How to save player data so deletion requests can find it

What it looks like

A player's data is saved somewhere that isn't tied to their UserId in a fixed pattern: a list of many players in one shared key, a key made from a random id or a guild name, or a value that only mentions the player inside. When the player asks Roblox to delete their account, nothing can find and remove that data.

store:UpdateAsync("Winners", function(list)
	table.insert(list, { UserId = player.UserId, Name = player.Name })
	return list
end)

How to detect it

• –List every data store and ordered data store, the keys and scopes the game uses, and what each value holds.
• –Roblox's right to be forgotten guide says creators must permanently delete personal data covered by a deletion request. Its data store deletion templates find data by a {UserId} token in the data store name, key or scope, matched with a fixed pattern such as User_{UserId}.
• –Data whose key is the UserId, or the UserId with a fixed prefix or suffix, can be matched. Data with the UserId only inside the value can't.
• –Look for shared keys holding many players' details: winner lists, guild member lists, logs of trades or reports, and mailboxes. Roblox's right to be forgotten guide says data that can be traced back to an individual user may be personal data, and usernames or display names stored next to a UserId can be.
• –Data sent outside Roblox, such as to a web server or Discord, can't be reached by templates either. Note it alongside Server details sent to outside addresses or Player text sent to webhooks with no limits.
• –Keys built from names are already Player data saved under the player's name. Mention deletion in that finding rather than reporting both.

What an exploiter could do

This isn't an exploit. A player who has their account deleted still has their name and history stored by the game, and the developer is left to find and remove it by hand from Roblox's daily deletion messages. Data that can't be found isn't deleted, which breaks the privacy obligations Roblox's guide describes.

How to fix it

• –Store each player's data under a key built from their UserId with a fixed pattern, and set up deletion templates for each data store.
• –Keep shared lists to UserIds only, and look names up when showing them, or key each entry as its own UserId key in an ordered data store.
• –For data that must stay shared, use Roblox's right-to-erasure webhook to remove a player's entries when a request arrives.

Vulnerable example

local DataStoreService = game:GetService("DataStoreService")
local Players = game:GetService("Players")

local store = DataStoreService:GetDataStore("Guilds")

local function join(player: Player, guild: string)
	pcall(store.UpdateAsync, store, guild, function(saved: any)
		local members = if typeof(saved) == "table" then saved else {}
		if #members < 50 then
			table.insert(members, { UserId = player.UserId, Name = player.Name, Joined = os.time() })
		end
		return members
	end)
end

Players.PlayerAdded:Connect(function(player)
	join(player, "Founders")
end)

Fixed example

local DataStoreService = game:GetService("DataStoreService")
local Players = game:GetService("Players")

local memberships = DataStoreService:GetDataStore("GuildMembers")

local function join(player: Player, guild: string)
	pcall(memberships.SetAsync, memberships, `Member_{player.UserId}`, { Guild = guild, Joined = os.time() }, { player.UserId })
end

Players.PlayerAdded:Connect(function(player)
	join(player, "Founders")
end)

A deletion template for GuildMembers with the key pattern Member_{UserId} removes the membership when Roblox processes a request.

Common false positives

• –Totals and counters with no player in them, such as a community goal, aren't personal data.
• –Keys that are the UserId with a fixed prefix or suffix, like most profile stores, can be matched by a template. Whether the developer has set the templates up can't be seen from the code, so mention it as advice only.
• –Roblox's guide says personal data must be erased once there's no valid legal or business reason to keep it. Ban and moderation records may have one, so don't report a ban list keyed by UserId.