Users 13 and older who opt in to the Contact Importer feature share the names and phone numbers of all contacts in their mobile address book with Roblox; the policy states this data is automatically and periodically accessed to sync contacts, and retained only for contacts who match existing Roblox users.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Roblox may collect and retain Personal Information belonging to individuals who are not Roblox users and who have not consented to Roblox's data collection, which engages privacy notice obligations under GDPR and may interact with US state privacy laws governing third-party data collection.
Interpretive note: Whether temporary processing of non-matching contact data before deletion satisfies GDPR data minimization and lawful basis obligations for non-Roblox third parties is subject to regulatory interpretation.
The updated policy restricts personalized advertising based on age. Users under 18 will see only nonpersonalized ads on the platform, while users 18 and older may see personalized ads if they provide consent where required. The revised language also removes the previous statement that the platform collects personal information from under-13 accounts for advertising purposes, clarifying that such data is not used for marketing. Users 18 or older can control whether they see personalized ads through Roblox account settings.
View change record →The updated policy clarifies that parent email addresses constitute the only personal information collected from child accounts under COPPA, rather than listing persistent identifiers. The policy now states that personalized ads are not enabled until age 18, rather than leaving this ambiguous when a child turns 13. These clarifications affect how parents and children understand what data Roblox collects and when advertising becomes personalized; however, the underlying data practices do not appear to have changed operationally. The policy removed detailed descriptions of collection purposes (such as internal operations), which means parents now have less granular explanation of data uses, though stated practices remain.
View change record →New provision discloses contact importation functionality that collects phone numbers and contact names, requiring explicit user opt-in but enabling continuous address book synchronization.
View full change record →Under this clause, activating the Contact Importer feature results in Roblox periodically accessing the user's full mobile address book and collecting names and phone numbers of all contacts; the agreement states retention is limited to contacts matching existing Roblox accounts. Users can decline to activate this feature or deactivate it at any time to prevent this collection.
Cross-platform context
See how other platforms handle Contact Importer: Address Book Data Collection and similar clauses.
Compare across platforms →"If you opt-in to the Contact Importer feature, you will share the first and last names and phone numbers of your contacts in your address book on your mobile phone with Roblox. This feature helps connect with your friends on our Service. If you use the feature, we will automatically access and collect information in your address book from time to time in order to sync your contacts. Such information will only be retained in case of matches with existing Roblox users.Excerpt from Roblox's Privacy and Cookie Policy
(1) REGULATORY LANDSCAPE: Collection of contact data belonging to non-Roblox users who have not consented to data collection engages GDPR Article 6 (lawful basis for processing third-party data) and GDPR Article 14 (transparency obligations to …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Roblox may collect and retain Personal Information belonging to individuals who are not Roblox users and who have not consented to Roblox's data collection, which engages privacy notice obligations under GDPR and may interact with US state privacy laws governing third-party data collection.
Under this clause, activating the Contact Importer feature results in Roblox periodically accessing the user's full mobile address book and collecting names and phone numbers of all contacts; the agreement states retention is limited to contacts matching existing Roblox accounts. Users can decline to activate this feature or deactivate it at any time to prevent this collection.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.