WHAT THE POLICIES SAY

Roku, Inc. (Nasdaq: ROKU) makes streaming players, the Roku TV operating system, and The Roku Channel, and operates an advertising business built around Automatic Content Recognition (ACR) and cross-context tracking. Roku's own Privacy Policy discloses an opt-in ACR feature that captures detailed viewing data from a household's connected devices, states that disabling ACR does not stop other Roku-side viewing/ad data collection, and self-declares under state privacy law that it has 'shared for cross-context behavioral advertising, and sold' personal-information categories over the prior 12 months. Apple's App Store privacy label independently confirms the Roku app uses Contact Info, Search History, Identifiers and Usage Data to track users across other companies' apps and websites, and uses linked Contact Info for third-party advertising. Roku is a publicly traded, SEC-filing company with a traceable corporate structure; its FY2025 Form 10-K acknowledges 'previously identified cybersecurity incidents' without detailing them or disclosing an FTC/state fine, and no such fine against Roku itself (distinct from Vizio's unrelated 2017 ACR settlement) was found in this research.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

9 ON FILE

[2026-07-01] · COLLECTION

Roku's Privacy Policy states that on Roku TV and other Smart TV Experience devices, users have the option to enable Automatic Content Recognition ('ACR') to collect information about what they watch or access — including programs, video games, ads and channels viewed, plus the date, time and duration — via the TV's antenna, cable box, game console, media player or other connected devices. The policy separately states that if ACR is disabled, Roku still collects viewing and interaction data from The Roku Channel, the Streaming Store, the Home screen, ads, and third-party streaming apps by other methods.

docs.roku.com ↗

OWNERSHIP TRANSPARENCY

SEC EDGAR's company filing index independently confirms Roku, Inc. as CIK 0001428439, incorporated in Delaware, with business address 1173 Coleman Avenue, San Jose, CA — a government-registry identity record independent of the company's own website copy.

sec.gov ↗

[2026-02-13] · OWNERSHIP TRANSPARENCY

Roku, Inc.'s Form 10-K for fiscal year 2025, filed with the SEC on February 13, 2026, discloses consolidated financial statements covering 'Roku and its wholly-owned subsidiaries,' and states elsewhere that its Class A common stock trades on the Nasdaq Global Select Market under the ticker 'ROKU' — a publicly filed, auditable corporate-structure disclosure rather than a marketing-page summary.

sec.gov ↗

SHARING

The same App Store privacy label states that Contact Info (including Email Address and Name), 'which may be collected and linked to your identity,' is used for 'Third-Party Advertising' in addition to first-party advertising/marketing, analytics, and product-personalization purposes.

apps.apple.com ↗

[2026-07-01] · SHARING

Roku's CCPA/state-law disclosure table, within the same Privacy Policy, states that over the past 12 months, Roku has 'collected, processed, disclosed, shared for cross-context behavioral advertising, and sold each of the categories of Personal Information' listed in its accompanying chart — a self-declared 'sale' and 'sharing' of personal information under state privacy law definitions.

docs.roku.com ↗

[2026-08-17] · SHARING

As of 2026-08-17, Roku's own ads.txt file at www.roku.com authorizes 43 advertising system domain(s) to sell its ad inventory (52 DIRECT and 114 RESELLER entries), including telaria.com, tremorhub.com, freewheel.tv, pubmatic.com, google.com, video.unrulymedia.com, appnexus.com, openx.com.

roku.com ↗

[2026-02-13] · TRACK RECORD

The FY2025 10-K's Item 1C (Cybersecurity) section states that Roku's 'business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents' — a self-acknowledged admission that incidents have occurred, alongside disclosure that Roku engages third-party cybersecurity consulting firms and 'manage[s] a bug bounty program.' No named audit firm, incident count or scope, or published bounty terms are disclosed, and no FTC or state regulatory fine against Roku was found in this research.

sec.gov ↗

TRACKING TECH

Apple's App Store privacy label for the official Roku app (self-reported by Roku, Inc. to Apple) discloses that Contact Info, Search History, Identifiers, and Usage Data 'may be used to track you across apps and websites owned by other companies' — Apple's designated category for cross-context tracking, distinct from ordinary first-party analytics.

apps.apple.com ↗

[2026-07-01] · TRACKING TECH

The same Privacy Policy discloses that Roku and its 'business partners, such as analytics and advertising partners,' use cookies, pixel tags, web beacons, SDKs, and device identifiers to recognize users and track their online activities 'over time and across different online services.'

docs.roku.com ↗

LAST REVIEWED 2026-08-27 · METHODOLOGY v1.7