Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Users 13 and older who opt in to the Contact Importer feature share the names and phone numbers of all contacts in their mobile address book with Roblox; the policy states this data is automatically and periodically accessed to sync contacts, and retained only for contacts who match existing Roblox users.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Roblox may collect and retain Personal Information belonging to individuals who are not Roblox users and who have not consented to Roblox's data collection, which engages privacy notice obligations under GDPR and may interact with US state privacy laws governing third-party data collection.
Interpretive note: Whether temporary processing of non-matching contact data before deletion satisfies GDPR data minimization and lawful basis obligations for non-Roblox third parties is subject to regulatory interpretation.
The updated policy restricts personalized advertising based on age. Users under 18 will see only nonpersonalized ads on the platform, while users 18 and older may see personalized ads if they provide consent where required. The revised language also removes the previous statement that the platform collects personal information from under-13 accounts for advertising purposes, clarifying that such data is not used for marketing. Users 18 or older can control whether they see personalized ads through Roblox account settings.
View change record →The updated policy adds explicit language disclosing that Roblox collects persistent identifiers (IP addresses and unique device identifiers) from all users, including children, for purposes including account authentication, ad frequency capping, network communications, and security. The policy states Roblox implements technical, contractual, and other measures to ensure these identifiers are not used for purposes outside the listed scope. This represents a clarification and formalization of practices rather than a change to what data is collected, but it does establish contractual limits on how that data may be used. You can review the full updated Privacy Policy to understand which persistent identifiers are collected and the specific operational purposes for which they are retained.
View change record →The updated policy clarifies that parent email addresses constitute the only personal information collected from child accounts under COPPA, rather than listing persistent identifiers. The policy now states that personalized ads are not enabled until age 18, rather than leaving this ambiguous when a child turns 13. These clarifications affect how parents and children understand what data Roblox collects and when advertising becomes personalized; however, the underlying data practices do not appear to have changed operationally. The policy removed detailed descriptions of collection purposes (such as internal operations), which means parents now have less granular explanation of data uses, though stated practices remain.
View change record →Under this clause, activating the Contact Importer feature results in Roblox periodically accessing the user's full mobile address book and collecting names and phone numbers of all contacts; the agreement states retention is limited to contacts matching existing Roblox accounts. Users can decline to activate this feature or deactivate it at any time to prevent this collection.
Cross-platform context
See how other platforms handle Contact Importer: Address Book Data Collection and similar clauses.
Compare across platforms →Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you opt-in to the Contact Importer feature, you will share the first and last names and phone numbers of your contacts in your address book on your mobile phone with Roblox. This feature helps connect with your friends on our Service. If you use the feature, we will automatically access and collect information in your address book from time to time in order to sync your contacts. Such information will only be retained in case of matches with existing Roblox users.Excerpt from Roblox's Privacy and Cookie Policy
(1) REGULATORY LANDSCAPE: Collection of contact data belonging to non-Roblox users who have not consented to data collection engages GDPR Article 6 (lawful basis for processing third-party data) and GDPR Article 14 (transparency obligations to data subjects not directly collected from). The FTC's authority over unfair data collection practices is also relevant. California's CCPA/CPRA may apply to contact data of California residents collected without their direct knowledge. (2) GOVERNANCE EXPOSURE: Medium. The policy asserts that non-matching contact data is not retained, but the periodic automatic access to the full address book before matching occurs constitutes processing of third-party personal data. Whether temporary processing without retention satisfies GDPR minimization and lawful basis requirements for data subjects who are not Roblox users is a compliance question that depends on regulatory interpretation. (3) JURISDICTION FLAGS: EEA users face heightened exposure under GDPR Article 14, which requires informing data subjects whose data is collected indirectly. California residents whose contact information is collected via this feature may have CCPA rights they are unaware of. The policy notes the feature may not be available in certain locations, suggesting Roblox has already identified jurisdictional restrictions. (4) CONTRACT AND VENDOR IMPLICATIONS: If contact data is processed by third-party vendors in connection with the Contact Importer feature, GDPR Article 28 data processing agreements would be required. Procurement teams should confirm no contact data is shared with third parties for purposes beyond the stated matching function. (5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the opt-in mechanism for Contact Importer constitutes valid informed consent under GDPR and applicable US state law, whether GDPR Article 14 notices are provided to non-Roblox contacts whose data is processed, and whether the policy's claim of non-retention for non-matching contacts is operationally verifiable.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that Roblox may collect and retain Personal Information belonging to individuals who are not Roblox users and who have not consented to Roblox's data collection, which engages privacy notice obligations under GDPR and may interact with US state privacy laws governing third-party data collection.
Under this clause, activating the Contact Importer feature results in Roblox periodically accessing the user's full mobile address book and collecting names and phone numbers of all contacts; the agreement states retention is limited to contacts matching existing Roblox accounts. Users can decline to activate this feature or deactivate it at any time to prevent this collection.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.