Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that third-party experience creators automatically receive users' usernames, display names, user IDs, game metrics, UGC transaction details, and regional location derived from IP addresses, without any opt-out mechanism described for this sharing.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes automatic data sharing with third-party creators as an inherent condition of using any Roblox experience, creating downstream data controller or processor relationships that may require contractual documentation under GDPR Article 28 and equivalent frameworks in other jurisdictions.
Under this clause, any third-party creator whose experience or content a user interacts with automatically receives the user's username, display name, user ID, game metrics, UGC transaction details, and regionally derived location without a separate opt-in. The policy does not describe an opt-out mechanism for this specific sharing.
Cross-platform context
See how other platforms handle Data Sharing with Experience Creators and similar clauses.
Compare across platforms →Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The creators of the experiences you use or content you interact with will have access to your username, display name, user ID, game metrics, UGC transaction details, and your regional location (which we base on your IP address). We do not share your IP address with the creators. We provide creators with the regional location of players to determine their player base and make sure their experiences meet the legal requirements of the country you live in.Excerpt from Roblox's Privacy Policy
1. REGULATORY LANDSCAPE: Automatic sharing of usernames, user IDs, and regional location with third-party creators implicates GDPR Articles 13 and 14 (transparency obligations), Article 26 (joint controller arrangements) or Article 28 (processor relationships), and CCPA/CPRA provisions on third-party data sharing. For users under 13, this sharing must be consistent with COPPA's restrictions on third-party disclosure. The FTC enforces COPPA; EU data protection authorities enforce GDPR; California's CPPA enforces CCPA/CPRA. 2. GOVERNANCE EXPOSURE: Medium. The nature of the legal relationship between Roblox and experience creators (joint controllers, independent controllers, or processors) is not defined in this policy, creating ambiguity about who bears responsibility for downstream processing of shared data. GDPR compliance requires this relationship to be contractually defined and disclosed to data subjects. 3. JURISDICTION FLAGS: EEA and UK residents have rights to information about all recipients of their personal data under GDPR Articles 13-14. California residents may have rights to know about third-party sharing under CCPA. For users under 13, any sharing with creators must satisfy COPPA's requirements, including that creators are prohibited from using the data beyond the stated purpose. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should assess whether Roblox's creator agreements impose adequate data handling obligations on creators consistent with GDPR Article 28 processor requirements or Article 26 joint controller obligations. The absence of an opt-out mechanism for this sharing may limit users' ability to exercise CCPA or GDPR data minimization rights. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether the disclosure of creator data sharing in this policy meets GDPR transparency requirements, whether creator agreements include appropriate data protection clauses, and whether the COPPA contractual requirements applicable to service providers are extended to creators who receive persistent identifiers or other data about users under 13.
This provision establishes automatic data sharing with third-party creators as an inherent condition of using any Roblox experience, creating downstream data controller or processor relationships that may require contractual documentation under GDPR Article 28 and equivalent frameworks in other jurisdictions.
Under this clause, any third-party creator whose experience or content a user interacts with automatically receives the user's username, display name, user ID, game metrics, UGC transaction details, and regionally derived location without a separate opt-in. The policy does not describe an opt-out mechanism for this specific sharing.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.