Roblox (RBLX) 10-K2023 FY Annual report

Registrant’s telephone number, including area code

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

Indicate by check mark whether the Registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports); and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit and post such files). Yes ☒ No ☐

If an emerging growth company, indicate by check mark if the Registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the Registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that has prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of voting Class A common stock held by non-affiliates of the Registrant on June 30, 2023, the last business day of the Registrant’s most recently completed second fiscal quarter (based on a closing price of $40.30 per share on June 30, 2023 as reported on the New York Stock Exchange) was approximately $16.3 billion. Solely for purposes of this disclosure, shares of Class A common stock held by executive officers, directors, and holders of more than 10% of our common stock of the Registrant as of such date have been excluded in that such persons may be deemed to be affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes.

As of February 1, 2024, the Registrant had 581,551,952 shares of Class A common stock and 50,086,273 of Class B common stock, each with a par value of $0.0001 per share, outstanding.

Portions of the Registrants’ definitive proxy statement relating to its 2024 annual meeting of shareholders (the “2024 Proxy Statement”) are incorporated by reference into Part III of this Annual Report on Form 10-K where indicated. The 2024 Proxy Statement will be filed with the U.S. Securities and Exchange Commission within 120 days after the end of the fiscal year to which this report relates.

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K contains forward-looking statements within the meaning of the federal securities laws, which statements involve substantial risks and uncertainties. Forward-looking statements generally relate to future events or our future financial or operating performance. In some cases, you can identify forward-looking statements because they contain words such as “expect,” “anticipate,” “should,” “believe,” “hope,” “target,” “project,” “plan,” “goals,” “estimate,” “potential,” “predict,” “may,” “will,” “might,” “could,” “would,” “intend,” “shall,” “contemplate,” “opportunity,” or “continue” or the negative of these words or other similar terms or expressions that concern our expectations, strategy, plans, or intentions. Forward-looking statements contained in this Annual Report on Form 10-K include, but are not limited to, statements about:

We caution you that the foregoing list may not contain all of the forward-looking statements made in this Annual Report on Form 10-K.

You should not rely upon forward-looking statements as predictions of future events. We have based the forward-looking statements contained in this Annual Report on Form 10-K primarily on our current expectations and projections about future events and trends that we believe may affect our business, financial condition, results of operations and prospects. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties and other factors, including those described in the section titled “Risk Factors” and elsewhere in this Annual Report on Form 10-K. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Annual Report on Form 10-K. We cannot assure you that the results, events and circumstances reflected in the forward-looking statements will be achieved or occur, and actual results, events or circumstances could differ materially from those described in the forward-looking statements.

Neither we nor any other person assumes responsibility for the accuracy and completeness of any of these forward-looking statements. Moreover, the forward-looking statements made in this Annual Report on Form 10-K relate only to events as of the date on which the statements are made. We undertake no obligation to update any forward-looking statements made in this Annual Report on Form 10-K to reflect events or circumstances after the date of this Annual Report on Form 10-K or to reflect new information or the occurrence of unanticipated events, except as required by law. We may not actually achieve the plans, intentions or expectations disclosed in our forward-looking statements and you should not place undue reliance on our forward-looking statements. Our forward-looking statements do not reflect the potential impact of any future acquisitions, mergers, dispositions, joint ventures or investments we may make.

SPECIAL NOTE REGARDING OPERATING METRICS

While these metrics are based on what we believe to be reasonable estimates of our user base for the applicable period of measurement, there are inherent challenges in measuring how our platform is used. These metrics are determined by using internal data gathered on an analytics platform that we developed and operate and have not been validated by an independent third party. This platform tracks user account and session activity. If we fail to maintain an effective analytics platform, our metrics calculations may be inaccurate. These metrics are also determined by certain demographic data provided to us by the user, such as age or gender. If our users provide us with incorrect or incomplete information, then our estimates may be inaccurate.

We believe that these metrics are reasonable estimates of our user base for the applicable period of measurement, and that the methodologies we employ and update from time-to-time to create these metrics are reasonable bases to identify trends in user behavior. Because we update the methodologies we employ to create metrics, our current period metrics may not be comparable to those in prior periods. For example, in the first quarter of 2023, we revised the methodology we use to calculate average monthly unique payers for payers who purchased prepaid cards through one of our specified distributors (the impact to average new and returning monthly unique payers and average bookings per monthly unique payer in periods prior to the first quarter of 2023 was not significant). Finally, the accuracy of our metrics may be affected by certain factors relating to user activity and systems and our ability to identify and detect attempts to replicate legitimate user activity, often referred to as botting. See the section titled “Risk Factors—Our user metrics and other estimates are subject to inherent challenges in measurement, and real or perceived inaccuracies in those metrics may significantly harm and negatively affect our reputation and our business.”

Other companies, including companies in our industry, may calculate DAUs differently.

We track DAUs as an indicator of the size of the audience engaged on our platform. DAUs are also broken out by geographic region to help us understand the global engagement on our platform.

The geographic location data collected is based on the IP address associated with the account when an account is initially registered on Roblox. The IP address may not always accurately reflect a user’s actual location at the time they engaged with our platform. Historically, we have grouped Xbox users into Rest of World DAUs for the purposes of our reporting (we note that since the fourth quarter of 2020, Xbox users have represented less than 2% of our total quarterly DAUs and quarterly hours engaged). Beginning in the fourth quarter of 2023, Xbox users are reported in their respective geographies.

The platform data collected is based on the platform associated with the account when an account is initially registered on Roblox. The demographic data collected is self-reported to us and may not always accurately represent the actual attributes of the user.

Because DAUs measure account activity and an individual user may actively use our platform within a particular day on multiple accounts for which that individual registered, our DAUs are not a measure of unique individuals accessing Roblox. Additionally, if undetected, fraud and unauthorized access to our platform may contribute, from time to time, to an overstatement of DAUs. In many cases, fraudulent accounts are created by bots to inflate user activity for a particular developer’s content on our platform, thus making the developer’s experience or other content appear more popular than it really is. We strive to detect and minimize fraud and unauthorized access to our platform. See the sections titled “Risk Factors—Our user metrics and other estimates are subject to inherent challenges in measurement, and real or perceived inaccuracies in those metrics may significantly harm and negatively affect our reputation and our business,” and “Risk Factors—Some developers, creators, and users on our Platform may make unauthorized, fraudulent, or illegal use of Robux and other digital goods or experiences on our Platform, including through unauthorized third-party websites or “cheating” programs.”

We continuously strive to detect and minimize unauthorized use of our platform, including, but not limited to, botting. As we continue to improve our ability to detect and deter unauthorized use of our Platform, we may see an impact to our overall hours engaged as our efforts to reduce botting become more successful.

We believe bookings provide a timelier indication of trends in our operating results that are not necessarily reflected in our revenue as a result of the fact that we recognize the majority of revenue over the estimated average lifetime of a paying user, which was 28 months as of December 31, 2023. The change in deferred revenue constitutes the vast majority of the reconciling difference from revenue to bookings. By removing these non-cash adjustments, we are able to measure and monitor our business performance based on the timing of actual transactions with our users and the cash that is generated from these transactions. Over the long-term, the factors impacting our revenue and bookings trends are the same. However, in the short-term, there are factors that may cause revenue and bookings trends to differ.

We use this non-GAAP financial information to evaluate our ongoing operations and for internal planning and forecasting purposes. We believe that this non-GAAP financial information may be helpful to investors because it provides consistency and comparability with past financial performance. However, non-GAAP financial measures have limitations in their usefulness to investors because they have no standardized meaning prescribed by GAAP and are not prepared under any comprehensive set of accounting rules or principles. In addition, other companies, including companies in our industry, may calculate similarly titled non-GAAP financial measures differently or may use other measures to evaluate their performance, all of which could reduce the usefulness of our non-GAAP financial information as a tool for comparison. As a result, our non-GAAP financial information is presented for supplemental informational purposes only and should not be considered in isolation from, or as a substitute for financial information presented in accordance with GAAP.

Bookings are also broken out by geographic region based on the billing country of our payers, to help us understand the global engagement and monetization on our platform. The billing address may not always accurately reflect a payer’s actual location at the time of their purchase.

We define returning monthly unique payers as user accounts that have made a purchase on the platform, or via redemption of prepaid cards, in the current month and in any prior month. Average returning monthly unique payers for a specified period is the average of the returning monthly unique payers for each month during that period. Because we do not always have the data necessary to link an individual who has paid under multiple user accounts, an individual may be counted as multiple returning monthly unique payers.

We define monthly repurchase rate as the returning monthly unique payers in the current month, divided by the sum of the prior month’s new monthly unique payers and returning monthly unique payers. Average monthly repurchase rate for a specified period is the average of the monthly repurchase rates for each month during that period.

Part I

Our Platform consists of the Roblox Client, the Roblox Studio, and the Roblox Cloud. Roblox Client is the application that allows users to seamlessly explore 3D immersive experiences. Roblox Studio is the free toolset that allows developers and creators to build, publish, and operate 3D immersive experiences and other content accessed with the Roblox Client. Roblox Cloud includes the services and infrastructure that power our Platform.

Our mission is to connect a billion users with optimism and civility. We are constantly improving the ways in which our Platform supports shared experiences, ranging from how these experiences are built by an engaged community of developers and creators to how they are enjoyed and safely accessed by users across the globe.

Growth at Roblox has been driven primarily by a significant investment in technology and two mutually reinforcing network effects: content and social.

First, user-generated content, built by our community of developers and creators, powers our Platform. As developers and creators build increasingly high-quality content, more users are attracted to our Platform. With more users on our Platform, greater engagement and monetization opportunities exist, which in turn, makes Roblox more attractive to developers and creators, incentivizing them to design increasingly engaging content and encouraging new developers and creators to start building on our Platform.

Second, our Platform is social. When users join, they typically interact with friends, which inspires them to invite more friends, who in turn, invite their friends, driving organic growth. The more friends that each of our users have interacting on the Platform, the more valuable and engaging the Platform becomes. This drives more users to our Platform through word of mouth from their existing friends on the Platform.

We measure the health and success of our developer and creator community based on their earnings and the user engagement in their experiences. As our Platform has scaled, our monetizing developers and creators have enjoyed meaningful earnings expansion over time, reflecting the increasing popularity and opportunities for monetization of our Platform and driving a growing incentive for our developers and creators to continue to build high-quality content.

