As a Roblox developer, it is currently too hard to fully comply with the GDPR (EU) laws because of the current format of sending these messages. The problems with the messages include:
If the developer’s messages are flooded, this won’t get addressed. An automated email may be better in this context.
No information about the affected (played) games is given. This requires going through every DataStore game instead of being certain of the games.
There was no public announcement to alert us that we need to prepare for this situation. I didn’t have a pre-existing method to easily handle this until I got the message.
Here’s some code for anyone not prepared for this situation, you should make sure it works for your data system, but it worked for mine, just run in command line in your game on a live server
(save time on govt regulations interfering in your life)
--REMOVING DATA
print"REMOVING DATA:"
local ID = 000 -- Change the player's id
local DataStoreService = game:GetService("DataStoreService")
local PlayerKey = "user_" .. ID
local DataStore = DataStoreService:GetDataStore("data1") --Change to your data store name
local removed = DataStore:RemoveAsync(PlayerKey) --this returns all the default values for your game's data if removed successfully
if removed then
print("Success if this table matches your defaults")
print(removed)
else
print("Fail")
end
Here is a more robust solution, which can be open and run for all games you can write DataStores to:
local DataStoreService = game:GetService("DataStoreService")
local Users = {}
local PlaceDataStores = {
--Roblox Battle (2018 Edition)
[2061194359] = { --Place id
["PlayerSaveData_Live1"] = { --DataStore name
function(UserId) --Returns the key for the user id
return tostring(UserId).."_SaveData"
end,
},
},
}
local function DeleteAsync(DataStore,Key)
local Worked,Return = pcall(function()
return DataStore:GetAsync(Key)
end)
if not Worked then
warn("DataStore GetAsync failed because: "..tostring(Return))
elseif Return == nil then
print("No data found: "..Key)
return
end
local Worked,Return = pcall(function()
DataStore:RemoveAsync(Key)
end)
if not Worked then
warn("DataStore RemoveAsync failed because: "..tostring(Return))
elseif Return == nil then
print("Deleted: "..Key)
end
end
for PlaceId,PlaceData in pairs(PlaceDataStores) do
print("Setting place id: "..PlaceId)
game:SetPlaceId(PlaceId)
for DataStoreName,KeyFunctions in pairs(PlaceData) do
local DataStore = DataStoreService:GetDataStore(DataStoreName)
for _,KeyFunction in pairs(KeyFunctions) do
for _,UserId in pairs(Users) do
DeleteAsync(DataStore,KeyFunction(UserId))
end
end
end
print("")
end
If you want to be allowed to have your game played in the EU (legally), you do.
I’m really surprised we weren’t told about this, presumably it’s very rare. However, an email or some better form of communication might help avoid missing these messages.
Roblox has been putting a lot of responsibility on developers lately, often without announcements or the proper tools to comply. This is another example. Might be a good idea to read the ToU if you haven’t already.
In this case, why not for example add a method to save datastore data specifically for a player or userId, similar to how data persistence used to work? That way Roblox can easily manage and automatically delete data if requested. A more scalable solution than having individual developers going through and removing the data.
It looks like 30 days from when the player requests the deletion. Roblox doesn’t currently provide how long it’s been since the players sent the request. There is no way to tell if they requested 29 days ago and Roblox is just now sending the notification, or they sent it as soon as they got it.
Definitely a lot of good feedback on this thread so far. Keep it coming. I’ve passed this along to the appropriate party.
I am not fully educated on the topic of Data Protection Regulations in the EU, so correct me if I’m wrong, but what prevents an individual in the EU from continuously requesting right of erasure requests for their accounts, alternate accounts, or new accounts? All the individual needs to do is join some front page games, have data stored with their user ID, then send a right of erasure request in to Roblox, and all the developers for those games are then responsible to delete their data.
If there is nothing in place, presumably that they can perform this request repeatedly, it could begin to pose more of a significant issue. It perhaps is now clear that we as developers need to keep this in mind when creating user data saving systems, and to incorporate a manageable way to delete their data from our games.
A formal announcement with more information should’ve been made on this, before sending these direct messages out to developers.
It seems like Roblox may be confident that there will be no legal issues arising if the data wasn’t removed, as there is no urgency expressed in the message that @TheNexusAvenger received.
If it were an urgent matter, then the message would’ve mandated the data deletion instead of saying “Please delete”, given a date to delete it by, and as previously mentioned, be sent to developers in a more formal fashion instead of being sent to their Roblox inbox, which can be frequently flooded and go unnoticed.
Thank you for saving my precious time by writing this.
However, I still have to manually open every single place and place the dataStore name. I wish roblox had a way to just grab every single data store within a specified game to help with things like this.
like maybe a
GetAllDataStores that returns a table of datastore names?
If Roblox is going to be making developers delete records at the request of a player - they need better tools so it’s much easier for developers to delete data.
The question is, what exactly will happen if we fail to delete the data due to a lack of a proficient tool?
@Crazyman32’s Data Store editor doesn’t seem to work for my datastores - if this ever happens to me.
Honestly Roblox ought to add a configuration under the game setting page that allows you to define where a players data is stored so that they can automatically delete it. All we would need is a list where we can add or remove entries, and define a basic string pattern to show where a players data would be saved.
ASCII representation:
[Datastore ] [Key(Optional)]:
__________________________
[-] ["Profiles"] [ID ] -- Clear Key based on userId
[-] [ID.."Data"] [ ] -- Clear whole datastore based on userId
[-] ["Saves" ] ["Save1"..ID] -- Alternate clear key based on userId
[ + Add new location ]
Also, there should be better GDPR notifications from Roblox, put it in the developer’s news tab or somewhere like that, maybe write some documentation on how to deal with such requests and failure to do so.
You should have been notified back in May in regards to dealing with this.
I thought about this before posting earlier, but I didn’t say it because there’s a big problem with possible extensive data loss through this, if you mess up your string formatting or something goes wrong on Roblox’s end, it could end up deleting data that shouldn’t be deleted.
What im wondering is why would they need their data to be removed at all? Most of the time its just things like cash and other game related things. Not every dev stores indepth information about the player that someone would want removed such as time played or other statistics. But looks like ill be adding a secure way for players to clear their data from within the game so I don’t have to do so manually.
