I have received several right-of-erasure requests, which likely originate from my game Imagination. The latest request, which includes the game ID, confirms it.
This game utilizes only Data Persistence for long-term storage. Data Persistence requires the player to be present in a live game server in order for such data to even be accessible to the developer. Given that the user in question no longer exists, this request is literally impossible for me to fulfill.
Roblox has access to the internals of DP, and all data stored with DP is associated with a user, so I am going to assume that they already delete the data themselves. The only explanation for the request that I can think of is that it is sent Just-In-Case™.
I propose that Roblox implements an additional check to see if a game has any information at all in its Data Stores before sending a request. Imagination was last updated in 2011, while Data Stores were implemented in 2013, so the game couldn’t possibly hold any information about erased users.
Basically, stop sending me messages for things I can do nothing about.
@Anaminus I don’t think a player needs to be present in a game for you to access the player’s data. You should be able to write a script to find the player’s data at anytime as long as his data has been saved to datastore before. Regarding the player does not exist, are you saying his account has been deleted? If so, this is mostly likely the case because our support will fulfill the request from our side by deleting the account, but we currently don’t have a way to know if and how the player data is stored in a game, so you will need to take actions to make sure any of the player’s data is permanently removed in order to be GDPR compliant. Please let me know if you have further questions.
IIRC, Roblox sends an RoE based on if the player has played the game before. They have no way of knowing if the game actually stores data on the player.
Data Persistence refers to the first iteration of persistent storage, distinct from Data Stores, which is the second iteration. Your answer applies to Data Stores, but not to Data Persistence.
The Data Persistence API is implemented as several Load and Save methods on the Player class. Getting a Player instance associated with a particular user requires the user to be in a server playing the game. If the user never joins the game (or does not exist, for that matter), then there is no opportunity for the developer to access or delete the Data Persistence-stored data for that user.
Additionally, because Data Persistence is inherently associated with the user, the data could be deleted internally by Roblox. If this was the case, there would be no action needed by the developer, and therefore no reason to send a RoE request. On the other hand, if there is any amount of data of any kind stored in the game’s Data Store, then Roblox cannot be certain whether it contains information about the user, and therefore must send a RoE request.
My request addresses the case where a game has a user’s information stored in Data Persistence, and there is absolutely no data of any kind whatsoever stored in Data Stores. In this case, we can be certain that (assuming Roblox deletes DP data) the user no longer has any data associated with the game, and therefore no RoE request needs to be sent.