Developers and creators are able to earn Robux through the following methods:

Rewards and Experiences Breakdown

We invest in our developers and creators by providing a comprehensive set of free tools and services through Roblox Studio, the Roblox Open Cloud, and a range of other creator resources that enable them to easily build, publish, analyze, grow, and monetize experiences. We empower developers and creators to get started with minimal upfront costs as we cover hosting, storage, customer support, localization, regulatory requirements, payment processing, and platform fees. We provide appropriate support for all developers and creators to ensure engagement and growth in our developer and creator community. This includes managing and moderating our online developer and creator forums and operating special programs for aspiring and top developers and creators such as our annual Roblox Developers Conference. With Roblox Open Cloud, developers and creators can leverage a suite of backend APIs to seamlessly build and scale their experiences.

The investment in our developer and creator community has resulted in an ever-changing offering of diverse content for our users to explore and engage in. The chart below shows the percentage of in-experience engagement within the top 1,000 experiences by month from January 1, 2023 to December 31, 2023.

The Roblox Client features the Avatar Editor, which enables users to manipulate the size and body shape of their avatars as well as equip their avatar with clothing, gear, animations, simulated gestures, or emotes, and other accessories from the Marketplace. Our avatar system allows users to attach practically any accessory to any avatar maximizing the combinatorial variety of avatar configurations supported by the Platform. Users manipulate their avatar through a consistent set of controls for emotes, basic movement, and tap-to-move functionality which adapts to dynamically changing virtual environments. The Roblox Client normalizes camera and avatar control inputs from different device form factors, including mobile, tablet, desktop, and game console, to simplify the process of building multiuser, multiplatform, and avatar-based experiences.

Within most experiences, avatars appear exactly how they were configured in the Avatar Editor, creating a sense of persistent identity. However, developers, when designing experiences, have the freedom to dynamically reconfigure all or part of the participating avatars to meet the specific needs of the developer’s experience.

The social graph is central to human communication and connection. When a user chooses to join an experience, the Roblox Cloud is designed to automatically place that user into the same virtual environment as others connected through the social graph. In addition, most developers allow users to purchase private servers that allow groups of friends to share an exclusive, invite-only instance of a 3D immersive experience.

Further, users can now connect through Roblox Connect, a way to communicate with another user within a 3D immersive experience. Either through the standalone Roblox Connect experience or within certain experiences that have embedded the capability behind Roblox Connect, people can call friends and have conversations as avatars together in a shared immersive space using voice and facial expressions.

Developers use Roblox Studio to easily build 3D immersive experiences that are then rendered and simulated on the Roblox Platform. The Roblox Client leverages efficient low-level hardware-specific device APIs, such as Vulkan for Android devices and Metal for Apple devices, to efficiently render those experiences. Each experience combines thousands of meshes, textures, 3D models, and animations. Using Roblox Studio, developers can also insert immersive ad units into their environments, which are native and 3D structures, and include images and immersive portals.

Each 3D immersive experience is simulated in the Roblox Cloud with a custom physics engine built for rigid body and constraint-based physics. Using a combination of novel mathematical formulations and aggressive optimization, the engine can simulate a large number of complex mechanisms at high levels of fidelity. To achieve an optimal balance between latency, scale, and consistency, computations for the simulation are distributed across Roblox Clients and the Roblox Cloud.

Assets that make up the 3D immersive experience are stored in a persistent tree hierarchy that is the foundation for collaborative editing and interactive multiuser experiences. The hierarchy can be modified through APIs which serve as a powerful abstraction layer making it easy to create experiences that are consistent across all Roblox Clients, regardless of device type. During simulation, this data is dynamically replicated within the Roblox Cloud and selectively transmitted to Roblox Clients. The Roblox Client then constructs and renders its own view of the 3D immersive experience.

The Roblox Client is designed for the rapid movement of users between experiences. Almost immediately upon launching a new experience, the Roblox Client will begin simulating and rendering the virtual world using a partial representation of the environment at a low level of detail. As more and higher fidelity assets are received by the Roblox Client, the fidelity of the experience automatically improves.

Assets are delivered to the Roblox Client through geographically distributed content delivery networks. The Roblox Cloud determines the format, level of detail, and priority of each asset sent in order to optimize for the capabilities and bandwidth available to the client device. For large experiences, the Roblox Client can dynamically purge unnecessary assets from device memory, ensuring that a single large experience can be experienced simultaneously on different devices regardless of device memory capacity.

Developers have access to high-speed data stores in the Roblox Cloud where information about users and each simulated environment can be persisted. This, along with other services hosted in the Roblox Cloud, make it possible for a developer to build, launch, scale and monetize a 3D immersive experience without any additional tools or services.

Data centers in the Roblox Cloud are linked through a high-performance dedicated backbone network bypassing the public internet for server-to-server calls and we operate under an open peering policy where we have direct interconnection with Internet providers globally. Operating our own network maximizes performance and increases the immersiveness experienced by our users.

Developers build, publish, and operate 3D immersive experiences with Roblox Studio, a free suite of tools accessible to all skill levels. Teams can work together using built-in access control management and collaborative editing. Once content is built, it can be replicated and shared across multiple experiences, giving developers the ability to scale their efforts and make rapid updates.

In addition to constructing 3D objects and environments, developers can script complex behaviors into their experience with Roblox Luau. Based on Lua, an interpreted light-weight programming language popular in the gaming industry, Roblox Luau adds an optional static type system and a highly optimized interpreter that maximizes performance on Roblox Clients and in the Roblox Cloud. Using scripts, developers can modify the environment, control object behavior, and create new ways for users to interact with the virtual environment. Within Roblox Studio, developers have access to a powerful script editor which supports autocomplete, debugging, and the ability to emulate the Roblox Client running on supported devices.

Roblox Studio also leverages artificial intelligence (“AI”) to help reduce friction for creators and developers, making it easier to build content on the Platform. These AI tools help developers and creators with varying levels of experience. For example, AI tools help beginner developers and creators with no coding experience by answering common questions, while AI tools such as Code Assist or Materials Generator help developers and creators with minimal coding experience learn how to write and improve code and create more complex materials.

We provide developers with reference material, tutorials, community forums, and analytics to build their creations. Creator Hub includes reference material, API documentation, and tutorials for developers. Developer Forum is a private forum for qualified developers which provides insight on new features, community initiatives, recruitment opportunities, bug reporting, and direct engagement with our employees. Edu Hub provides content for educators, students, and parents who are using Roblox as a tool to learn coding, 3D design, and digital civility. All developers on the Roblox Platform have access to dashboards that show daily visits to their experience, as well as earned Robux generated from their experience and Marketplace items.

Within the Roblox Client, users find experiences through personalized content recommendations and search. Recommendations are based on past user behavior, the social graph, and demographic information collected at signup. An emphasis is always placed on experiences where someone you are connected with is present. The search engine automatically learns user intent, accounting for misspellings, slang, and multilingual queries.

Localization and compliance systems embedded within the Roblox Client and Roblox Cloud help to lower cultural barriers and enable our developers to meet regional requirements with little to no additional effort.

Developers can build experiences in their native language and then, using machine translation and advanced pattern recognition, the Roblox Cloud automatically translates those experiences into 16 languages including simplified Chinese, traditional Chinese, English, French, German, Indonesian, Italian, Japanese, Korean, Polish, Portuguese, Russian, Spanish, Thai, Turkish, and Vietnamese. Developers also have the ability to customize all or part of their translations if needed.

To meet an evolving global regulatory environment, the Roblox Client can adjust a user’s experience and available content based on their age, device type, current location and where the client application was obtained. This allows Roblox to dynamically apply relevant content filters, anti-addiction rules, payment limits, and parental consent requirements.

Users can also acquire Robux through a monthly subscription to Roblox Premium. With a subscription, users receive discounted Robux along with access to exclusive or discounted items in the Marketplace. Developers may also choose to offer additional benefits to active Roblox Premium subscribers in the form of discounted virtual merchandise or access to exclusive in-experience features.

Developers and creators earn Robux by selling virtual content or access to virtual content (including through subscriptions), as well as through the incorporation of immersive ads into their experiences, which are ad units that developers can insert into their experience for Roblox to programmatically serve ad content from advertisers. There are two immersive and native ad formats: image ads, which are static, non-clickable images within the 3D space of an experience and immersive portals, which are static, non-clickable images where the ad unit includes a door that teleports a user to the advertiser’s experience and back again. Developers can also earn Robux through Engagement-Based Payouts based on the share of time that Roblox Premium users engage in their experiences. Engagement-Based Payouts incentivize developers to invest in the engagement of their experiences. The payout system is designed to protect against fraud and computes a developer’s earnings potential on a daily basis.

Roblox allows developers and creators to convert earned Robux into the real-world currency of their choice through our Developer Exchange Program. All Developer Exchange Program requests are reviewed on a risk-based approach to mitigate fraud and money laundering. Developers and creators participating in the program are required to create an account with our third party vendor which collects tax information, ensures regulatory compliance, and executes the payouts. Additionally, developers and creators aged 13 and up can convert earned Robux into ad credits to purchase ads on the Platform.

Content submitted by developers and creators, including images, models, audio, and video, goes through a multi-step review process before appearing on the Platform. Images are evaluated for Child Sexual Abuse Material using PhotoDNA with flagged images automatically reported to the National Center for Missing and Exploited Children. Audio files are scanned for IP infringement. Finally, all assets are subject to review by humans or AI trained on our Community Standards. During the year ended December 31, 2023, including automated reviews, we evaluated over 300 million assets. Assets refer to images, audio files, and video files that developers upload to the Roblox Platform to include in their experiences and in the Marketplace.

When experiences are published or updated on the Roblox Platform, they are evaluated by a suite of AI driven tools that identify problematic language, potential bypasses to our safety systems, and content that falls outside our policies. A human review team is continuously operating to evaluate flagged experiences. The Roblox Platform includes a suite of anti-intruder technology leveraging machine learning, throttles, and circuit breakers designed to block automated bot attacks and mitigate the impact of humans who attempt to spam users and disrupt the service. We also leverage targeted penetration testing, a bug bounty program, code reviews, secure by design principles, security testing, and vulnerability scanning to promote the security of the Platform.

Our Platform is designed to comply with the Children’s Online Privacy Protection Act (“COPPA”) and the General Data Protection Regulation (“GDPR”) regulations. We work closely with regulators, authorities, and safety groups in many countries. We endeavor to promptly report any suspected child exploitation or abuse materials to the relevant authorities.

We partner with leading global organizations focused on child and internet safety, including the WeProtect Global Alliance, Digital Wellness Lab, Family Online Safety Institute, UK Safer Internet Centre, the Internet Watch Foundation, and kidSAFE, among others. We are also a member of various organizations, such as the Association for United Kingdom Interactive Entertainment and the Technology Coalition, with a goal of cross-industry collaboration, knowledge and technology exchange in areas of user safety, and child safety. As a member of the Technology Coalition, we are committed to providing transparency and promoting child safety online. We continue to work diligently with other digital platforms to report bad actors and inappropriate content so that they can also take appropriate actions on their platforms.

