When you delete your Roblox account, most data is permanently deleted, but IP addresses and device identifiers may be kept for up to two years afterward for safety and security reasons.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause creates a carve-out from full data deletion by permitting extended retention of identifying information beyond account termination, which maintains the entity's ability to track or recognize returning users or devices during the two-year retention window for fraud and abuse prevention.
The updated policy restricts personalized advertising based on age. Users under 18 will see only nonpersonalized ads on the platform, while users 18 and older may see personalized ads if they provide consent where required. The revised language also removes the previous statement that the platform collects personal information from under-13 accounts for advertising purposes, clarifying that such data is not used for marketing. Users 18 or older can control whether they see personalized ads through Roblox account settings.
View change record →The updated policy adds explicit language disclosing that Roblox collects persistent identifiers (IP addresses and unique device identifiers) from all users, including children, for purposes including account authentication, ad frequency capping, network communications, and security. The policy states Roblox implements technical, contractual, and other measures to ensure these identifiers are not used for purposes outside the listed scope. This represents a clarification and formalization of practices rather than a change to what data is collected, but it does establish contractual limits on how that data may be used. You can review the full updated Privacy Policy to understand which persistent identifiers are collected and the specific operational purposes for which they are retained.
View change record →The updated policy clarifies that parent email addresses constitute the only personal information collected from child accounts under COPPA, rather than listing persistent identifiers. The policy now states that personalized ads are not enabled until age 18, rather than leaving this ambiguous when a child turns 13. These clarifications affect how parents and children understand what data Roblox collects and when advertising becomes personalized; however, the underlying data practices do not appear to have changed operationally. The policy removed detailed descriptions of collection purposes (such as internal operations), which means parents now have less granular explanation of data uses, though stated practices remain.
View change record →Deleting your Roblox account does not mean all your data is immediately erased. Device identifiers and IP addresses associated with your account may be retained for up to two years for security purposes, which is relevant for users who believe account deletion results in complete data removal.
How other platforms handle this
When you delete your WhatsApp account, your undelivered messages are deleted from our servers as well as any of your other information we no longer need to operate and provide our Services. Deleting your account will, for example, delete your account info and profile photo, delete you from all Whats...
Please note there are situations where Spotify is unable to delete your data, for example when: it's still necessary to process the data for the purpose we collected it for; we have an overriding interest in continuing to process the data, for example where we need the data to protect our services f...
If you follow the instructions here, your account will be deactivated and your data will be queued for deletion. When deactivated, your X account, including your display name, username, and public profile, will no longer be viewable on X.com, X for iOS, and X for Android. For up to 30 days after dea...
Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you delete your account, Roblox initiates permanent deletion of data in our systems. For safety and security purposes (e.g., bot prevention), Roblox may process persistent identifiers for up to two years after account deletion.— Excerpt from Roblox's Roblox Privacy and Cookie Policy
REGULATORY LANDSCAPE: Under GDPR Article 5(1)(e), personal data must not be kept in a form that permits identification for longer than necessary for the purposes for which it is processed. A two-year post-deletion retention period for persistent identifiers must be grounded in a documented legitimate purpose and proportionality assessment. Under COPPA, retention of persistent identifiers from children must be limited to what is reasonably necessary; a two-year post-deletion retention for safety purposes warrants scrutiny from the FTC regarding proportionality. The FTC and EU data protection authorities are the relevant enforcement bodies. GOVERNANCE EXPOSURE: Medium. The stated purpose (bot prevention and security) is a recognized legitimate interest but the two-year period is relatively long for identifiers that can link to a household or device. The adequacy of this retention period under GDPR's storage limitation principle and COPPA's minimization requirement should be assessed with documented justification. JURISDICTION FLAGS: EU and UK users have the right to erasure under GDPR Article 17, and Roblox would need to demonstrate that the security exception under Article 17(3)(e) or another exemption applies to justify continued retention after a deletion request. California residents under CCPA have a right to deletion subject to exceptions; the security exception may apply but should be specifically documented. CONTRACT AND VENDOR IMPLICATIONS: Service providers holding persistent identifiers of deleted accounts must be contractually required to apply equivalent retention limitations. Vendor contracts should specify maximum retention periods aligned with Roblox's stated policy and provide for audit rights. COMPLIANCE CONSIDERATIONS: Legal teams should document the specific security rationale for the two-year post-deletion retention period and confirm it is proportionate. A data protection impact assessment for post-deletion retention of children's persistent identifiers is advisable. The policy should be reviewed to confirm that users and parents are adequately informed of post-deletion retention at the time of account deletion, not only in the privacy policy.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause creates a carve-out from full data deletion by permitting extended retention of identifying information beyond account termination, which maintains the entity's ability to track or recognize returning users or devices during the two-year retention window for fraud and abuse prevention.
Deleting your Roblox account does not mean all your data is immediately erased. Device identifiers and IP addresses associated with your account may be retained for up to two years for security purposes, which is relevant for users who believe account deletion results in complete data removal.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.