Hello, I’ll keep this short and sweet. Our team has received a GDPR request for the removal of an individual’s data from our game. I’m fully aware of the process needed to remove a user’s data, however our game has gone through multiple stages and multiple different datastores, and suffice to say; I can’t for the life of me remember all the old keys or even names of the datastores we used to use(also used datastore2 at one point). Without these keys/names, I don’t really think I can fully remove all of the user’s data completely. I’m not entirely sure what to do about this.
Having gone through a multitude of datastores might not have been a good call on our part, but we can’t simply ignore these requests right?
Yes by law all data that you have stored of the user must be deleted. However, if the DataStores that you previously used has the players data, and you don’t have access to them, there is physically nothing you can do. And if the data is not accessible by anyone I think you’ll be fine, if you want to be safe, you could contact Roblox and see if they can help you out.
#NotLegalAdvice but this is once again Roblox taking the lazy way out.
GDPR requests are to be handled by Roblox themselves, but they deputize game developers to do their dirty work for them. It’s quite frankly absurd.
Suffice it to say that the legal trouble will fall on Roblox if the data isn’t removed, not you as a developer. That’s one of the trade offs they make by calling your creations “experiences” and not “games” to avoid lowering their unholy 75% tax rate
Roblox themselves would technically be in legal trouble but wouldn’t they just delete your account/groups to make sure the data is deleted if you don’t comply?
AFAIK that wouldn’t actually delete the required data. Games can be owned by groups, not users. So banning a user outright will simply increase their workload, as they’ll likely receive no cooperation from the developers in locating the data.
