reissued 2026-10-07: this change was first recorded in reverse as CA-X-001396, which was withdrawn; this record describes it in the order it happened. Roblox revised its Privacy and Cookie Policy. It removed its own “Summary of Recent Changes” notice, which had announced an update effective April 30, 2026 (three sentences: that it added language on who can see personalized and non-personalized ads, that it added language on sharing information with authorities, and a link to the full policy). It added an “Internal operations” section: “When children sign up for Roblox, we also collect certain types of personal information called persistent identifiers for internal operations and to provide you and other users with Services.” The operations listed include “Serving contextual advertising, including capping the frequency of ads”, and the section says service providers supporting them “may process persistent identifiers from users under the age of 13”. Contextual advertising to users under 13 was already disclosed elsewhere in the policy. New passages also say that images taken for facial age estimation are “deleted once the age assurance process is complete”, that Roblox deletes a parent's email within 24 hours if parent-account linking is not completed, and that for safety and security purposes Roblox may process persistent identifiers “for up to two years after account deletion”.
Consumers: Roblox now clearly states it collects and uses device identifiers from child users for account maintenance, security, and ad serving.
Consumers: Roblox now discloses that it may collect facial images from users to verify age, and deletes those images once verification is complete.
Parents: If a parent provides an email to link their account but does not complete the process, Roblox will delete that email within 24 hours.
Data controllers: Roblox discloses that third-party service providers help process device identifiers from child users under contractual protections.
Consumers: Roblox may keep device identifiers for up to two years after account deletion for security and fraud prevention.
The updated policy explicitly discloses that Roblox collects persistent identifiers such as IP addresses and unique device identifiers from all users, including children under 13, for internal operations including account maintenance, security, contextual advertising, and frequency capping. The policy states that Roblox implements technical and contractual measures to limit use of these identifiers to the stated purposes, and maintains a retention policy designed to limit data retention to what is reasonably necessary. For users under 13, the policy adds disclosure that Roblox may collect facial images to perform age assurance, with such images deleted once the age assurance process is complete. Parents can provide an email address to establish a parental account, and Roblox will delete the parent's email within 24 hours if the linking process is not completed.
→ Review the updated Facial Media Capture Policy linked in the privacy policy to understand age assurance practices.
→ If you are a parent, understand that providing your email for account linking will result in deletion within 24 hours if the linking process is not completed.
Policy now explicitly discloses collection of IP addresses and device identifiers from all users, including children under 13, for internal operations, account maintenance, security, and contextual advertising.
Policy adds disclosure that Roblox may collect facial images to perform age verification, with images deleted once the process is complete.
Policy states persistent identifiers may be retained for up to two years after account deletion for security and bot prevention purposes.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
This change materially expands the privacy policy's transparency regarding persistent identifier collection and use, particularly for minors. The added language explicitly discloses collection of IP addresses and device identifiers from users under 13 for internal …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-005439.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and lia…
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.