Global privacy regulations create rules for "controllers" of data, a term that means individuals or organizations that determine why and how data is processed. Privacy rules typically define "personal data" or Personally identifiable information (PII) broadly. It encompasses any information that relates to an identified or identifiable living individual. If a piece of data can be traced back to an individual user, it may be personal data subject to privacy regulations.
A fundamental principle across global frameworks is that controllers should not retain personal data indefinitely. Similarly, users can request the deletion of data that is no longer necessary. If a user requests that Roblox permanently delete their Roblox account, Roblox notifies creators of that so they can delete information that is no longer needed. The primary rule governing deletion is that personal data must be permanently erased once there is no longer a valid legal or business basis for processing it. Roblox has recently introduced tools to enable creators to configure their data stores to automatically delete PII if a user deletes their account.