Throughout our site and in-experience, we provide our users with the ability to report activity that they find objectionable. Users can also block or mute other users with whom they do not want to interact. We also provide parents with customizable parental controls to limit or disable online chat or to restrict access to a curated list of age appropriate experiences.

We have a dedicated team and thousands of trust & safety agents whose role is to protect our users by focusing on detecting inappropriate content and behavior 24/7 through a combination of AI and human moderation. We take swift action to address any content or developer or creator that violates our terms of use once detected. We have a Safety Advisory Board, made up of global industry experts that advise on the best practices to protect our community.

We continue to invest in technology and people to combat bad actors who attempt to undermine our efforts to connect millions of people. Our priority remains the safety and digital civility of our community.

Consistent with our free to use business model, a small portion of our users have historically been payers. For example, in the year ended December 31, 2023, of our 68.4 million DAUs, only 852,000 represented our average daily unique paying users. Similarly, in the year ended December 31, 2023, our average daily bookings per DAU was $0.14, whereas our average daily bookings per daily unique paying user was $11.32. We believe that maintaining and growing our overall number of users, including the number of users who may not purchase and spend Robux, is important to the success of our business. As a result, we believe that the number of users who choose to purchase and spend Robux will continue to constitute a small portion of our overall users.

Roblox also allows developers, creators, and brands to reach their audiences by purchasing ads. Further, Roblox offers sponsored experiences and sponsored avatar items, whereby developers and creators can pay to purchase ads to increase discoverability of their creations, which appear where experiences and items are discovered, including through search.

Generally, as users purchase and subsequently spend Robux on Roblox, creators of the virtual item receive 30% of the Robux, the seller or distributor of the virtual item receives 40% of the Robux, and the Platform receives 30% of the Robux. Oftentimes, the creator of the virtual item is also the seller of that item. Creators that sell their own creations within their experiences receive 70% of the Robux spent, as they are acting both as the creator and the seller. Creators that make their virtual items available through the Marketplace receive 30% of the Robux spent, as Roblox is both the seller and the Platform for these transactions. Creators also receive 70% of the Robux spent for sales of plugins and other assets that appear in the Creator Store. As it relates to generating impressions for ads units and portals, developers earn Robux based on the number of impressions and teleports that occur within their experience.

Our developers and creators do not always exchange their Robux into real-world currency. Some choose to reinvest their Robux into developer tools from the Creator Store, purchase ad credits to promote their experiences on the Platform, or spend the Robux as any other user would.

Users build a direct relationship with the Roblox brand by establishing an identity and creating their social graph. Users are able to navigate across an integrated universe of experiences on our Platform and engage on the Platform with other users in their social graph. We believe this approach helps to create a flywheel that brings new users to the Platform, and promotes loyalty and engagement.

We have millions of experiences to choose from on Roblox, and developers continue to build new experiences on the Platform and publish them daily. As experiences on the Platform grow in popularity, this success accrues to the Roblox brand and serves to draw in new audiences. Our approach is to amplify these experiences on both earned and owned channels which builds awareness and affinity for Roblox. This approach includes educating our creators, users, and brands on the Platform’s capabilities and innovations, all of which elevates each stakeholder’s experience.

We operate a highly efficient marketing model. Our approach is highly organic, with our user, creator and developer adoption driven by mutually reinforcing content and social network effects. We also leverage our influencer community to increase brand awareness and our reach across all age demographics.

We believe safety and civility is an integral and differentiating part of our brand. We have invested heavily in creating a safe and civil platform, which has allowed us to both grow and retain our user base.

We rely on developers and creators to create the content that leads to and maintains user engagement (including maintaining the quality of experiences). We compete to attract and retain developers and creators by providing them with the free tools to easily build, publish, operate, and monetize content. We compete for developers and creators and engineering talent with gaming platforms such as Epic Games, Unity, Meta Platforms, and Valve Corporation, who provide developers and creators the ability to create or distribute interactive content. We are able to compete for these developers and creators because of our comprehensive offering to build, publish, and operate experiences on our Platform, our free and easy-to-use technology, our broad user reach, our economic rewards system, our brand, our reputation for innovation, our developer and creator-centric culture, and our mission.

We rely on a variety of statutory and common-law frameworks and defenses relevant to the content available on our service, including the Digital Millennium Copyright Act (“DMCA”), the Communications Decency Act, and the fair-use doctrine in the U.S., and the Electronic Commerce Directive in the European Union (“EU”). However, each of these statutes is subject to uncertain or evolving judicial interpretation and regulatory and legislative amendments. In addition, pending or recently adopted legislation in the EU may impose additional obligations or liability on us associated with content uploaded by users to our Platform. If the rules, doctrines or currently available defenses change, if international jurisdictions refuse to apply protections similar to those that are currently available in the U.S. or the EU, or if a court were to disagree with our application of those rules to our service, we could be required to expend significant resources to try to comply with the new rules or incur liability, and our business, revenue and financial results could be harmed.

We are also subject to U.S. federal and state and foreign laws and regulations regarding privacy and data protection, including with respect to the collection, storage, sharing, use, processing, transfer, disclosure, and protection of personal data. For example, the California Consumer Privacy Act (“CCPA”), went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide new disclosures to California consumers, and afford such consumers new abilities to opt-out of the sale of personal information. Additionally, the California Privacy Rights Act (“CPRA”) became effective on January 1, 2023. The CPRA significantly modifies the CCPA, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. Similar legislation has been proposed or adopted in other states. Aspects of the CCPA and these other state laws and regulations, as well as their enforcement, remain unclear, and we may be required to modify our practices in an effort to comply with them. California has also enacted the California Age-Appropriate Design Code Act (“ADCA”), which will take effect on July 1, 2024. The ADCA implements into law certain principles taken from the U.K.’s Age Appropriate Design Code (“AADC”), which went into effect in September 2021, and imposes substantial new obligations upon companies that offer online services, products, or features “likely to be accessed” by children, defined under the ADCA as anyone under 18 years of age. A U.S. District Court judge in the Northern District of California granted a request for preliminary injunction finding that the plaintiff is likely to succeed on its claim that the AADC violates the First Amendment. The California Attorney General has since filed an appeal. In addition, foreign data protection, privacy, consumer protection, communication, content regulation, and other laws and regulations may be more restrictive and burdensome. For example, GDPR imposes stringent operational requirements for entities processing personal information and significant penalties for non-compliance. Under GDPR, fines up to 20 million Euros or up to 4% of the annual global revenues of the infringer, whichever is greater, can be imposed for violations. In addition, the EU’s Digital Services Act, which became fully applicable on February 17, 2024 imposes new content moderation obligations, notice and transparency obligations, advertising restrictions and other requirements on digital platforms to protect consumers and their rights online. The evolving regulatory landscape internationally results in uncertainty and could require us to incur additional costs and expenses to comply.

Children’s privacy has also been a focus of recent enforcement activity and subjects our business to potential liability that could adversely affect our business, financial condition or operating results. The Federal Trade Commission and state attorneys general in the U.S. have in recent years increased enforcement of COPPA, which requires companies to obtain parental consent before collecting personal information from children under the age of 13. In addition, the FTC released proposed updates to COPPA and are requesting comments prior to publishing a final version of the updated COPPA rule. In addition, GDPR prohibits certain processing of personal information of children under the age of 13-16 (depending on the country) without parental consent. The CCPA requires companies to obtain the consent of children in California under the age of 16 (or parental consent for children under the age of 13) before selling their personal information. Actual or perceived noncompliance with the AADC may result in audits or other proceedings by the United Kingdom’s Information Commissioner Office, the body set up to uphold information rights in the United Kingdom, and other regulators in the EEA or Switzerland, as noncompliance with the AADC may indicate noncompliance with applicable data protection law. Although we take reasonable efforts to comply with these laws and regulations, we may in the future face claims under COPPA, the GDPR, the CCPA, the ADCA, and the AADC, or other laws or actual or asserted obligations relating to children’s privacy. There are also a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning content regulation and data protection that could affect us if enacted in the future.

We take a variety of technical and organizational security measures and other measures designed to protect our data, including data pertaining to our users, employees and business partners. Despite measures we put in place, we may be unable to anticipate or prevent unauthorized access to such data.

Non-compliance with any applicable laws and regulations could result in penalties or significant legal liability. Although we take reasonable efforts to comply with applicable laws and regulations, there can be no assurance that we will not be subject to regulatory action, including fines, in the event of an incident or as the result of a regulatory investigation. We or our third-party service providers could be adversely affected if legislation or regulations are expanded to require changes in our or our third-party service providers’ business practices or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our or our third-party service providers’ business, results of operations, or financial condition.

Government authorities outside the U.S. may also seek to restrict access to or block our Platform, prohibit or block the hosting of certain content available through our Platform or impose other restrictions that may affect the accessibility or usability of our Platform in that country for a period of time or even indefinitely. In addition, some countries have enacted laws that allow websites to be blocked for hosting certain types of content or may require websites to remove certain restricted content. Our privacy policy and terms and conditions of use describe our practices concerning, the use, transmission, and disclosure of user information and are posted on our website.

For additional information, please see the sections titled “Risk Factors—Risks Related to Our Business—If the security of our Platform is compromised, it could compromise our and our developers’, creators’, and users’ private information, disrupt our internal operations, and harm public perception of our Platform, which could cause our business and reputation to suffer,” “Risk Factors—Risks Related to Our Business—Some developers, creators, and users on our Platform may make unauthorized, fraudulent, or illegal use of Robux and other digital goods or experiences on our Platform, including through unauthorized third-party websites or “cheating” programs,” and “Risk Factors—Risks Related to Government Regulations—Because we store, process, and use data, some of which contains personal information, we are subject to complex and evolving federal, state, and international laws and regulations regarding privacy, cybersecurity, data protection, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, and could result in investigations, claims, changes to our business practices, increased cost of operations, and declines in user growth, retention, or engagement, any of which could significantly harm our business.”

As of December 31, 2023, we owned more than 160 U.S. patents relating to aspects of our actual or contemplated operations and technologies. Our issued patents are scheduled to expire between 2025 and 2041. We also had more than 250 pending patent applications in the U.S. and abroad. There can be no assurance that each of our patent applications will result in the issuance of a patent. In addition, any resulting issued patents may have claims narrower than those in our patent applications. We seek to protect our proprietary inventions relevant to our business through patent protection; however, we are not dependent on any particular patent or application for the operation of our business.

