Data Report Card · Roblox
Roblox Data Report Card
Gaming platform · Roblox Corporation (San Mateo)
Data
Practices
Practices
2Access1Portability1Friction1Deletion1Sells0Trains AI
=
C
6/12
Agent
Readiness
Readiness
2Access
1Portability
1API access
=
C
4/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
Reviewed Jun 2026 · some cells re-verified Aug 2026 · policies are checked weekly for changes · stated — every cell is read from Roblox's published policy; none has been tested (run by us) yet.
2Accessstated
Self-serve: the in-app Right to Access Report “includes the personal information Roblox has collected and linked to your account, such as account details, login history, and payment history”, with a stated 10-day receipt confirmation and 45-day response window — and published CCPA metrics.
Roblox — Right to Access Reports / US State Addendum · accessed Aug 2026 ↗1Portabilitystated
The Access Report doubles as the export (7-day expiring link; “portable and readily usable format” is the stated right), but no file format is documented and no time-period selection exists — the format-unstated level.
Roblox — Right to Access Reports · accessed Aug 2026 ↗1Frictionstated
In-app tools plus a support form and toll-free phone; identity verification with denial reserved; a “Your Privacy Choices” link and GPC are supported, but opt-outs are per-browser (“your opt-out will apply only to … the specific browser”), Do Not Track is not honored, and responses run to the 45-day statutory window.
Roblox — US State Privacy Policy Addendum · accessed Aug 2026 ↗1Deletionstated
Deletion is self-serve in privacy settings and “initiates permanent deletion”, but no purge timeline is stated, persistent identifiers may be processed “for up to two years after account deletion”, legal/tax carve-outs apply, and sold virtual items persist with other users — the shared-content residual shape.
Roblox Privacy and Cookie Policy — data retention · accessed Aug 2026 ↗1Sells / sharesstated
The addendum admits the CCPA shape plainly: disclosures of contact identifiers, demographics and device identifiers to advertising companies “may constitute a ‘sale’ or ‘sharing’”, with a working opt-out (link + GPC). No sensitive-personal-information sale; under-18s see only nonpersonalized ads.
Roblox — US State Privacy Policy Addendum · accessed Aug 2026 ↗0Trains AIstated
The Terms of Use take a licence to UGC “and any related interaction data … including without limitation in connection with the training of machine learning and related models”, and the policy uses posted content and voice recordings for training “where the law allows” — consent carve-outs exist for EEA/Brazil voice, but a US consumer has no stated general opt-out.
Roblox Terms of Use — UGC licence / AI Features · accessed Aug 2026 ↗1API access — feeds Agent Readiness, not the /12stated
Open Cloud offers a real consumer-grantable OAuth 2.0 flow (“grant permissions to third-party apps to access your or your group’s resources without giving them your credentials”), but scopes cover inventory, assets and profile/social — not chat, history or a personal-data export — so programmatic self-access is partial.
Roblox Open Cloud — OAuth 2.0 overview · accessed Aug 2026 ↗Graded 2026-08-31 against the Roblox Privacy and Cookie Policy (last updated Apr 30, 2026), the US State Privacy Policy Addendum (effective Jun 30, 2026) and Roblox's help-center articles. Consumer surface = roblox.com, the apps, Roblox Player and Studio, operated by Roblox Corporation (San Mateo, CA). The self-serve mechanics are strong — an in-app Right to Access Report, in-app deletion, GPC support and published CCPA metrics (2025 medians: 38 days for access, 32 for deletion). The Terms of Use take a UGC licence “in connection with the training of machine learning and related models” with no general consumer opt-out — the Trains cell scores 0 and trips the red-flag cap. Under-13 accounts get stronger default privacy settings and nonpersonalized ads only, but Roblox characterizes under-13 signup data as “non-personal information, as defined by COPPA” and does not require a parent's email to create a child account. All cells stated, not tested.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Roblox — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Roblox.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
No changes since this grade was first published in Jun 2026.
How to request your data from Roblox
- Go to https://en.help.roblox.com/hc/en-us/articles/40630460625556-Right-to-Access-Reports — Roblox's data-request entry point.
- In-app: privacy settings → Request Account Data (Right to Access Report) and Delete; support form; (888) 858-BLOX.
- Expected wait: stated 10-day receipt confirmation, 45-day response; published 2025 medians 32–38 days — Roblox's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Roblox — Privacy Manager: mailto:privacy@roblox.com.
These steps reflect Roblox's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.