Roblox may ask you to take a selfie or provide a facial image to verify your age. The policy states this image is deleted after the age check is finished.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Facial images are sensitive biometric-adjacent data. The policy's assertion that images are deleted post-process may not resolve all legal obligations depending on the jurisdiction, particularly under laws that treat facial geometry or images used for identification purposes as biometric data requiring explicit consent.
Interpretive note: Whether facial images used for age estimation qualify as biometric data triggering BIPA or GDPR Article 9 obligations depends on the specific technical method used, which the policy does not fully describe.
The updated policy restricts personalized advertising based on age. Users under 18 will see only nonpersonalized ads on the platform, while users 18 and older may see personalized ads if they provide…
The updated policy adds explicit language disclosing that Roblox collects persistent identifiers (IP addresses and unique device identifiers) from all users, including children, for purposes includin…
The updated policy clarifies that parent email addresses constitute the only personal information collected from child accounts under COPPA, rather than listing persistent identifiers. The policy now…
If Roblox requests a facial image from you or your child for age verification, the policy states it will be deleted after use. However, users in Illinois, Texas, or other states with biometric privacy laws should be aware that their rights under those frameworks may apply independently of this policy's deletion commitment.
Cross-platform context
See how other platforms handle Facial Image Collection for Age Assurance and similar clauses.
Compare across platforms →Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"To assess user ages, Roblox may collect information about you, including images such as a selfie, to perform age assurance. Information collected to assess user ages, such as images taken to perform facial age estimation, is deleted once the age assurance process is complete. You can learn more about Roblox's practices in the Roblox Facial Media Capture Policy.— Excerpt from Roblox's Roblox Privacy and Cookie Policy
REGULATORY LANDSCAPE: Facial images collected for age estimation may qualify as biometric data or biometric identifiers under Illinois BIPA, Texas CUBI, and Washington's My Health My Data Act, triggering informed written consent, retention schedule, and destruction requirements that go beyond simple post-process deletion. Under GDPR Article 9, processing biometric data for the purpose of uniquely identifying a natural person requires an explicit legal basis such as explicit consent. The relevant enforcement authorities include the FTC (COPPA, unfair practices), Illinois AG (BIPA), and EU data protection authorities. GOVERNANCE EXPOSURE: High. The collection of facial images from a platform with a significant minor user base creates heightened biometric privacy exposure in multiple US states and under GDPR. The policy's assertion that images are deleted post-process does not itself constitute compliance with state biometric laws that impose specific consent, notice, and prohibition-on-profit requirements. JURISDICTION FLAGS: Illinois (BIPA) creates the highest exposure given its private right of action. Texas (CUBI), Washington, and New York create secondary exposure. Under GDPR, processing biometric data requires a specific Article 9(2) exception and a separate legal basis; reliance on consent for minors under 13 is further constrained. Brazilian LGPD similarly classifies biometric data as sensitive personal data requiring explicit consent. CONTRACT AND VENDOR IMPLICATIONS: Any third-party age estimation vendor processing facial images on Roblox's behalf must be covered by data processing agreements that impose equivalent deletion and security obligations. Procurement teams should assess whether vendor contracts contain explicit BIPA and GDPR Article 28 compliant terms, audit rights, and sub-processor restrictions. COMPLIANCE CONSIDERATIONS: Legal teams should conduct a Data Protection Impact Assessment under GDPR Article 35 for the age assurance process. Consent mechanisms for biometric data collection should be reviewed for adequacy under BIPA (written informed consent), GDPR (explicit consent), and COPPA (verifiable parental consent for under-13 users). The Roblox Facial Media Capture Policy referenced in this provision should be reviewed as a companion document for completeness of disclosure.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Facial images are sensitive biometric-adjacent data. The policy's assertion that images are deleted post-process may not resolve all legal obligations depending on the jurisdiction, particularly under laws that treat facial geometry or images used for identification purposes as biometric data requiring explicit consent.
If Roblox requests a facial image from you or your child for age verification, the policy states it will be deleted after use. However, users in Illinois, Texas, or other states with biometric privacy laws should be aware that their rights under those frameworks may apply independently of this policy's deletion commitment.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.