Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Roblox states it may share Personal Information and the contents of user communications with law enforcement, regulators, judicial authorities, and public agencies (including schools and children's services) pursuant to legal process, regulatory requests, or a belief that disclosure may prevent a crime or protect legal rights; the policy specifically references obligations under the EU Digital Services Act Article 18, the UK Online Safety Act, and the Australian Online Safety Act.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal and discretionary bases under which Roblox may disclose user communications content to third parties including schools and children's services, which is operationally significant for users who may not anticipate disclosure of private communications to non-law-enforcement entities.
The updated policy restricts personalized advertising based on age. Users under 18 will see only nonpersonalized ads on the platform, while users 18 and older may see personalized ads if they provide consent where required. The revised language also removes the previous statement that the platform collects personal information from under-13 accounts for advertising purposes, clarifying that such data is not used for marketing. Users 18 or older can control whether they see personalized ads through Roblox account settings.
View change record →The updated policy adds explicit language disclosing that Roblox collects persistent identifiers (IP addresses and unique device identifiers) from all users, including children, for purposes including account authentication, ad frequency capping, network communications, and security. The policy states Roblox implements technical, contractual, and other measures to ensure these identifiers are not used for purposes outside the listed scope. This represents a clarification and formalization of practices rather than a change to what data is collected, but it does establish contractual limits on how that data may be used. You can review the full updated Privacy Policy to understand which persistent identifiers are collected and the specific operational purposes for which they are retained.
View change record →The updated policy clarifies that parent email addresses constitute the only personal information collected from child accounts under COPPA, rather than listing persistent identifiers. The policy now states that personalized ads are not enabled until age 18, rather than leaving this ambiguous when a child turns 13. These clarifications affect how parents and children understand what data Roblox collects and when advertising becomes personalized; however, the underlying data practices do not appear to have changed operationally. The policy removed detailed descriptions of collection purposes (such as internal operations), which means parents now have less granular explanation of data uses, though stated practices remain.
View change record →Under these terms, Roblox may share the content of user communications with law enforcement, regulators, courts, and public agencies including schools and children's services, both when legally required and when Roblox believes disclosure may prevent a crime. The policy references specific legal obligations under the EU Digital Services Act, UK Online Safety Act, and Australian Online Safety Act as disclosure triggers.
Cross-platform context
See how other platforms handle Law Enforcement Disclosure and Communication Content Sharing and similar clauses.
Compare across platforms →Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may share your Personal Information, as permitted or required by law, if: necessary to comply with a judicial proceeding, court order, or other legal process served on Roblox law enforcement agencies, regulators, or other public agencies (including schools or children's services) request that we share it we believe that disclosing the information may prevent a crime we believe it is necessary to protect our legal rights or the legal rights of others a law requires us to share it We may also share the contents of your communications as permitted or required by law: to law enforcement or judicial authorities to address a threat to life or safety of a person, including (but not limited to) where consistent with Roblox's obligations under the Digital Services Act, Article 18 when required by law in response to governmental regulatory requests, such as Information notices issued under the UK Online Safety Act when required by laws governing online safety, such as the Australian Online Safety ActExcerpt from Roblox's Privacy and Cookie Policy
(1) REGULATORY LANDSCAPE: This provision engages the EU Digital Services Act (DSA) Article 18 obligation to notify authorities of criminal offenses involving threats to life or safety, the UK Online Safety Act's information notice provisions, and the Australian Online Safety Act. In the US, the Electronic Communications Privacy Act (ECPA) governs law enforcement access to stored communications. GDPR Article 6(1)(c) (legal obligation) and Article 6(1)(d) (vital interests) provide the lawful bases for EEA disclosures. (2) GOVERNANCE EXPOSURE: Medium. The discretionary disclosure basis (belief that disclosure may prevent a crime or protect legal rights) is broader than a strictly legal-obligation-based disclosure policy. The inclusion of schools and children's services as potential disclosure recipients is operationally distinct from standard law enforcement disclosure provisions and may affect user expectations regarding confidentiality of communications. (3) JURISDICTION FLAGS: EEA users are protected by GDPR's provisions on lawful basis for processing in law enforcement contexts. UK users are subject to the UK Online Safety Act's information notice regime. Australian users are subject to the Australian Online Safety Act. US users' communications content is subject to ECPA's stored communications provisions. (4) CONTRACT AND VENDOR IMPLICATIONS: The discretionary disclosure provision (belief-based, not legally compelled) may interact with GDPR's requirement that disclosures based on legitimate interests satisfy a balancing test. Compliance teams should assess whether the policy's discretionary disclosure basis is consistent with the lawful basis framework for each relevant jurisdiction. (5) COMPLIANCE CONSIDERATIONS: Legal teams should review whether the policy's reference to DSA Article 18, the UK Online Safety Act, and the Australian Online Safety Act accurately reflects Roblox's legal obligations under each statute, and whether the discretionary disclosure standard is operationally defined to ensure consistent application.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the legal and discretionary bases under which Roblox may disclose user communications content to third parties including schools and children's services, which is operationally significant for users who may not anticipate disclosure of private communications to non-law-enforcement entities.
Under these terms, Roblox may share the content of user communications with law enforcement, regulators, courts, and public agencies including schools and children's services, both when legally required and when Roblox believes disclosure may prevent a crime. The policy references specific legal obligations under the EU Digital Services Act, UK Online Safety Act, and Australian Online Safety Act as disclosure …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.