We have registered “Roblox,” “Robux,” and our corporate logo as trademarks in the U.S. and other jurisdictions. In total, we are the owner of over 453 trademark filings and have over 39 trademark applications in the U.S. and foreign countries as of December 31, 2023. There can be no assurance that each of our trademark applications will result in the issuance of a trademark or that each resulting trademark registration will be able to be maintained. As of December 31, 2023, we were the registered holder of over 1,700 domestic and international domain names. We continually monitor the registration of our domain names, trademarks, and service marks in the U.S. and in certain locations outside the U.S.

Despite our efforts, we may not be able to obtain or maintain sufficient protection for or successfully enforce our intellectual property. Any current and future patents, trademarks and other intellectual property or other proprietary rights we own or license, or otherwise have a right to use, may be contested, circumvented or found unenforceable or invalid. Our existing and future patents, copyrights, trademarks, trade secrets, domain names and other intellectual property rights may not provide us with competitive advantages, distinguish our products from those of our competitors or prevent competitors from launching comparable products. We may also be dependent on third-party content, technology and intellectual property in connection with our business. Further, we may not be able to prevent third parties from infringing, diluting or otherwise misappropriating or violating our intellectual property rights, and we may face challenges to the validity or enforceability of our intellectual property rights. We cannot guarantee that our business does not and will not infringe or misappropriate the rights of third parties. We expect to continue to face allegations from third parties, including our competitors and “non-practicing entities,” that we have infringed or otherwise violated their intellectual property rights. While we do not anticipate that these allegations, if they were to result in litigation against us, would have a materially adverse impact on our business, financial condition or operating results, there can be no guarantee that such lawsuits would not have a materially adverse impact on us. Further, certain federal statutes in the U.S. may apply to us with respect to various activities of our users, including the DMCA, provide immunity from monetary damages for online service providers such as us from, among other things, infringing content uploaded to our Platform by our users provided we comply with certain statutory requirements. The immunity is part of a statutory safe harbor. To enjoy the benefits of the safe harbor and be immune from monetary damages for infringing content uploaded by our users, we have to register a designated agent with the U.S. Copyright Office and maintain that filing on a periodic basis with the U.S. Copyright Office. We must also expeditiously remove any infringing content upon acquiring actual knowledge of such infringement or, in the absence of actual knowledge, if we become aware of facts or circumstances from which infringing activity is apparent. We must also adopt, reasonably implement, and inform users of our Platform about a policy that provides for the termination in appropriate circumstances of users who are repeat infringers of the copyrights of third parties. If we fail to comply with the conditions for qualifying for safe harbor protection, we may be subject to monetary damages for infringing content on our Platform. The damages for copyright infringement can range from $750 to $30,000 per work infringed and, in the case of willful infringement, up to $150,000 per work infringed. Alternatively, copyright owners could seek to recover their actual damages and our profits. As we host millions of user uploaded works, we could be subject to significant damages claims if we are determined not to comply with the DMCA safe harbors. Intellectual property disputes are common in our sector, and, as we face increasing competition or grow our business, there is an ongoing risk that we may become involved in legal disputes involving intellectual property claims. In addition to the protection provided by our intellectual property rights, we maintain a policy requiring our employees, consultants, and other third parties to enter into confidentiality and proprietary rights agreements to control access to our intellectual property.

For additional information on risks relating to intellectual property, please see the sections titled “Risk Factors—Risks Related to Intellectual Property—Claims by others that we infringe their proprietary technology or other rights, the activities of our users, or the content of the experiences on our Platform could subject us to liability and harm our business,” “Risk Factors—Risks Related to Intellectual Property—Failure to protect or enforce our intellectual property rights or the costs involved in such enforcement would harm our business,” and “Risk Factors—Risks Related to Intellectual Property—We use open source software as part of, and in connection with certain experiences on, our Platform, which may pose particular intellectual property and security risks to and could have a negative impact on our business.”

We have embraced four core values since we founded Roblox and focus on incorporating them into our daily actions:

To help focus our core values and to promote and support diversity, inclusion and equity, we have established several affinity groups. Our affinity groups are inclusive, voluntary, and employee-led whose aim is to promote inclusion at the Company and allow networking, mentorships, and other opportunities for professional and personal development. They include groups for women, racial and ethnic minorities, and people who identify as LGBTQIA+.

We were incorporated in 2004. Our principal executive offices are located at 970 Park Place, San Mateo, California 94403, and our telephone number is (888) 858-2569. Our website address is www.corp.roblox.com. Information contained on, or that can be accessed through, our website is not incorporated by reference into this Annual Report on Form 10-K. “Roblox,” “Robux,” our logo and our other registered or common law trademarks, service marks or trade names appearing in this Annual Report on Form 10-K are the property of Roblox Corporation. Other trademarks and trade names referred to in this Annual Report on Form 10-K are the property of their respective owners. Solely for convenience, trademarks and trade names referred to in this Annual Report on Form 10-K, including logos, artwork and other visual displays, may appear without a trademark symbol, but such references are not intended to indicate in any way that we will not assert, to the fullest extent under applicable law, our rights or the rights of the applicable licensor to these trademarks and trade names. We do not intend our use or display of other entities’ trade names, trademarks or service marks to imply a relationship with, or endorsement or sponsorship of us by, any other entity.

RISK FACTORS

A description of the risks and uncertainties associated with our business is set forth below. You should carefully consider the risks described below, as well as the other information in this Annual Report on Form 10-K, including our consolidated financial statements and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The occurrence of any of the events or developments described below could materially and adversely affect our business, financial condition, results of operations, and growth prospects. In such an event, the market price of our Class A common stock could decline, and you may lose all or part of your investment. Additional risks and uncertainties not presently known to us or that we currently believe are not material may also impair our business, financial condition, results of operations, and growth prospects.

We are also subject to content moderation obligations, notice and transparency obligations, advertising restrictions and other requirements on digital platforms to protect consumers and their rights online, and existing and new regulations and policies with respect to privacy, biometrics, data protection, cybersecurity, gambling, loot boxes, intellectual property, childhood protection, consumer protection, ratings, and taxes. Additionally, the Federal Trade Commission regulates and restricts deceptive or unfair commercial activities, including with relation to targeted advertising. We are subject to regulations with respect to advertising, in particular, advertising to minors, and advertising regulations could differ based on the jurisdiction of the user. We may not be able to implement an advertising model that is compliant with regulations in all jurisdictions in which we operate. These requirements may increase our moderation and compliance related costs and expenses, reduce the overall use or demand of our Platform, or result in significant injunctive and monetary remedies for violations.

Moreover, changes to these laws, regulations, standards, or obligations could require us to change our business model, take on more onerous obligations, including, but not limited to, applying for government-issued licenses to operate, establishing a local presence in certain jurisdictions, or developing localized product offerings, and impact the functionality of our Platform. The costs of compliance with, and other burdens imposed by, these laws, regulations, standards, and obligations, could be prohibitively expensive. Furthermore, any inability to adequately address these burdens, would harm our ability to operate our Platform, limit the attractiveness of our Platform, or reduce overall demand for our Platform, which would harm our business, financial condition, and results of operations.

Our Platform relies on our developers and creators to create experiences and virtual items on our Platform for our users, and we believe the interactions between and within the developer, creator, and user communities on our Platform create a thriving and organic ecosystem, and this network effect drives our growth. To facilitate and incentivize the creation of the experiences and virtual items by developers our Platform offers developers an opportunity to earn Robux, a virtual currency on our Platform. When virtual items are acquired on our Platform, the originating developer or creator earns a portion of the Robux paid for the item. Developers are able to exchange their accumulated earned Robux for real-world currency under certain conditions outlined in our Developer Exchange Program. While we have millions of developers and creators on our Platform, 48% of engagement hours were spent in the top 50 experiences in the month ending December 31, 2023 and only 526 experiences had engagement hours of 10 million or more. The loss of any of our top developers could have a material impact on our business, financial condition, and operations. If we fail to provide a sufficient return to developers, they may elect to develop user-generated content on other platforms, which would result in a loss of revenue.

Despite our efforts, users, developers, or creators may become dissatisfied with our billing or payment policies, our handling of personal data, or other aspects of our Platform. If we fail to adequately address these or other user, developer, or creator complaints, negative publicity about us or our Platform could diminish confidence in and the use of our Platform. If we do not provide the right technologies, education or financial incentives to our developers and creators, they may develop fewer experiences or virtual items or be unable to or choose not to monetize their experiences, and our users may elect to not participate in the experiences or acquire the virtual items, and, thus, our Platform, revenue, and bookings could be adversely affected. Additionally, if we fail to anticipate developers’ and creators’ needs, the quality of the content they create may not attract users to engage with experiences and result in a decline of users on our Platform. When we develop new or enhanced features for our Platform, we typically incur expenses and expend resources upfront to develop, market, promote, and sell new features, and we may not be able to realize some or all of the anticipated benefits of these investments.

If any unauthorized access to our network, systems or data, including our sensitive and proprietary information, personal data from our users, developers, or creators, or other data, or any other loss or unavailability of, or unauthorized use, modification, disclosure, or other processing of personal data or any other security breach or incident, occurs or is believed to have occurred, whether as a result of third-party action, employee negligence, error or malfeasance, defects, social engineering techniques, ransomware attacks, or otherwise, our reputation, brand and competitive position could be damaged, our and our users’, developers’ and creators’ data and intellectual property could potentially be lost or compromised, and we could be required to spend capital and other resources to alleviate problems caused by such actual or perceived breaches or incidents and remediate our systems. In the past, we have experienced social engineering and phishing attacks, and if similar attacks occur and are successful, this could have a negative impact on our business or result in unfavorable publicity. Additionally, we contract with certain third parties to store and process certain data for us, including our distribution channels, and these third parties face similar risks of actual and potential security breaches and incidents, which could present similar risks to our business, reputation, financial condition, and results of operations.

We incur significant costs in an effort to detect and prevent security breaches and other security-related incidents, including those to secure our product development, test, evaluation, and deployment activities, and we expect our costs will increase as we make improvements to our systems and processes to prevent future breaches and incidents. The economic costs to us to reduce cyber or other security problems, such as spammers, errors, bugs, flaws, “cheating” programs, defects or corrupted data, could be significant and may be difficult to anticipate or measure. Even the perception of these issues may cause developers, creators, and users to use our Platform less or stop using it altogether, and the costs could divert our attention and resources, any of which could result in claims, demands, and legal liability to us, regulatory investigations and other proceedings, and otherwise harm our business, reputation, financial condition, or results of operations. There could also be regulatory fines imposed for certain data breaches that take place around the world. Further, certain laws and regulations relating to privacy, biometrics, cybersecurity, and data protection, such as the California Consumer Privacy Act (“CCPA”), allow for a private right of action, which may lead to consumer litigation for certain data breaches that relate to specified categories of personal information. From time to time, we do identify product vulnerabilities, including through our bug bounty program. Although we have policies and procedures in place designed to swiftly characterize the potential impact of such vulnerabilities and develop appropriate patching or upgrade recommendations and also maintain policies and procedures related to vulnerability scanning and management of our internal corporate systems and networks, such policies and procedures may not be followed or detect every issue, and from time to time, we have, and may in the future again, need to proactively disable access to our Platform in order to provide necessary patching or upgrades.

