Roblox is a kids/teens-skewing gaming and virtual-world platform operated by the publicly traded Roblox Corporation (NYSE: RBLX). Its Privacy and Cookie Policy (last updated April 30, 2026) describes a COPPA-scoped collection model for under-13 users limited to a username, password, date of birth and persistent device/IP identifiers, but the platform also monitors and stores voice-chat audio, collects geolocation for teens and adults, and, since December 2025/January 2026, requires facial-image-based age estimation to unlock chat platform-wide. Roblox discloses contact and device identifiers to third-party advertising and measurement companies and is actively expanding an 'immersive' advertising business reaching its homepage, seen by over 151 million daily active users. Ownership is transparent — Roblox Corporation is itself the SEC-reporting public parent, with a full subsidiary list on file. Its FY2025 Form 10-K discloses that several state Attorneys General have filed or announced youth-safety and consumer-protection claims, and that federal/state courts are hearing multiple lawsuits alleging Roblox's safety systems have been insufficient to protect minors from predatory behavior and sexual exploitation, plus an ongoing class action over minors gambling Robux via third-party virtual casinos; these are documented allegations, not adjudicated findings, and no confirmed data breach was found in fetched sources.
TRACK RECORD
1 BREACH
[2016-07-31] · BREACH
Have I Been Pwned lists a breach record for Roblox: "Roblox".
Approximately 52,458 accounts affected, per HIBP.
Exposed: Account balances, Email addresses, IP addresses, Purchases, Usernames.
Roblox's own newsroom, in a post by its Chief Safety Officer and VP of User and Discovery Product published January 7, 2026, states that Roblox's facial age-check requirement to chat — first required in select regions in December 2025 — was rolling out globally that week, calling Roblox 'the first large online gaming platform to require facial age checks for users of all ages to access chat' and stating it limits communication between adults and children younger than 16.
Roblox's Privacy and Cookie Policy (last updated April 30, 2026) states that for under-13 users it collects only a required username, password, and date of birth plus optional gender, and separately collects 'persistent identifiers' (IP address and unique device identifiers) for internal operations including serving contextual (not personalized) advertising; the same policy's Age Assurance section states that images such as a selfie collected to perform facial age estimation are deleted once the age-assurance process completes.
Exhibit 21.1 to Roblox Corporation's FY2025 Form 10-K lists all subsidiaries and their jurisdictions of incorporation, including Roblox Advertising Services, LLC (Delaware), Roblox China Holding Corporation (Cayman Islands), Roblox (Shenzhen) Digital Science and Technology, Co., Ltd (China), Roblox UK Limited, and Byfron Technologies LLC (Ohio), among others.
Roblox Corporation's Form 10-K for fiscal year 2025 (filed with the SEC February 11, 2026) states that its Class A common stock is listed on the New York Stock Exchange under the symbol 'RBLX' and began trading on March 10, 2021, confirming Roblox Corporation itself as the SEC-reporting public parent rather than a subsidiary of a larger conglomerate.
Roblox's newsroom, in a January 6, 2026 post by its VP of Product, Ads, and Commerce, announced Roblox is scaling its advertising platform with new 'immersive' ad formats and expanded programmatic and brand partnerships, including a new Homepage Feature ad unit that 'connects brands directly to the next generation on the Roblox homepage, which is the starting point for over 151 million daily active users,' with initial advertisers including e.l.f., Sam's Club, and Universal Pictures.
The Privacy Policy states Roblox 'may disclose information collected from or about you with third-party advertising companies and/or advertising measurement companies to select and display advertisements to you on Roblox, or measure and improve advertising effectiveness,' identifying consent (Article 6(1)(a) GDPR) as the legal basis and specifying that data disclosed for advertising measurement includes contact identifiers and device identifiers.
As of 2026-08-17, Roblox's own ads.txt file at www.roblox.com authorizes 2 advertising system domain(s) to sell its ad inventory (4 DIRECT and 0 RESELLER entries).
Have I Been Pwned's breach catalog lists the "Roblox" incident (roblox.com), breach date 2016-07-31, affecting approximately 52,458 accounts. Data classes exposed per HIBP: Account balances, Email addresses, IP addresses, Purchases, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
Roblox Corporation's FY2025 Form 10-K states that 'various state Attorneys General have filed claims or announced the intent to file claims against us based on various state laws and causes of action primarily relating to youth-related consumer protection and online safety matters,' and separately discloses that federal and state courts are hearing cases alleging Roblox's platform design, moderation systems, and safety safeguards have been insufficient to protect minor users from predatory behavior and sexual exploitation; the same filing describes the ongoing Colvin v. Roblox class action (N.D. Cal., filed August 1, 2023) alleging minors used third-party virtual casinos to gamble Robux, in which the court's March 2024 ruling allowed plaintiffs' negligence and California Unfair Competition Law claims to proceed. All matters described are pending or unresolved allegations rather than adjudicated judgments.
The Roblox iOS App Store listing's Apple-mandated privacy label (self-declared by Roblox Corporation) states that data 'linked to your identity' includes Location (coarse), Contact Info, User Content (including Audio Data and Gameplay Content), Search History, Identifiers (User ID, Device ID), Usage Data (Product Interaction), and Advertising Data, used for the developer's own advertising/marketing, analytics, and product personalization.
The Privacy Policy states that if a user uses Roblox's audio features, Roblox 'will monitor, collect, use, and store audio captured through your device' to enable voice chat, to make voice-related services safer including detecting and combatting abuse, to inform training and product improvement, and in connection with screen recordings that creators and users produce through the service.