The issue of children’s safety online is an ever-present concern for parents as well as data privacy advocates. As children are allowed access to internet-facing services at a younger and younger age, the tension between child data privacy and tech monetization has been rising. Games like Minecraft and Among Us have led to the rise of online video games marketed toward children over the last decade.
Roblox is one such game, released in 2006 but only gaining widespread popularity in the late 2010s. The game currently has over 90 million daily active users, many of whom (46%) are under the age of 13. These children often have unfettered and unmonitored access to the Roblox platform due to the game’s reputation for child-friendliness. However, a lawsuit filed in April 2025 through a California federal court alleges that the Roblox corporation has illegally collected and profited from children’s data.
The Allegations: Surveillance Under the Surface
The complaint submitted for the suit alleges a wide range of misconduct by Roblox concerning the sensitive data of its underage users. According to the complaint, Roblox is accused of collecting granular behavioral data, including keystrokes, mouse movements, chat logs, search histories, and unique device identifiers. This is a broad range of sensitive personal data that is often protected by regulations and data privacy standards.
Plaintiffs frame this surveillance as akin to illegal wiretapping activity, and allege that Roblox collects this data without obtaining verifiable parental consent. According to the parents behind the suit, the Roblox platform does not inform users of this data collection or obtain permission from the parents of minor players.
Follow the Data: How Roblox Allegedly Profits
Given the alleged unauthorized data collection, it is important to know what the Roblox Corporation does with this information. The suit alleges that Roblox uses the ill-gotten data from child players for profit, as many organizations do with the data they collect, either legitimately or otherwise. There are two primary avenues described in the complaint that are often used by corporations to monetize collected consumer data.
The first is by utilizing behavioral profiling to enhance platform engagement, analyzing personal data, and using it to increase screentime and catch users in addiction loops. The second is by sharing or selling personal data to third-party advertisers, equipping them to market to young users. The allegation of Roblox using these tactics with children’s information raises concerns over targeted marketing to minors and the lack of transparency in advertising and data collection.
Legal Foundation: The Laws in Play
There are a few relevant laws that Roblox is said to have violated by collecting this data: the Electronic Communications Privacy Act of 1986, the Stored Communications Act, and the Children’s Online Privacy Protection Act (COPPA). The latter notably requires site operators to obtain verifiable parental consent in order to collect, use, or disclose data from children under the age of 13. There are also state-level privacy and wiretapping laws, such as California’s Invasion of Privacy Act, that forbid the kind of opaque surveillance and exploitation alleged against Roblox.
The plaintiffs in the case argue that the Roblox Corporation has violated several laws, and they are hoping for a number of outcomes from the suit. They are seeking damages, policy reform to prevent these data privacy violations in the future, and class-action status for the suit to provide the broader Roblox user base with the opportunity to be represented in this suit.
Roblox’s History with Content and Safety Scrutiny
As an extremely popular online game that has been around for almost 20 years, Roblox is no stranger to conflict and criticism. Some previous controversies involving Roblox have been concerned with inappropriate content and moderation lapses, exposing young users to adult content and unsafe interactions with other players. “While Roblox fosters creativity and connection, it’s also a space where bad actors can operate,” says Casey Ellis, founder at Bugcrowd, a San Francisco, California-based leader in crowdsourced cybersecurity. “Teaching kids to recognize red flags—like someone asking for personal details, trying to move conversations off-platform, or trying to encourage them towards 'illegal' activity within the app—is key.”
Some have also taken issue with the game’s monetary system of “Robux” and covert manipulation of the digital currency, raising virtual currency gambling concerns. The Robux currency is purchased with real-world money, and the manipulation of prices in the in-game shop is akin to the stock market, encouraging players to gamble to obtain desired items. There are also third-party sites where users can gamble with Robux, which the Roblox Corporation is accused of knowingly allowing to take place. Roblox's nominal commitment to public safety stands in contrast with this history of criticism and the recent lawsuit’s claims of misconduct and mismanagement.
Implications: Ethics, Trust, and Tech Accountability
It is important to recognize that this lawsuit has not arisen from an isolated policy of violating data privacy, nor is it unique to Roblox. Rather, it is part of a much larger conversation regarding tech organizations and their ethical responsibilities to their users. The broad debate about how to best balance the overwhelming system of surveillance capitalism with children’s right to privacy and protection in digital spaces is a complex issue.
The gamification and monetization of user behavior across all platforms, not just those handling large amounts of information on child users, is of pressing significance in this debate. Corporations are not financially incentivized to handle user data safely and ethically, which is where regulation comes in. It is not simple to get laws passed to restrict this type of activity, but regulatory momentum is building with FTC scrutiny and state Attorney General investigations to hold tech companies accountable for ethical data handling.
What Comes Next
The Roblox Corporation’s legal response to the lawsuit will shape the future trajectory not just for the plaintiffs in this case, but for the general landscape of tech surveillance and privacy issues. The suit could lead to several potential outcomes, including the plaintiffs’ goals of monetary settlement and policy reform going forward. The case may have far-reaching implications for gaming and educational technology platforms with significant user bases of underage individuals.
