(Credit: Zain bin Awais/PCMag)
LAS VEGAS—Roblox isn’t just a simple game creation engine anymore. It’s grown into a massive social platform that blends elements of Steam, VR Chat, and Fortnite. With more than 132 million daily active users, around half of whom are minors, ensuring user privacy is a monumental task.
Given that the platform has experienced significant data breaches and has been the subject of controversies over child endangerment and insufficient protections for minors, I was curious to hear how the platform handles privacy now and what steps the company plans to take going forward.
Hao Zhang, engineering manager, and Yiwen Luo, principal privacy software engineer, presented on Roblox security at Black Hat. I hoped the session would introduce policy changes to reduce data retention requirements, but it largely focused on user data as a reon concentrated on operational privacy and scalable data erasure on the platform, Roblox logs, shares, and retains far too much data to be considered privacy-focused
Perhaps the most telling point made is that user deletion requests are easy to make but deceptively hard to execute. A single Roblox user’s request to delete data can result in more than 600 subtasks requiring collaboration across a vast set of teams.
Beyond this surprising fact, here’s a look inside how Roblox’s new “federated central data coordination system” tracks, stores, and attempts to manage the data of 132 million users.
Monitoring the Extent of Roblox’s Data Collection
While Roblox’s new system doesn’t have a snappy name, it represents a change in how the platform manages user data and handles requests to delete it.
First, to see how much data Roblox collects, check its privacy policy. Roblox’s policy isn’t out of the ordinary for an online platform. It collects a vast amount of user data, including:
- Chat, audio, and video logs
- Device identifiers and demographic information
- Email and phone number (optional for account recovery)
- Government ID and/or selfie (required for voice chat and other age-restricted content)
- Payment information
- Sign-up information (date of birth, username, password)
All of this information is retained as long as Roblox deems appropriate, even if you delete your account. While retaining this data is standard practice, competing platforms like Steam make their retention terms clearer by defining data retention periods. Keeping all of this data is a logistical problem that the new platform aims to streamline, although, unfortunately, it does not minimize data collection.
Zhang and Luo’s data suggest that more users are concerned about this data collection than before, with a 3.5x year-over-year increase in privacy-related user data requests.
“Simply keeping track of this data,” stated Zhang, “requires architecture that connects hundreds of systems.” Roblox integrates with many third parties to ensure its massive platform continues to operate, and those third parties also hold user data. The pair claimed that simply knowing “where user data lives” is the hardest part of the battle.
Roblox’s new federated management platform is designed to reduce the number of steps required to delete a user’s data and uses a custom AI detection system called Sentinel, which preemptively detects harmful content and messages.
Additionally, the company’s safety center outlines how it aims to protect children on its platform by filtering games, moderating chats, and ensuring games aren’t published without human and AI review.
Better Security or Mass Surveillance? The Hidden Cost of Roblox’s Safety Tools
This improved system gives users more control over their digital footprint, but it also ramps up moderation measures through more advanced AI tools, age-verification gates, and preventive algorithms designed to stop abuse before it starts. Plus, users will continue to feed Roblox data as long as they use the platform, even if they regularly submit data-deletion requests.
It seems like a no-brainer to support increased verification measures, especially considering Roblox is a platform aimed at children. However, ensuring child safety is a complex task, and it’s not one unique to Roblox. More than half of the states in the US have passed age-verification laws aimed at preventing children from accessing adult content. However, age verification hasn’t proven effective due to easy workarounds such as VPNs. And according to the Electronic Frontier Foundation (EFF), these laws and site requirements lead to discrimination. Forcing verification can create artificial barriers for at-risk individuals who don’t possess identification and can bar those with disabilities from completing biometrics scans due to facial irregularities.
As with those laws, the efficacy of Roblox’s moderation system has repeatedly come into question due to leaked games featuring violence and extremism despite seemingly stringent prevention measures in place. There have also been various cases of lawsuits filed against the company for grooming, even with software like Sentinel in place. Roblox’s latest claims in its Sentinel documentation are dated to mid 2025, but it shows that only 1,200 potential reports have been made for child endangerment, with an undocumented number of verified cases.
Introducing detection algorithms, AI oversight, and age verification measures creates points of failure that can end up harming the proposed cause of protecting children in the event of a data breach.
It’s good to hear that Roblox has improved its systems and can now track 100% of users’ personally identifiable information, but I still find the amount of data the platform collects invasive. Ultimately, I get the impression that Roblox is more concerned with tracking user data than with giving users a more private, protected experience.
