Data Sharing with Advertising and Analytics Partners

What it is

Roblox states it shares your personal data with advertising and analytics companies, who may use tracking technologies to follow your activity on Roblox and potentially on other websites.

Why it matters (compliance & governance perspective)

The policy authorizes sharing of identifiers, behavioral data, and device information with third-party advertising partners who may use this data for cross-context behavioral advertising, which constitutes data 'sharing' under CPRA and may trigger opt-out rights for California residents.

Change history

Consumer impact (what this means for users)

According to the policy, personal data including device identifiers, behavioral data, and usage information may be shared with advertising and analytics partners who use tracking technologies across platforms. California residents have the right to opt out of this sharing by using the 'Do Not Sell or Share My Personal Information' mechanism.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages CCPA/CPRA, which defines 'sharing' to include disclosures of personal information to third parties for cross-context behavioral advertising even where no monetary consideration is exchanged. California residents have a statutory right to opt out. The provision also engages GDPR Article 6 for EU/EEA users, requiring a lawful basis (typically consent) for sharing with advertising partners. (2) GOVERNANCE EXPOSURE: High. The disclosure that third-party partners may use tracking technologies across other websites and applications indicates cross-context data collection extending beyond the Roblox platform. This practice may require evaluation under CPRA's expanded definition of sensitive personal information and opt-out rights, and under GDPR consent requirements for cookie-based advertising in the EU. (3) JURISDICTION FLAGS: California (CCPA/CPRA opt-out right), EU/EEA (GDPR consent requirements for advertising cookies), UK (UK GDPR and PECR for cookie-based tracking), Brazil (LGPD), and other jurisdictions with data sharing restrictions. (4) CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements or data sharing agreements with advertising and analytics partners should specify the permitted purposes for data use, restrict onward transfer, and confirm that partners honor opt-out signals. Where partners are acting as independent controllers (rather than processors), this characterization affects the obligations that flow from the agreement. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain an up-to-date list of all advertising and analytics partners receiving personal data, confirm that contractual protections are in place, and ensure that the opt-out mechanism for California residents is technically effective (i.e., that opt-out signals are passed to all downstream partners). Cookie consent mechanisms for EU/EEA users should be audited to confirm that advertising cookies are not set prior to obtaining valid consent.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection of Personal Data from Children Under 13 (COPPA) high
• Behavioral Advertising to Teen Users (Ages 13-17) high
• Do Not Sell or Share My Personal Information (California CPRA Opt-Out) medium
• Data Retention and Deletion Rights medium
• Cookie and Tracking Technology Use medium
• Cross-Border Data Transfers medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.