Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Roblox may collect facial images, including selfies, to estimate a user's age, and that such images are deleted after the age assurance process is completed. Additional detail is provided in a separate Roblox Facial Media Capture Policy.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a biometric data collection practice for age estimation purposes, which may require evaluation under state biometric privacy laws including Illinois BIPA, Texas CUBI, and Washington's My Health My Data Act, as well as GDPR's requirements for processing biometric data as a special category under Article 9.
Interpretive note: Whether facial images used for age estimation constitute biometric data subject to BIPA or GDPR Article 9 depends on the specific processing methodology and whether unique biometric identifiers are extracted, which is not fully described in this document.
This new biometric data collection practice represents a significant privacy expansion, as Roblox now explicitly collects and processes facial images, though with stated deletion after verification.
View full change record →This clause establishes that Roblox may collect and process facial images from users for age verification purposes, with the policy stating that images are deleted once the process is complete. The scope of consent requirements and the full data lifecycle for age assurance processing are described in a separate linked policy document.
How other platforms handle this
We may also collect and use personal information with your consent...You can revoke your consent at any time (mostly through our services directly), though note that you might not be able to use any service or feature...
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"To assess user ages, Roblox may collect information about you, including images such as a selfie, to perform age assurance. Information collected to assess user ages, such as images taken to perform facial age estimation, is deleted once the age assurance process is complete. You can learn more about Roblox's practices in the Roblox Facial Media Capture Policy.Excerpt from Roblox's Privacy Policy
1. REGULATORY LANDSCAPE: Facial images used for age estimation constitute biometric data under Illinois BIPA, Texas CUBI, Washington's My Health My Data Act, and potentially GDPR Article 9 as biometric data processed for identification purposes. GDPR Article 9 requires explicit consent or another enumerated basis for processing biometric data. The FTC has enforcement authority over deceptive or unfair practices in biometric data collection. State AGs in Illinois, Texas, and Washington have enforcement authority under applicable biometric statutes. 2. GOVERNANCE EXPOSURE: High. Biometric data collection, even with stated deletion commitments, creates significant statutory exposure under BIPA, which provides a private right of action with statutory damages. The adequacy of the deletion timeline and the scope of processing before deletion are material compliance questions. The reference to a separate Roblox Facial Media Capture Policy creates a governance dependency on a document not fully reproduced here. 3. JURISDICTION FLAGS: Illinois BIPA creates the highest exposure due to its private right of action. Texas CUBI and Washington biometric statutes impose consent and retention requirements. GDPR Article 9 requires explicit consent or a specific exemption for biometric processing in the EEA. The adequacy of Roblox's deletion commitment as a GDPR safeguard depends on whether facial images constitute biometric data for unique identification under the specific processing methodology used. 4. CONTRACT AND VENDOR IMPLICATIONS: If age assurance processing is performed by a third-party vendor, the contract must address biometric data handling, deletion timelines, and liability allocation consistent with applicable biometric statutes. The identity verification vendor referenced elsewhere in the policy (Persona) may be involved, requiring specific DPA provisions covering biometric data. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should review the Roblox Facial Media Capture Policy for full processing details, assess whether written consent mechanisms satisfy BIPA and GDPR Article 9 requirements, verify deletion procedures and timelines through technical audit, and evaluate whether age assurance practices in the EEA satisfy the requirement that biometric processing be strictly necessary for the stated purpose.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a biometric data collection practice for age estimation purposes, which may require evaluation under state biometric privacy laws including Illinois BIPA, Texas CUBI, and Washington's My Health My Data Act, as well as GDPR's requirements for processing biometric data as a special category under Article 9.
This clause establishes that Roblox may collect and process facial images from users for age verification purposes, with the policy stating that images are deleted once the process is complete. The scope of consent requirements and the full data lifecycle for age assurance processing are described in a separate linked policy document.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.