Incident #1B7E8A · 02 NOV 2026major
Roblox EU privacy policy adds AI training on uploaded camera content, researcher data access and longer parent-email retention
Roblox's EU privacy policy now says content you upload through camera or upload features may be kept for AI training and improving products, not just for the feature itself. It adds a section on researcher access to platform data, which in some cases may include Personal Information. It also names more legal orders that can lead to sharing (e.g. European Production Orders), and keeps a parent's email for 7 days instead of 24 hours if account linking isn't completed. It adds some parental-rights and Global Privacy Control wording as well.
Taken from you
- Uploaded camera/photo/video content may now be kept for AI training and product improvement, not just the feature's purpose
- Parent emails are kept 7 days instead of 24 hours if linking is not completed
- Personal Information may be shared with researchers where legally required
- Legal-order sharing now names specific instruments, such as European Production/Preservation Orders and Brazilian Marco Civil orders. Sharing in response to court orders and legal process was already allowed.
- Creators 'may' rather than 'will' access user data; contact importer wording no longer says 'consent'
Won back
- Roblox now explains that facial age estimation analyzes your selfie to estimate your age without identifying who you are.
- Voice-to-text audio is stated to be deleted immediately after use
- The COPPA parental-rights list now also covers withdrawing previously granted consent and receiving direct notice of Roblox's data notices. It also warns that deleting a child's data may require closing their account.
- Global Privacy Control signals are honoured as opt-out requests
- A legal-obligation basis (Article 6(1)(c) GDPR) is now listed for camera features used for age assurance. The consent basis for ID verification was already stated.
Evidence · 4 of 4 quotes matched in source
we will collect, process, and store that content only for as long as needed to accomplish the purpose of the feature, AI training, and improving products.+ inserted · ✓ matched in source
Roblox may process the ID and live selfie you provide through ID Verification for AI training or improving products on the basis of Article 6 sec.+ inserted · ✓ matched in source
Roblox deletes your parent’s email within 7 days if your parent does not complete the linking process.+ inserted · ✓ matched in source
Archived version ↗ · 2,364 words changed