Roblox keeps your personal data for as long as it needs to for its services and legal requirements. You can request deletion of your data, and Roblox states it will respond within 45 days (with a possible 45-day extension).
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy establishes a 45-day response window for deletion requests with an optional 45-day extension, which is relevant to both CCPA/CPRA (which sets a 45-day statutory response deadline) and GDPR (which requires response without undue delay and within one month with a possible two-month extension); the retention language is broadly stated and does not specify retention periods by data category.
Interpretive note: Retention periods are not specified by data category in the policy; the practical duration of retention for specific data types cannot be determined from the document text alone.
Users can request deletion of their personal data by contacting privacy@roblox.com or using the privacy request form; the policy states Roblox will respond within 45 days, potentially extended by another 45 days. The retention policy does not specify how long specific categories of data are kept.
How other platforms handle this
These Additional Terms apply only to the Mistral AI Products available on the Mistral AI Infrastructure and provided to customers located in the European Union that are subject to the EU Data Act (as defined below). These Additional Terms shall take effect on 12 September 2025 (the "Effective Date")...
Managing And Deleting Your Information. You have the right to access, correct, or delete your information in certain circumstances. We store information until it is no longer necessary to provide our Services or until your account is deleted, whichever comes first. You can delete your WhatsApp accou...
Depending on your location, you may have certain rights regarding your personal information, including the right to access, correct, or delete your personal information, the right to data portability, and the right to opt out of certain data processing activities. To exercise these rights, please co...
Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your personal information by submitting a request through our privacy request form or by contacting us at privacy@roblox.com. We will respond to verified deletion requests within 45 days, with an extension of up to an additional 45 days where necessary.— Excerpt from Roblox's Roblox Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages CCPA/CPRA (45-day response with 45-day extension, consistent with statutory requirements), GDPR Article 17 (right to erasure, one-month response with two-month extension), and UK GDPR. The broad retention language ('as long as necessary') without category-specific retention schedules may require evaluation under GDPR's storage limitation principle. (2) GOVERNANCE EXPOSURE: Medium. The absence of specific retention periods by data category is a common gap in privacy policies but may create compliance exposure under GDPR's storage limitation principle, which requires that data be kept no longer than necessary for specified purposes. Regulators in the EU have cited indefinite or broadly stated retention language as a compliance issue. (3) JURISDICTION FLAGS: EU/EEA (GDPR storage limitation), California (CCPA/CPRA right to deletion), UK (UK GDPR), and Brazil (LGPD). The response timeline of 45 days aligns with CCPA but differs from GDPR's one-month standard; compliance teams should confirm that the response process operates within the shorter GDPR timeline for EU users. (4) CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with service providers and sub-processors must include deletion obligations that align with Roblox's commitments to users. When a user deletion request is honored, downstream processors must also be instructed to delete the data, which requires contractual mechanisms to be in place. (5) COMPLIANCE CONSIDERATIONS: Legal teams should implement category-specific data retention schedules and document the legitimate basis for each retention period. The deletion request workflow should be tested to confirm that deletion is propagated to all systems, including backup systems, within the disclosed timeframe. Verification mechanisms for deletion requests should be assessed to ensure they do not impose undue burden on users.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy establishes a 45-day response window for deletion requests with an optional 45-day extension, which is relevant to both CCPA/CPRA (which sets a 45-day statutory response deadline) and GDPR (which requires response without undue delay and within one month with a possible two-month extension); the retention language is broadly stated and does not specify retention periods by data category.
Users can request deletion of their personal data by contacting privacy@roblox.com or using the privacy request form; the policy states Roblox will respond within 45 days, potentially extended by another 45 days. The retention policy does not specify how long specific categories of data are kept.
ConductAtlas has identified this type of provision across 7 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.