These and other factors could harm our ability to generate revenue and bookings outside of the U.S. and, consequently, adversely affect our business, financial condition and results of operations. We may not be able to expand our business and attract users in international markets and doing so will require considerable management attention and resources. International expansion is subject to the particular challenges of supporting a business in an environment of multiple languages, cultures, customs, legal systems, alternative dispute systems, regulatory systems and commercial infrastructures. We may not be able to offer our Platform in certain countries, and expanding our international focus may subject us to risks that we have not faced before or increase risks that we currently face.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in our financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the recognition and measurement of certain assets and liabilities and revenue and expenses that is not readily apparent from other sources. In addition to revenue recognition and estimates of the average lifetime of a paying user, our accounting policies that involve judgment include those related to assumptions used for estimating the fair value of common stock to calculate stock-based compensation, capitalization of internal-use software costs, valuation of goodwill and intangible assets, certain accrued liabilities, and valuation allowances associated with income taxes. If our assumptions change or if actual circumstances differ from those in our assumptions, our results of operations could be adversely affected, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the market price of our Class A common stock.

Further, many jurisdictions have also adopted or are considering adopting marketplace facilitator laws that shift the burden of tax collection to online marketplaces. If we are characterized as a marketplace facilitator for the sale of content between our developers, creators, and users, we may need to invest substantial amounts to modify our solutions or business model to be able to meet any reporting and collection obligations with respect to sales, value added, or similar taxes. A successful assertion by a jurisdiction that we should have been or should be collecting additional sales, value added, or other taxes for the sale of content between our developers, creators, and users, could, among other things, result in substantial tax payments, create significant administrative burdens for us, discourage potential users, developers or creators from subscribing to our Platform, or otherwise harm our business, results of operations, and financial condition.

Governmental agencies in any of the countries in which we, our users, developers, or creators are located from time to time seek to and could seek to block access to, impose restrictions on, or require a license for our Platform, our website, operating system platforms, application stores or the internet generally for a number of reasons, including cybersecurity, privacy, data protection, confidentiality, or regulatory concerns which may include, among other things, governmental restrictions on certain content in a particular country, requirements to establish a local presence in a particular jurisdiction, and a requirement that user information be stored on servers in a country within which we operate. Moreover, the adoption of any laws or regulations adversely affecting the growth, popularity or use of the internet, including laws impacting Internet neutrality, could decrease the demand for our Platform and increase our operating costs. The legislative and regulatory landscape regarding the regulation of the internet and, in particular, internet neutrality, in the U.S and internationally is subject to uncertainty. Governmental agencies could issue fines or penalties if there are instances where we are found not to have been in compliance with regulations in any of these areas. Users generally need to access the internet, including in geographically diverse areas, and also mobile platforms such as the Apple App Store and the Google Play Store, to engage with experiences on our Platform. If governmental or other entities block, limit or otherwise restrict developers, creators, and users from accessing our Platform, or users from engaging with experiences on our Platform, we may need to take on more onerous obligations, limit the functionality of our Platform, and/or establish certain local entities, each of which could adversely affect our results of operations or subject us to additional fines and penalties.

Certain privacy, biometrics, cybersecurity, and data protection laws and regulations have placed and will continue to place significant privacy, data protection, and cybersecurity obligations on organizations such as ours and may require us to continue to change our policies and procedures. For example, the European Union’s (“EU”) General Data Protection Regulation (“GDPR”) imposed more stringent data protection requirements regarding EU personal data, and its provisions include increasing the maximum level of fines that EU regulators may impose for the most serious breaches of noncompliance of €20 million or 4% of annual global revenues of the previous year, whichever is greater. Such fines would be in addition to (i) the rights of individuals to sue for damages in respect of any data privacy breach which causes them to suffer harm, (ii) the right of individual member states to impose additional sanctions over and above the administrative fines specified in the GDPR, and (iii) the ability of supervisory authorities to impose orders requiring companies to modify their practices. If we are found not to be compliant with GDPR or similar requirements, including obligations to comply with data protection requirements when transferring personal data from the European Economic Area (“EEA”), Switzerland, and the United Kingdom (“U.K.”) to the U.S., we may be subject to significant fines and the risk of civil litigation.

The United Kingdom maintains the Data Protection Act of 2018 and the UK GDPR, which collectively implement and complement the GDPR and provide for penalties for noncompliance of up to the greater of £17.5 million or four percent of worldwide revenues, uncertainty remains regarding the future of data protection in the United Kingdom. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the EEA to the U.K. Such adequacy decision must, however, be renewed after four years and may be modified or revoked in the interim. We cannot fully predict how the Data Protection Act, the UK GDPR and other United Kingdom data protection laws or regulations may develop in the medium to longer term, nor the effects of divergent laws and guidance regarding how data transfers to and from the United Kingdom will be regulated.

In addition, various local, national, and foreign laws and regulations apply to our operations, including the Children’s Online Privacy Protection Act (“COPPA”), in the U.S., Article 8 of the GDPR and similar regulations in other jurisdictions. COPPA imposes strict requirements on operators of websites or online services directed to children under 13 years of age (or 16 years of age under other regulatory regimes). 42% of our DAUs were under the age of 13 during the year ended December 31, 2023. COPPA requires companies to obtain verifiable parental consent before collecting personal information from children under the age of 13. Both the U.S. federal government and the states can enforce COPPA and violations of COPPA can lead to significant fines. No assurances can be given that our compliance efforts will be sufficient to avoid allegations of COPPA violations, and any non-compliance or allegations of non-compliance could expose us to significant liability, penalties and loss of revenue, significantly harm our reputation, and could be costly and time consuming to address or defend. To the extent we rely on consent for processing personal data under the GDPR, consent or authorization from the holder of parental responsibility is required in certain cases for the processing of personal data of children under the age of 16, and member states may enact laws that lower that age to 13. Additionally, in certain jurisdictions the law may allow minors to disaffirm their contracts, including our Terms of Use. If minors on our Platform are able to avoid enforcement of our Terms of Use under applicable law, it could have a material adverse impact on our business, financial condition, results of operations, and cash flow.

We are also monitoring updated guidance from the United Kingdom’s Information Commissioner Office (“ICO”) on the Age Appropriate Design Code (“AADC”), which focuses on online safety and protection of children’s privacy online. The AADC became effective September 2, 2021, and noncompliance with the AADC may result in audits or other proceedings by the ICO, the regulatory body set up to uphold information rights in the United Kingdom, and other regulators in the EEA or Switzerland, as noncompliance with the AADC may indicate noncompliance with applicable data protection law. In addition, we are monitoring developments with the EU’s, Digital Services Act (“DSA”), which became fully applicable on February 17, 2024. The DSA imposes new content moderation obligations, notice and transparency obligations, advertising restrictions and other requirements on digital platforms to protect consumers and their rights online. Noncompliance with the DSA could result in fines of up to 6% of annual global revenues, which are in addition to the ability of civil society organizations and non-governmental organizations to lodge class action lawsuits. We may incur liabilities, expenses, costs, and other operational losses under the GDPR and laws and regulations of applicable EU Member States and the United Kingdom relating to privacy, cybersecurity and data protection in connection with any measures we take to comply with them.

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and cybersecurity, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais or LGPD, entered into effect on September 18, 2020, authorizing a private right of action for violations. Penalties may include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50M reais (approximately $9.5 million U.S. dollars). The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with the similar rights as the GDPR regarding their data. A Brazilian Data Protection Authority, Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados) has been established to provide rules and guidance on how to interpret and implement the LGPD’s requirements, including regarding notice of processing, data transfer requirements, and other compliance obligations, such as security measures, recordkeeping, training, and governance. Additionally, the Personal Information Protection Law, or PIPL of the People’s Republic of China (“PRC”), was adopted on August 20, 2021, and went into effect on November 1, 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to citizens of the PRC. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year. Our approach with respect to the LGPD and PIPL may be subject to further evaluation and change, our compliance measures may not be fully adequate and may require modification, we may expend significant time and cost in developing and maintaining a privacy governance program, data transfer or localization mechanisms, or other processes or measures to comply with the LGPD, the PIPL, and any implementing regulations or guidance under these regimes, and we may potentially face claims, litigation, investigations, or other proceedings or liability regarding the LGPD or PIPL and may incur liabilities, expenses, costs, and other operational losses under the LGPD and PIPL and any measures we take to comply with them.

In addition, the CCPA, which established a new privacy framework for covered businesses such as ours, went into effect in January 2020, requiring us to modify our data processing practices and policies and incur compliance related costs and expenses. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, which may increase the likelihood and cost of data breach litigation. Additionally, the California Privacy Rights Act (“CPRA”), was approved in November 2020, and significantly modified the CCPA. The CPRA went into effect on January 1, 2023 and, among other things, gives California residents the ability to limit the use of their sensitive information, provides for penalties for CPRA violations concerning California residents under the age of 16, and establishes a new agency to implement and enforce the law. Further, the CCPA has prompted similar legislative developments in other states in the U.S., including laws enacted in Virginia, Colorado, Utah, Connecticut, Florida, Iowa, Indiana, Montana, Tennessee, Oregon, Delaware, Texas, and New Jersey. These developments create the potential for a patchwork of overlapping but different state laws. Other states, including California, Utah and Arkansas, have passed legislation imposing substantial new obligations upon companies that offer online services, products, or features “likely to be accessed” by children 17 years of age or under, or certain types of social media and digital services, respectively. The California legislation includes certain requirements and principles from the AADC including, among other things, data protection impact assessments and the implementation of privacy by design. The laws in Utah and Arkansas impose new restrictions and obligations in connection with users who are, or are deemed to be, under 18, including access restrictions and restrictions on abilities for minors to create accounts. Many states have also passed their own laws that require verifiable parental consent before allowing children to create an account or impact companies that process children’s personal data. Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of operating our products and services and other aspects of our business. The potential effects of new and evolving legislation relating to privacy, cybersecurity, data protection, and related matters, such as age verification, are far-reaching, create the potential for a patchwork of overlapping but different laws, and may require us to modify practices and policies, incur substantial costs and expenses, or restrict our operations. Additionally, requirements for verified parental consent before allowing children to create an account may limit the use of our Platform or reduce or overall demand for our Platform, which could harm our business, financial condition, and results of operations.

