Roblox Privacy and Cookie Policy

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Introduces automatic age-based feature gating with graduated privacy protections, deferring personalized advertising until age 18 rather than 13, representing stricter child privacy compliance.

Explicitly carves out exception allowing persistent identifier collection for children for core service functionality, clarifying what data collection remains permissible under COPPA compliance.

Adds transparency about government data requests, likely required by regulatory changes or litigation pressure to disclose law enforcement cooperation practices.

Introduces explicit GDPR compliance framework with designated EU representatives and data protection officer contact information, likely responding to increased EU regulatory enforcement.

Removal reflects shift away from broad third-party behavioral targeting disclosure, likely replaced by more restrictive age-tiered advertising policies that prohibit such practices for minors.

Removal of consolidated jurisdiction-specific rights section suggests these provisions were relocated to jurisdiction-specific sections (like the new GDPR section) rather than eliminated.

Removal of detailed tracking technology disclosure aligns with restrictions on such tracking for minors under age-tiered policy, though the current version mistakenly lists a contact provision under this name.

Removal of broad third-party sharing framework, particularly advertising and analytics partner sharing, reflects tightening of data sharing practices for compliance with child privacy regulations.

Removal may indicate this standard provision was moved to a separate policy section or deemed unnecessary as standard practice.

Shifted from general biometric collection framework to specific age assurance use case with explicit deletion guarantee post-assessment and reference to separate facial media policy.

Shifted from parental consent framework to data minimization-first approach with automatic deletion or account protections for excess data collection rather than requiring parental intervention.

Expanded from simple deletion-on-request policy to comprehensive retention governance framework emphasizing purpose limitation, persistent identifier management, and operational safeguards like access controls and employee training.