← IoT Privacy Database

Roku Streaming Platform

Roku, Inc. · Smart TV

Staff Reviewed — a person at DeSpy reviewed this rating.

7.5Surveillance
Index
Policy — what its policy permitsF
Evidence — what research provesF

States outright that it has collected, sold and shared viewing history, browsing/search history and voice data for cross-context behavioral advertising over the past 12 months, per its own privacy policy.

Why this rating

Roku's own privacy policy states outright that it has sold and shared viewing history, browsing/search history and voice data for cross-context behavioral advertising, and the platform suffered a 2024 credential-stuffing breach affecting roughly 576,000 accounts.

What it is

Manufacturer
Roku, Inc.
Category
Smart TV
Model years
2008-present
Market status
Current
Companion app
Roku

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S4Roku 2024 Credential-Stuffing Breach — Protecting Your Roku Account
    Breach report · Roku · 2024-04-01

    Roku disclosed a credential-stuffing attack compromising roughly 576,000 accounts in 2024, prompting mandatory password resets and two-factor authentication.

    Why it matters here: Roku's own breach disclosure covers ~576,000 compromised accounts in 2024.

  2. S2Consumer Reports: How to Turn Off Smart TV Snooping Features
    Ngo review · Consumer Reports · 2023-01-01

    Consumer Reports guide documenting which major smart TV brands track viewing via ACR and how to disable it.

    Why it matters here: Consumer Reports guide covers Roku's ACR opt-out settings.

Where your data goes

Third parties this device's data has flowed to, and on what basis. An ended tag means the flow has verifiably stopped — it stays listed for the record.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database