We believe we take reasonable efforts to comply with all applicable laws, regulations, and other legal obligations and certain industry codes of conduct relating to privacy, cybersecurity, and data protection. However, it is possible that the obligations imposed on us by applicable laws and regulations, industry codes of conduct or other actual or asserted obligations relating to privacy, cybersecurity, data protection, or related matters, may be interpreted and applied in inconsistent manners and may conflict with other rules or our practices in certain jurisdictions. Additionally, due to the nature of our service, we are unable to maintain complete control over cybersecurity or the implementation of measures that reduce the risk of a security breach or incident. For example, our customers may accidentally disclose their passwords or store them on a mobile device that is “SIM swapped,” lost, or stolen, creating the perception that our systems are not secure against third-party access. Any failure or perceived failure by us to comply with our privacy policies, our obligations to users or other third parties relating to privacy, cybersecurity or data protection, or our other policies or obligations relating to privacy, cybersecurity, data protection, or related matters, or any actual or perceived compromise of security, including any such compromise that results in the unauthorized loss, unavailability, modification, release, transfer, or other processing of personal information or other user, developer or creator data, may result in governmental investigations and enforcement actions, litigation, claims or public statements against us by consumer advocacy groups or others and could cause our developers, creators, and users to lose trust in us, any or all of which could have an adverse effect on our business, financial condition, or results of operations.

Finally, the Organization for Economic Cooperation and Development has proposed the Pillar One framework as part of the OECD/G20 Base Erosion and Profit Shifting (BEPS) Project, which would revise existing profit allocation and nexus rules to require profit allocation based on location of sales versus physical presence for certain large multinational businesses, but if implemented, could result in the removal of unilateral digital services tax initiatives described above. Any developments or changes in federal, state, or international tax laws or tax rulings could adversely affect our compliance costs, effective tax rate, and our operating results.

With regard to our international business, we have engaged with business partners and third-party intermediaries to market our solutions and obtain necessary permits, licenses, and other regulatory approvals. We or our employees, agents, representatives, business partners or third-party intermediaries have had direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for the corrupt or other illegal activities of our employees, agents, representatives, business partners or third-party intermediaries, even if we do not authorize such activities and notwithstanding having policies, training, and procedures to address compliance with these laws, we cannot assure you that no violations of our policies or these laws will occur.

Following our risk assessments, we evaluate when and how to design, implement, and maintain reasonable safeguards to minimize the identified risks and address any identified gaps in existing safeguards, and proceed with such design, implementation, and maintenance as deemed appropriate. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (“CISO”) who reports to our Chief Technology Officer, to manage the risk assessment and mitigation process. Our CISO has served in various roles in information technology and information security for over 15 years, including leading information security initiatives and incident response at two other large public companies and serving as the Chief Security Officer for the Arkansas Department of Human Services and working for the United States Department of Defense. He has an MS in Information Assurance from the University of Advanced Technology in Arizona and a BS in Computer Science from the University of Arkansas at Little Rock.

We also engage third-party service providers in connection with our risk assessment process and certain risk management processes. Our collaboration with these third-party service providers includes threat assessments and consultation on security enhancements.

We perform risk-tiered information security risk reviews for certain third-party service providers who have access to sensitive Company, user or employee information, reviewing areas such as data protection, endpoint management and protection, phishing, business continuity, and incident response management.

We also share and receive threat intelligence with federal, state, and local government agencies, peers and other organizations, information sharing and analysis centers, and cybersecurity associations.

The Audit and Compliance Committee (the “ACC”) is central to the Board of Directors’ oversight of cybersecurity risks and has been delegated the primary responsibility for this domain. The ACC is composed of independent board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The ACC has also engaged a cybersecurity advisor to assist them in cybersecurity matters. In overseeing the Company’s cybersecurity risks and mitigation strategies, at least quarterly the CISO, members of management, and the ACC’s cybersecurity advisor, review and discuss with the ACC guidelines, practices and policies to identify, monitor, and address enterprise risks, including cybersecurity risks. The ACC then oversees and monitors management’s plans to address such risks.

Our CISO, and management committee on cybersecurity consisting of our Chief Technology Officer, General Counsel, Chief Financial Officer, and CISO, are primarily responsible for assessing and managing our material risks from cybersecurity threats and overseeing our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above. The processes by which our CISO, and our management committee on cybersecurity, are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes both manual reviews and automated reviews of our systems and data, a bug bounty program, self-reporting, participation in information sharing forums on cybersecurity, proactive education of our service providers and product and application security reviews.

In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan to guide response actions. This incident response plan includes immediate actions to mitigate the impact of the incident, long-term strategies for remediation and prevention of future incidents, and provides for internal notification of the incident functional areas (e.g. legal) as well as senior leadership and the ACC of the Board of Directors, as appropriate.

Our CISO provides briefings to the ACC at least quarterly regarding, among other topics, recent notable cybersecurity incidents, even if immaterial, and the Company’s response, cybersecurity systems testing results, the cybersecurity landscape and emerging risks and threats, compliance with regulatory requirements and industry standards.

Notwithstanding the extensive approach we take to cybersecurity, including managing associated risks, we may not be successful in managing risks from cybersecurity threats, including identifying, preventing, or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K, including the risk factors entitled “Risks Related to Our Business: If the security of our Platform is compromised, it could compromise our and our developers’, creators’, and users’ private information, disrupt our internal operations, and harm public perception of our Platform, which could cause our business and reputation to suffer.”

We lease additional office space internationally in Canada, the United Kingdom, and China. We also operate several data centers in the U.S. in Florida, Georgia, Illinois, New Jersey, Texas, Virginia, California, and Washington and around the world including in France, Germany, Hong Kong, Japan, Poland, Singapore, the Netherlands, India, Australia, and the United Kingdom pursuant to various lease agreements.

Part II

Our Class B common stock is not listed nor traded on any stock exchange, but is convertible into shares of our Class A common stock on a one-for-one basis.

As of February 1, 2024, there were 3 holders of record of our Class B common stock. All shares of our Class B common stock are beneficially owned by David Baszucki.

The performance graph below shows the cumulative total return to our stockholders between March 10, 2021 (the date that our Class A common stock commenced trading on the NYSE) through December 31, 2023, in comparison to the S&P 500 Index and the S&P 500 Information Technology Index. The graph assumes (i) that $100 was invested in our Class A common stock at its closing price on March 10, 2021 and in each of the S&P 500 Index and the S&P 500 Information Technology Index at their respective closing prices on February 28, 2021, and (ii) reinvestment of gross dividends. The stock price performance shown in the graph represents past performance and should not be considered an indication of future stock price performance.

This section of our Annual Report on Form 10-K discusses our financial condition as of and results of operations for the fiscal years ended December 31, 2023 and 2022, as well as year-to-year comparisons between fiscal years 2023 and 2022. A discussion of our financial condition as of and results of operations for the fiscal year ended 2021 and year-to-year comparisons between fiscal years 2022 and 2021 that is not included in this Annual Report on Form 10-K can be found in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in our Annual Report on Form 10-K for the year ended December 31, 2022.

Our free to use immersive platform for connection and communication consists of the Roblox Client, the Roblox Studio, and the Roblox Cloud (collectively, the “Roblox Platform” or the “Platform”). Roblox Client is the free application that allows users to explore 3D immersive experiences. Roblox Studio is the free toolset that allows developers and creators to build, publish, and operate 3D immersive experiences and other content accessed with the Roblox Client. Roblox Cloud includes the services and infrastructure that power our Platform.

Our mission is to connect a billion users with optimism and civility. We are constantly improving the ways in which our Platform supports shared experiences, ranging from how these experiences are built by an engaged community of developers and creators to how they are enjoyed and safely accessed by users across the globe.

Consistent with our free to play business model, a small portion of our users have historically been payers. For example, in the year ended December 31, 2023, of our 68.4 million DAUs, only approximately 852,000 represented our average daily unique paying users. Similarly, in the year ended December 31, 2023, our average daily bookings per DAU was $0.14, whereas our average daily bookings per daily unique paying user was $11.32. We believe that maintaining and growing our overall number of users, including the number of users who may not purchase and spend Robux, is important to the success of our business. As a result, we believe that the number of users who choose to purchase and spend Robux will continue to constitute a small portion of our overall users.

Our primary areas of investment have been, and we expect will continue to be, our developer and creator community, and the people, technology, and infrastructure required to keep improving the Roblox Platform. These areas of focus are how we drive the business and are reflected in our operating cost structure, which primarily consists of four major areas: payment processing and other fees, compensation and benefits, developer earnings, and direct infrastructure.

Below we also include revenue calculated in accordance with GAAP, the most directly comparable financial measure to bookings.

Refer to the section titled “Non-GAAP Financial Measures” for the definition of and discussion on bookings, including its limitations as a non-GAAP financial measure.

We define returning monthly unique payers as user accounts that have made a purchase on the platform, or via redemption of prepaid cards, in the current month and in any prior month. Average returning monthly unique payers for a specified period is the average of the returning monthly unique payers for each month during that period.

We define monthly repurchase rate as the returning monthly unique payers in the current month, divided by the sum of the prior month’s new monthly unique payers and returning monthly unique payers. Average monthly repurchase rate for a specified period is the average of the monthly repurchase rates for each month during that period.

We use these measures to understand our monetization across our payers through the sale of virtual currency and subscriptions.

We believe bookings provide a timelier indication of trends in our operating results that are not necessarily reflected in our revenue as a result of the fact that we recognize the majority of revenue over the estimated average lifetime of a paying user. The change in deferred revenue constitutes the vast majority of the reconciling difference from revenue to bookings. By removing these non-cash adjustments, we are able to measure and monitor our business performance based on the timing of actual transactions with our users and the cash that is generated from these transactions. Over the long-term, the factors impacting our revenue and bookings trends are the same. However, in the short-term, there are factors that may cause revenue and bookings trends to differ.

The following table presents a reconciliation of revenue, the most directly comparable financial measure calculated in accordance with GAAP, to bookings, for each of the periods presented (in thousands): 

The following table presents a reconciliation of net cash provided by operating activities, the most directly comparable financial measure calculated in accordance with GAAP, to free cash flow, for each of the periods presented (in thousands):

Acquisition of property and equipment primarily includes servers, infrastructure equipment, tenant improvements, and capitalized software licenses.

In the first quarter of 2022, we updated our estimated paying user life from 23 months to 25 months, which was subsequently updated again to 28 months in the third quarter of 2022. Based on the carrying amount of deferred revenue and deferred cost of revenue as of December 31, 2021, these changes in estimates resulted in a decrease in revenue of $344.9 million and a decrease in cost of revenue of $79.3 million during the year ended December 31, 2022.

The estimated paying user life was 28 months throughout the year ended December 31, 2023.

