Part one
The formal position
Article I
Lawful basis: legitimate interests
We treat all the data we hold about an identifiable person as personal data within the meaning of of the General Data Protection Regulation, regardless of whether the source was public. The "public" framing in this document refers to where the data came from. It is still covered by GDPR.
Our lawful basis for processing it is : processing necessary for the legitimate interests of a third party, where those interests are not overridden by the rights and freedoms of the data subject. The third-party interest is the safety of children using a platform whose user base is materially populated by minors.
requires three things in sequence: a legitimate interest, the necessity of processing for that interest, and a balancing exercise weighing the interest against the rights and freedoms of the subject. The interest we rely on, child safety on Roblox, is recognised in regulator guidance as the kind of interest the provision was written for. Necessity means we cannot achieve the protective effect through less-intrusive processing; we work with the minimum data needed to flag the specific conduct, drawn from public profile fields and other lawful sources. We run the balancing test on every objection. The EDPB Guidelines 1/2024 on Article 6(1)(f) set out this three-step framework in detail.
Article II
Why we do not ask for consent
consent is one lawful basis among six. It is not required, and for safety processing it is not workable. A platform that asked accounts engaged in CSE conduct whether they consented to being flagged would receive predictable answers, and the resulting system would protect no one. The same logic applies to fraud detection, anti-phishing tooling, and platform anti-abuse work generally.
Consent is also incompatible with the structural posture of this system. We are not a service the flagged account uses; we are a third-party safety annotation about that account, surfaced to other people. was written for exactly this kind of relationship.
Article III
The right to erasure and its carve-outs
of GDPR establishes a right to erasure, and lists the situations in which the right does not apply. covers processing necessary for the establishment, exercise, or defence of legal claims, and we apply it where a flag record is part of an actual or threatened legal proceeding, a platform safety referral, or a law enforcement referral. For ordinary processing outside those situations, we rely on balancing rather than on .
We do not rely on . That subsection covers controllers vested with official authority or processing necessary to comply with a Union or Member State legal obligation, and we are neither a public authority nor under a statutory mandate to flag accounts. The work we do is in the public interest in the ordinary sense of those words, but requires more than that.
Where does not cover a request, we still weigh it under (the right to object), where the test is whether we have compelling legitimate grounds that override the rights and freedoms of the subject. That is a balancing exercise, not a blanket refusal, and we run it on every objection.
Article IV
The right to object
gives data subjects the right to object to processing based on . The controller must then stop, unless it can demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the subject, or the processing is for the establishment, exercise, or defence of legal claims.
Child protection is the kind of compelling ground was written for. We do not treat that as a free pass. Each objection is read on its own facts, including how recent the conduct was, whether the subject has been cleared by Roblox or by us, and whether the flag turns out to be wrong.
Article V
Children as data subjects
Some flagged accounts are operated by minors. of GDPR requires heightened care for children's data, and the EDPB has stated that children's interests can outweigh a controller's legitimate interest where the two are in tension.
Our position is that this raises the bar for retention of child-subject data, but does not move the bar to zero. The balance still leans toward retention where the subject's own conduct produces an active, current risk to other children. Where the conduct is dated, where the account has been cleared, or where a verified parent or guardian asks for erasure, we treat the request as presumptively granted. See "Limits we accept" for the operational version of this.
In the United States, COPPA governs the collection of children's information by online services. We treat the applicability of its specific exceptions to a third-party safety classifier of our shape as counsel-reviewed rather than settled. What we can say is that our processing is bounded to data we have a lawful basis to hold and is not used or disclosed for any unrelated commercial purpose.
Article VI
UK-specific position
Under UK GDPR, our substantive position is the same as for EU GDPR. UK law also provides a statutory exemption that operates independently of and that strengthens our position for UK subjects in specific cases.
provides an exemption from various subject-right provisions of UK GDPR to the extent that applying those rights would be likely to prejudice the prevention, investigation or detection of crime, or the apprehension or prosecution of offenders. Our processing is for the prevention and detection of conduct that endangers children, which the exemption recognises as a basis for limiting subject rights on a per-request basis. The exemption is not a categorical refusal: it is assessed per-request, and we apply it only where applying the right to that specific request would prejudice the work the exemption protects.
We have read ICO guidance, including the Children's Code, and use it as a reference where its provisions speak to what we do.