Roku

Is Roku safe?

For streaming, yes, with clear limits. Roku sells cheap players and the software inside millions of smart TVs, and the free Roku Remote app turns your phone into the remote. Everything runs through one Roku account, so the account and what Roku does with its data are what we score. We give Roku 54/100, just below Pluto TV (55).

Three things hold it back. Roku is mainly an advertising business, so the account is built to profile you. In 2024 more than half a million accounts were taken over with reused passwords. And the attorneys general of Michigan and Florida are both suing Roku over children's data.

What Roku collects

The App Store label for Roku Remote (Official) lists contact info, search history, identifiers and usage data under "Data Used to Track You". User content joins them in the data linked to your identity. On Android, Google Play lists your email as shared for advertising or marketing.

The app is the small part. Roku's privacy policy, last updated on 1 July 2026, covers the mobile app together with Roku players, Roku TV models and The Roku Channel. When you register, Roku asks for your name, email, postal address, phone number, birth date and gender. It then records your searches, voice commands and what you watch on its own services.

Roku also sells ads on other companies' sites, apps and TVs, and it receives data from those places about what people watch and how they react to ads. The policy says it may share your demographics and audience segments, such as "sports fans" or "cord cutters", with ad measurement firms.

Two features go further, and both are opt-in according to the policy. Automatic Content Recognition on Roku TV models logs what plays from an antenna, cable box or console. Content Viewing Disclosure lets Roku pass the titles you watch to third parties for ads. Check both under Settings, Privacy, Smart TV Experience. A Personalized Ads switch sits in the same Privacy menu and in your account online.

The Roku Channel app

The Roku Channel, Roku's own free streaming service, has no separate iPhone app. On iOS it plays inside Roku Remote, and only in the US and Mexico, according to the App Store listing. On Android it has its own app, with more than 5 million downloads on Google Play. That listing links to the same Roku privacy policy. Its data safety section says device IDs are shared with other companies for analytics and advertising, and that search history, app activity and user IDs are collected. What this page says about Roku's data use applies to it too.

The 2024 account takeovers

In March 2024 Roku told the California attorney general that attackers had broken into individual accounts with usernames and passwords stolen from other services, changed the login details and in some cases bought streaming subscriptions. CBS News reported that this first wave hit more than 15,000 accounts. On 12 April 2024 Roku said a second wave had reached about 576,000 accounts, out of more than 80 million. Fewer than 400 saw unauthorised purchases, and attackers did not get full card numbers.

Roku's response was to switch on two-step login for every account. Each sign-in now needs a 6-digit code sent to your email, according to its help centre. There is one weak spot: if the email does not arrive, the last five characters of any Roku device ID on the account will do instead. We found no public bug bounty for Roku on HackerOne or Bugcrowd. Its security.txt file gives only an email address for vulnerability reports.

Children, Kid & Teen Mode and the lawsuits

The Michigan suit, filed on 29 April 2025, says Roku let children's data flow to Roku and to third-party channels because, unlike rivals, it offered no children's profiles. Roku began a gradual rollout of Kid & Teen Mode in September 2026, according to Cord Cutters News, so not every account has it yet. It hides search, browsing, voice and guest mode, shows only the apps a parent has approved, and blocks purchases through Roku Pay. Leaving it needs the account PIN by default, a sensible design. In-app purchases with other payment methods can still get through.

Roku's own children's privacy notice says identifiers from its Kids & Family section are used only for internal operations, not behavioural advertising. The attorneys general say the problem lies outside those sections. Michigan's complaint brought seven claims. On 31 March 2026 Judge Stephen Murphy dismissed five of them, under the Video Privacy Protection Act and Michigan law, without prejudice. The two claims under the federal children's privacy law (COPPA) were not part of Roku's motion and are now in discovery.

Florida's attorney general filed a separate action in the state's 20th Judicial Circuit in October 2025, under the Florida Digital Bill of Rights and its consumer protection law. It alleges that Roku sold children's viewing habits and voice recordings without parental consent and overstated how well its opt-out tools work. Both cases are allegations, not findings. We score them in the pending-suit band, which is why the regulatory record (60) is low despite no fine.

Scams that use Roku's name

Roku's help centre calls fake activation and tech-support sites "common". People searching "roku activation" or "roku link" can land on paid ads for look-alike sites that charge for activation or sell support plans. Activation and accounts are free. Real Roku pages end in roku.com, such as my.roku.com.

Fox is buying Roku

On 14 June 2026 Roku agreed to be bought by Fox Corporation, which owns Tubi, in a cash and stock deal that values Roku at about $22 billion including debt. Roku's stockholders approved the merger on 14 October 2026, according to an SEC filing. The companies expect it to close in the first half of 2027, once regulators approve. Until then Roku's own privacy policy applies. After closing, watch for a new policy: Tubi's already shares viewing data with other Fox companies for marketing.

How to use Roku safely

1. Use a unique password for Roku and protect the email account that receives its sign-in codes.
2. Turn off Personalized Ads, and check that Automatic Content Recognition and Content Viewing Disclosure are off, under Settings, Privacy.
3. Set a Roku PIN for purchases, and put children in Kid & Teen Mode with only the apps you approve.
4. Never pay to activate a Roku device or call a phone number from a search ad.
5. If you want fewer ads in what you watch, compare free services like Tubi and paid ones like Netflix.

How we scored it

Scams and harmful content (68) is Roku's highest factor, thanks to Kid & Teen Mode and the lack of contact between users. Privacy (38) is the lowest, because the account feeds an advertising business that also gathers data from other companies' apps. Security (56) balances compulsory two-step login against the 2024 takeovers, and the regulatory record (60) reflects two pending attorney general suits.