Refer to the heading “Critical Accounting Policies and Estimates — Revenue Recognition” below for a complete discussion on the Company’s revenue recognition policies.

Other revenue streams include an insignificant amount of revenue from advertising and licensing arrangements. We plan to invest in and expand our advertising business for the foreseeable future.

All of our revenue is recorded net of taxes assessed by a government authority that are both imposed on and concurrent with specific revenue transactions between us and our users, and estimated chargebacks and refunds.

Personnel costs generally include employee expenses (salaries, benefits, and stock-based compensation expense) and contractor expenses, and are reflected in each expense category, with the exception of cost of revenue and developer exchange fees. In the years ended December 31, 2023 and 2022, personnel costs were $1,654.9 million and $1,180.5 million, respectively.

Cost of revenue as a percentage of revenue is affected by shifts in user purchasing preferences and trends. While in recent years, we saw a shift of our sales toward prepaid card distribution channels and credit card sales directly through our website, which are subject to lower processing fees compared to other distribution channels, such as the Apple App Store, Google Play Store, and consoles such as Xbox and PlayStation, we have seen this trend moderate over the last several quarters. We expect to see the overall distribution channel mix shift to higher processing fees continue in future periods with some seasonal variations.

We intend to use nearly all of any efficiencies earned in this area over time to increase earnings for our developers and creators.

In order to be qualified for our Developer Exchange Program and eligible to exchange earned Robux for real-world currency, developers and creators must meet certain conditions, such as having earned the minimum amount of Robux required to qualify for the program, a verified developer account, and an account in good standing. On January 31, 2022, we reduced the minimum amount of earned Robux required to qualify for the program from 100,000 Robux to 50,000 Robux and subsequently on January 31, 2023, we further reduced the minimum requirement from 50,000 Robux to 30,000 Robux. We believe these reductions in the minimum amounts required incentivize our developer and creator community, and promote the long term growth and the health of such community. As of December 31, 2023, over 16,500 developers and creators qualified for and were registered in our Developer Exchange Program.

Over the next few years, a major goal is to increase our developer and creator earnings by creating new earnings methods and enhancing existing ones, as well as through efficiencies realized in other areas of our business, while maintaining reasonable margins.

We plan to continue increasing the capacity, capability, and reliability of our infrastructure to support more sophisticated content, more users, and increased engagement. We expect to moderate our investment in infrastructure in fiscal year 2024, but generally expect to increase the dollar amount of our investment in infrastructure for the foreseeable future thereafter as we continue to build out our global infrastructure. We intend to achieve scalability by building and maintaining our own technical infrastructure, while generally generating operating leverage over the long-term.

Revenue

Revenue in the year ended December 31, 2023 increased $574.2 million, or 26%, compared to the year ended December 31, 2022. The increase is primarily due to a higher amortization of prior period deferred revenue and an increase in bookings in the current period. The increase in bookings was primarily driven by a higher average number of daily unique paying users during 2023, which increased from approximately 725,000 in 2022 to approximately 852,000 in 2023. The average number of daily unique paying users represents the number of user accounts that made a purchase on the Platform, including via redemption of prepaid cards for Robux, on an average daily basis during the respective period. The overall increase in revenue was offset by a longer average estimated paying user life during 2023 as compared to 2022 (during which the estimated paying user life increased from 23 months as of December 31, 2021 to 28 months by the third quarter of 2022).

Refer to the heading “Change in Accounting Estimate” earlier in this section for more information on the change in paying user life estimates in fiscal year 2022.

Cost of revenue increased $101.5 million, or 19%, for the year ended December 31, 2023 compared to the year ended December 31, 2022. The increase is primarily due to a net increase of $99.9 million in expense for payment processing fees, primarily driven by a higher amortization of prior period deferred cost of revenue and an increase in current period payment processing fees from the related growth in bookings. The overall increase in expense for payment processing fees was offset by the aforementioned increases in our estimated paying user life – as payment processing fees are also amortized over the estimated paying user life – as well as a shift of our sales toward distribution channels with lower processing fees.

Refer to the heading “Change in Accounting Estimate” earlier in this section for more information on the change in paying user life estimates in fiscal year 2022.

Developer exchange fees increased $116.9 million, or 19%, for the year ended December 31, 2023 compared to the year ended December 31, 2022. The increase is primarily driven by an increase in amounts earned by developers and creators due to the growth in bookings over the same period. However, the growth in bookings exceeded the growth in developer exchange fees, primarily driven by changes in non-USD pricing, which impacts the amount of developer exchange fees incurred.

Infrastructure and trust & safety expenses increased $189.3 million, or 27%, for the year ended December 31, 2023 compared to the year ended December 31, 2022. The increase is primarily driven by an increase of $89.0 million related to data center, hosting, and other hardware and software costs (including depreciation and amortization expense). The increase was further driven by an increase of $66.5 million in personnel costs, which includes an increase of $36.0 million in stock-based compensation expense, primarily due to an increase in headcount to support our infrastructure growth. Finally, the increase was supplemented by an increase of $24.0 million in moderation and customer support related costs.

Research and development expenses increased $380.1 million, or 44%, for the year ended December 31, 2023 compared to the year ended December 31, 2022. The increase is primarily due to an increase of $333.3 million in personnel costs, which includes an increase of $208.7 million in stock-based compensation expense, primarily due to continued growth in headcount supporting our engineering, design, and product teams. The increase was further supplemented by an increase of $25.6 million in facilities-related costs, primarily driven by higher rent expense associated with our office leases.

General and administrative expenses increased $92.7 million, or 31%, for the year ended December 31, 2023 compared to the year ended December 31, 2022. The increase is primarily due to an increase of $56.7 million in personnel costs, which includes an increase of $22.0 million in stock-based compensation expense, primarily due to increased headcount. The increase was further driven by an increase of $10.4 million in professional services expenses and $9.5 million of withholding-related taxes. The increase was also supplemented by an impairment charge of $7.0 million related to the operating lease right-of-use asset and related leasehold improvements of a portion of our San Mateo headquarters for which a sub-lease agreement was executed during the first quarter of 2023. For more information regarding the sub-lease transaction, refer to Note 3, “Leases” to the notes to consolidated financial statements.

Sales and marketing expenses increased $29.0 million, or 25%, for the year ended December 31, 2023 compared to the year ended December 31, 2022. The increase is primarily due to $17.9 million in personnel costs, which includes an increase in stock-based compensation expense of $11.9 million, primarily due to continued growth in headcount to support our sales and marketing teams, as well as an increase of $7.2 million in advertising and promotional expenses.

Interest income increased by $103.0 million for the year ended December 31, 2023 compared to the year ended December 31, 2022. The increase was primarily due to rising interest rates.

Interest expense was relatively flat for the year ended December 31, 2023 compared to the year ended December 31, 2022.

Other income/(expense), net changed by $5.2 million for the year ended December 31, 2023 compared to the year ended December 31, 2022. The change was primarily driven by a $5.0 million business interruption insurance recovery recognized during the second quarter of 2023 related to a fourth quarter 2021 Platform outage.

Provision for/(benefit from) income taxes changed by $(3.1) million for the year ended December 31, 2023 as compared to prior year ended December 31, 2022. The change was primarily due to a decrease in state income tax expense in certain states.

Since our inception, we have financed our operations primarily through cash generated from operations and, to a lesser extent, sales of convertible preferred stock, borrowings under our credit facilities, and the sale of our 2030 Notes. We require payment upfront for substantially all of our bookings.

On October 29, 2021, we issued the 2030 Notes, which will mature on May 1, 2030, unless earlier repurchased or redeemed. Interest is payable semi-annually in arrears on May 1 and November 1 of each year, commencing on May 1, 2022. The net proceeds from the 2030 Notes issuance were approximately $987.5 million and we intend to use the net proceeds for general corporate purposes, which may include working capital purposes, capital expenditures, and acquisitions.

The 2030 Notes are unsecured obligations and the Indenture contains covenants limiting the Company and its subsidiaries’ ability to: (i) create certain liens and enter into sale and lease-back transactions; (ii) create, assume, incur or guarantee indebtedness; or (iii) consolidate or merge with or into, or sell or otherwise dispose of all of substantially all of the Company and its subsidiaries’ assets to another person, all of which are limited to amounts not to exceed the greater of $4.0 billion and 3.5x “Consolidated EBITDA” (as defined in the Indenture and referred to as “Covenant Adjusted EBITDA” throughout this section). Non-compliance with these covenants may result in the acceleration of repayment of the 2030 Notes and any accrued and unpaid interest.

Accordingly, the Company presents Covenant Adjusted EBITDA calculated in accordance with “Consolidated EBITDA” as that term is defined in the Indenture, which is not calculated in accordance with GAAP and may not conform to the calculation of Adjusted EBITDA by other companies. Covenant Adjusted EBITDA should not be considered as a substitute for a measure of our financial performance or other liquidity measures prepared in accordance with GAAP and is also not indicative of income or loss calculated in accordance with GAAP. Management believes that this calculation is useful to investors for purposes of analyzing our compliance with certain covenants specified in the Indenture.

The following table presents the calculation of Covenant Adjusted EBITDA in accordance with the terms of the Indenture, for each of the periods presented (in thousands): 

As of December 31, 2023, contractual obligations related to the 2030 Notes are remaining payments of $38.8 million each year from 2024 through 2029 and $1,019.4 million due in 2030. These amounts represent principal and interest cash payments over the term of the 2030 Notes based on the stated maturity date. Any future redemption of the 2030 Notes could impact the amount or timing of our cash payments. For more information regarding the 2030 Notes, refer to Note 8, “Debt” to the notes to consolidated financial statements.

For all periods presented, we have generated losses from our operations and positive cash flows from operating activities. A substantial source of our cash provided by operating activities is our deferred revenue, which is included in our consolidated balance sheet as a liability. Deferred revenue consists of the unearned portion of bookings for which we have not yet satisfied our performance obligation. Our deferred revenue obligation is recognized as revenue over the estimated average lifetime of a paying user or as the virtual items are consumed.

We also expect to continue making investments in our business, including, but not limited, capital expenditures related to our technology infrastructure.

We believe our existing cash and cash equivalents and short-term investments, together with expected cash to be provided by future operations, will be sufficient to meet our needs for the next 12 months. Our future capital requirements, however, will depend on many factors, including our growth rate, investment in our headcount, capital expenditures to build out new facilities and purchase hardware for infrastructure, timing and extent of spending to support our efforts to develop our Platform, and the effects of inflation on these various expenses, amongst other factors. We may in the future enter into arrangements to acquire or invest in complementary businesses, services, and technologies, including intellectual property rights. In the event that additional financing is required from outside sources, we may seek to raise additional funds at any time through equity, equity-linked arrangements, or debt. If we are unable to raise additional capital when desired and at reasonable rates, our business, results of operations, and financial condition would be adversely affected. See Part 1, Item 1A. “Risk Factors” for more information.

