When you delete your Roblox account, most data is permanently deleted, but IP addresses and device identifiers may be kept for up to two years afterward for safety and security reasons.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Retaining persistent identifiers for up to two years after account deletion, including for accounts belonging to children under 13, extends the data lifecycle beyond what a user might reasonably expect upon requesting account deletion, and requires a lawful basis under applicable privacy frameworks.
The updated policy restricts personalized advertising based on age. Users under 18 will see only nonpersonalized ads on the platform, while users 18 and older may see personalized ads if they provide…
The updated policy adds explicit language disclosing that Roblox collects persistent identifiers (IP addresses and unique device identifiers) from all users, including children, for purposes includin…
The updated policy clarifies that parent email addresses constitute the only personal information collected from child accounts under COPPA, rather than listing persistent identifiers. The policy now…
Deleting your Roblox account does not mean all your data is immediately erased. Device identifiers and IP addresses associated with your account may be retained for up to two years for security purposes, which is relevant for users who believe account deletion results in complete data removal.
How other platforms handle this
Please note there are situations where Spotify is unable to delete your data, for example when: it's still necessary to process the data for the purpose we collected it for; we have an overriding interest in continuing to process the data, for example where we need the data to protect our services f...
Some operating system developers, such as Apple, allow mobile application users to request deletion of accounts created within an application. If you request deletion of your account, State Farm may still retain your information for legal, auditing, regulatory and business purposes. Retention period...
We retain personal data for as long as necessary to provide our products and services, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types in the context of different pr...
Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"When you delete your account, Roblox initiates permanent deletion of data in our systems. For safety and security purposes (e.g., bot prevention), Roblox may process persistent identifiers for up to two years after account deletion.— Excerpt from Roblox's Roblox Privacy and Cookie Policy
REGULATORY LANDSCAPE: Under GDPR Article 5(1)(e), personal data must not be kept in a form that permits identification for longer than necessary for the purposes for which it is processed. A two-year post-deletion retention period for persistent identifiers must be grounded in a documented legitimate purpose and proportionality assessment. Under COPPA, retention of persistent identifiers from children must be limited to what is reasonably necessary; a two-year post-deletion retention for safety purposes warrants scrutiny from the FTC regarding proportionality. The FTC and EU data protection authorities are the relevant enforcement bodies. GOVERNANCE EXPOSURE: Medium. The stated purpose (bot prevention and security) is a recognized legitimate interest but the two-year period is relatively long for identifiers that can link to a household or device. The adequacy of this retention period under GDPR's storage limitation principle and COPPA's minimization requirement should be assessed with documented justification. JURISDICTION FLAGS: EU and UK users have the right to erasure under GDPR Article 17, and Roblox would need to demonstrate that the security exception under Article 17(3)(e) or another exemption applies to justify continued retention after a deletion request. California residents under CCPA have a right to deletion subject to exceptions; the security exception may apply but should be specifically documented. CONTRACT AND VENDOR IMPLICATIONS: Service providers holding persistent identifiers of deleted accounts must be contractually required to apply equivalent retention limitations. Vendor contracts should specify maximum retention periods aligned with Roblox's stated policy and provide for audit rights. COMPLIANCE CONSIDERATIONS: Legal teams should document the specific security rationale for the two-year post-deletion retention period and confirm it is proportionate. A data protection impact assessment for post-deletion retention of children's persistent identifiers is advisable. The policy should be reviewed to confirm that users and parents are adequately informed of post-deletion retention at the time of account deletion, not only in the privacy policy.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Retaining persistent identifiers for up to two years after account deletion, including for accounts belonging to children under 13, extends the data lifecycle beyond what a user might reasonably expect upon requesting account deletion, and requires a lawful basis under applicable privacy frameworks.
Deleting your Roblox account does not mean all your data is immediately erased. Device identifiers and IP addresses associated with your account may be retained for up to two years for security purposes, which is relevant for users who believe account deletion results in complete data removal.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.