Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that account deletion initiates permanent data deletion but permits retention and processing of persistent identifiers such as IP addresses and device identifiers for up to two years after deletion for stated safety and security purposes.
This analysis describes what Roblox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a two-year post-deletion retention period for persistent identifiers, which creates a materially longer data lifecycle than account deletion alone would suggest. Under GDPR, retention beyond what is necessary for the original purpose requires a documented lawful basis and proportionality justification; under CCPA and similar state laws, users' deletion rights may be subject to exceptions for security and fraud prevention purposes.
Removal of the specific post-deletion retention period for persistent identifiers eliminates transparency about long-term data retention after account deletion, replaced with vaguer general retention language.
View full change record →Under this clause, users who delete their Roblox accounts may have persistent identifiers including IP addresses and device identifiers retained for up to two years after deletion for safety and security purposes as stated in the policy. The agreement characterizes this as an exception to the general permanent deletion practice initiated upon account closure.
How other platforms handle this
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
Roblox has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"When you delete your account, Roblox initiates permanent deletion of data in our systems. For safety and security purposes (e.g., bot prevention), Roblox may process persistent identifiers for up to two years after account deletion.Excerpt from Roblox's Privacy Policy
REGULATORY LANDSCAPE: Post-deletion data retention implicates GDPR's storage limitation principle, which requires that personal data not be retained longer than necessary for the specified purpose; US state privacy laws including CCPA contain security and fraud prevention exceptions to deletion rights that may permit this practice. The relevant enforcement authorities are GDPR supervisory authorities for EU and UK users and state Attorneys General for US state law purposes. GOVERNANCE EXPOSURE: Medium. The two-year retention period for persistent identifiers is specific and bounded, and the stated purpose of bot prevention is a recognized security rationale; however, GDPR compliance requires that the proportionality of this retention period be documented and defensible. JURISDICTION FLAGS: EEA and UK users have stronger deletion rights under GDPR Article 17; the security exception to deletion must be narrowly construed and documented. California residents have CCPA deletion rights subject to security exceptions, but the scope of those exceptions has been subject to regulatory scrutiny. CONTRACT AND VENDOR IMPLICATIONS: Service providers with access to retained post-deletion persistent identifiers should be subject to data processing agreements that restrict use to the stated security purposes and include deletion obligations at the end of the two-year period. COMPLIANCE CONSIDERATIONS: Compliance teams should document the legal basis for the two-year post-deletion retention under GDPR, confirm that access to retained identifiers is restricted to security use cases, establish automated deletion workflows triggered at the end of the retention period, and evaluate whether the retention period is the minimum necessary for the stated bot prevention purpose.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes a two-year post-deletion retention period for persistent identifiers, which creates a materially longer data lifecycle than account deletion alone would suggest. Under GDPR, retention beyond what is necessary for the original purpose requires a documented lawful basis and proportionality justification; under CCPA and similar state laws, users' deletion rights may be subject to exceptions for security and …
Under this clause, users who delete their Roblox accounts may have persistent identifiers including IP addresses and device identifiers retained for up to two years after deletion for safety and security purposes as stated in the policy. The agreement characterizes this as an exception to the general permanent deletion practice initiated upon account closure.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Roblox.