During the year ended December 31, 2023, cash and cash equivalents provided by operating activities was $458.2 million, which consisted of a consolidated net loss of $1,158.9 million, adjusted by non-cash charges of $1,110.3 million and net cash inflows from the change in net operating assets and liabilities of $506.8 million. The non-cash charges were primarily comprised of stock-based compensation of $868.0 million and depreciation and amortization of $208.1 million. The net cash and cash equivalent inflows from the change in our net operating assets and liabilities were primarily due to a $742.3 million increase in deferred revenue, primarily due to bookings generated in the current period, and a $83.2 million increase in our developer exchange liability, primarily driven by the increase in bookings generated in the current period, coupled with the timing of payments. The overall increase was offset by a $139.9 million increase in deferred cost of revenue, primarily due to payment process fees associated with bookings generated in the current period, a $126.2 million increase in our accounts receivable balance, net due to the timing of cash receipts on bookings generated in the current period and a $50.5 million decrease in our operating lease liabilities.

Our other purchase obligations primarily consist of non-cancellable obligations with our data center hosting providers and software vendors. As of December 31, 2023, we had other purchase obligations of $459.8 million, with $223.2 million payable within 12 months. For more information regarding our contractual obligations, refer to Note 9, “Commitments and Contingencies” to the notes to consolidated financial statements.

An accounting policy is considered to be critical if it requires an accounting estimate to be made based on assumptions about matters that are highly uncertain at the time the estimate is made, and if different estimates that reasonably could have been used, or changes in the accounting estimates that are reasonably likely to occur periodically, could materially impact the consolidated financial statements.

Refer to Note 1, “Overview and Summary of Significant Accounting Policies”, to our consolidated financial statements included in this Annual Report on Form 10-K for a full description of our revenue recognition and stock-based compensation expense policies.

The Company derives substantially all of its revenue from the sale of virtual items on the Roblox Platform.

Users can purchase Robux as one-time purchases or through monthly subscriptions via payment processors or through prepaid cards. Payments from users are non-refundable and relate to non-cancellable contracts for a fixed price that specify Company’s obligations. Revenue is recorded net of taxes assessed by government authorities that are both imposed on and concurrent with specific revenue transactions between the Company and its users, and estimated chargebacks and refunds.

The satisfaction of the Company’s performance obligation is dependent on the nature of the virtual item purchased and as a result, the Company categorizes its virtual items as either consumable or durable.

To separately account for consumable and durable virtual items, the Company specifically identifies each purchase for the majority of virtual items purchased on the Roblox Platform. For the remaining population, the Company estimates the amount of consumable and durable virtual items purchased based on data from specifically identified purchases and the expected behavior of the users within similar experiences. The estimation of consumable and durable virtual items purchased for the population of purchases not specifically identified requires management’s judgment as the Company evaluates and estimates the expected behavior of users in the population using information from known purchases in similar experiences.

The average lifetime of a paying user estimate is calculated based on historical monthly retention data for each user cohort to project future participation on the Roblox Platform. Determining the estimated average lifetime of a paying user requires management’s judgment as the Company analyzes the most recent trends in player cohort activity and other qualitative factors, including paying user behavior (e.g. impacts due to macroeconomic factors such as COVID-19), existing and new competition from a variety of entertainment resources for our users, the availability of the Roblox Platform across markets and user demographics, and other factors. The Company also considers results from prior analyses in determining the estimated average lifetime of a paying user. The Company believes this estimate is the best representation of the average life of the durable virtual items. The estimated paying user life was 28 months, 28 months, and 23 months as of December 31, 2023, 2022, and 2021, respectively. The increase in the estimated average lifetime of a paying user from 23 months as of December 31, 2021 to 28 months as of December 31, 2022 was in part attributable to the change in our paying users’ behavior as a result of the shelter-in-place and similar restrictions due to the COVID-19 pandemic, as these restrictions led to increased developer, creator, and user engagement and user experiences on the Roblox Platform relative to historical trends. Further we believe the improved content created by our developers and creators, the multitude and variety of experiences available to our users, and the way our users interacted with their peers and social network on the Roblox Platform in recent years resulted in an increase in the retention period of our paying users. Refer to the heading “Change in Accounting Estimate” for discussion on the quantitative amount of the change in accounting estimates for the respective periods impacted.

The Company offers prepaid cards through online and physical retailers, as well as on the Company website. The Company estimates expected breakage by taking into consideration historical patterns of redemption and escheatment laws as applicable.

The fair value of RSUs is estimated based on the fair value of our common stock on the date of grant. Prior to the Direct Listing, we estimated the fair value of Class A common stock, as discussed below in the section titled “Common Stock Valuations.” For RSUs granted subsequent to the Direct listing, the fair value of our Class A common stock is determined based on the NYSE closing price on the date of grant.

We also considered any secondary transactions involving our capital stock. In our evaluation of those transactions, we considered the facts and circumstances of each transaction to determine the extent to which they represented a fair value exchange. Factors considered include transaction volume, timing, whether the transactions occurred among willing and unrelated parties, and whether the transactions involved investors with access to our financial information.

We do not enter into investments for trading or speculative purposes. Our investment policy and strategy are focused on the preservation of capital and supporting our liquidity requirements.

In October 2021, we issued $1.0 billion aggregate principal amount of the 2030 Notes. The 2030 Notes were issued at par and we incurred approximately $12.5 million in debt issuance costs. Interest on the 2030 Notes is payable semiannually in arrears on May 1 and November 1 of each year, beginning on May 1, 2022, and the entire outstanding principal amount of the 2030 Notes is due at maturity on May 1, 2030. The 2030 Notes have a fixed interest rate; therefore, we have no financial statement risk associated with changes in interest rates with respect to the 2030 Notes. Additionally, on our balance sheet we carry the 2030 Notes at face value less unamortized discount and debt issuance cost, and we present the fair value for disclosure purposes only. The fair value of our 2030 Notes will fluctuate with movements in interest rates, increasing in periods of declining rates of interest and declining in periods of increasing rates of interest.

ROBLOX CORPORATION

We have audited the accompanying consolidated balance sheets of Roblox Corporation and subsidiaries (the “Company”) as of December 31, 2023 and 2022, the related consolidated statements of operations, comprehensive income/(loss), convertible preferred stock and stockholders’ equity/(deficit), and cash flows, for each of the three years in the period ended December 31, 2023, and the related notes (collectively referred to as the “financial statements”). In our opinion, the financial statements present fairly, in all material respects, the financial position of the Company as of December 31, 2023 and 2022, and the results of its operations and its cash flows for each of the three years in the period ended December 31, 2023, in conformity with accounting principles generally accepted in the United States of America.

These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on the Company’s financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion.

The critical audit matter communicated below is a matter arising from the current-period audit of the financial statements that was communicated or required to be communicated to the Audit and Compliance Committee and that (1) relates to accounts or disclosures that are material to the financial statements and (2) involved especially challenging, subjective, or complex judgments. The communication of critical audit matters does not alter in any way our opinion on the financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the accounts or disclosures to which it relates.

The Company derives substantially all of its revenue from the sale of virtual items on the Roblox platform. The Company’s performance obligation when selling virtual items to users is to provide those users with the ability to acquire, use, and hold virtual items on the Roblox platform over the estimated period of time the virtual items are available to the user, which is estimated as the average lifetime of a paying user (“customer life” for durable virtual items) or until the virtual items are consumed (for consumable virtual items). To separately identify, and account for consumable and durable virtual items, the Company specifically categorizes each purchase for the majority of virtual items purchased on the Roblox platform. For the remaining population, the Company estimates the amount of consumable and durable virtual items purchased based on data from specifically categorized purchases and the expected behavior of the users within similar experiences.

Significant judgement is exercised by management when (1) estimating the customer life, which includes analyzing the most recent trends in player cohort activities and (2) estimating the amount of consumable and durable virtual items purchased for the remaining population of purchases that are not specifically categorized (“remaining population allocation”), which includes evaluating and estimating the expected behavior of users in the population using information from known purchases in similar experiences.

Given the complexity of estimating the customer life and the remaining population allocation, auditing these estimates required a high degree of auditor judgement and increased extent of effort when performing audit procedures to evaluate the Company’s judgements and conclusions.

Our audit procedures related to the Company’s estimated customer life and remaining population allocation included the following, among others:

February 21, 2024

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended December 31, 2023, of the Company and our report dated February 21, 2024, expressed an unqualified opinion on those financial statements.

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management’s Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

February 21, 2024

ROBLOX CORPORATION

ROBLOX CORPORATION

_______________

ROBLOX CORPORATION

ROBLOX CORPORATION

ROBLOX CORPORATION

ROBLOX CORPORATION

The Company derives substantially all of its revenue from the sale of virtual items on the Roblox Platform.

Roblox Platform

Users can purchase Robux as one-time purchases or through monthly subscriptions via payment processors or through prepaid cards. Payments from users are non-refundable and relate to non-cancellable contracts for a fixed price that specify Company’s obligations. Revenue is recorded net of taxes assessed by government authorities that are both imposed on and concurrent with specific revenue transactions between the Company and its users, and estimated chargebacks and refunds.

The satisfaction of the Company’s performance obligation is dependent on the nature of the virtual item purchased and as a result, the Company categorizes its virtual items as either consumable or durable.

To separately account for consumable and durable virtual items, the Company specifically identifies each purchase for the majority of virtual items purchased on the Roblox Platform. For the remaining population, the Company estimates the amount of consumable and durable virtual items purchased based on data from specifically identified purchases and the expected behavior of the users within similar experiences. The estimation of consumable and durable virtual items purchased for the population of purchases not specifically identified requires management’s judgment as the Company evaluates and estimates the expected behavior of users in the population using information from known purchases in similar experiences.

The average lifetime of a paying user estimate is calculated based on historical monthly retention data for each user cohort to project future participation on the Roblox Platform. Determining the estimated average lifetime of a paying user requires management’s judgment as the Company analyzes the most recent trends in player cohort activity and other qualitative factors, including paying user behavior (e.g. impacts due to macroeconomic factors such as COVID-19), existing and new competition from a variety of entertainment resources for our users, the availability of the Roblox Platform across markets and user demographics, and other factors. The Company also considers results from prior analyses in determining the estimated average lifetime of a paying user. The Company believes this estimate is the best representation of the average life of the durable virtual items. The estimated paying user life was 28 months, 28 months, and 23 months as of December 31, 2023, 2022, and 2021, respectively.

As part of the process above, in the first quarter of 2022, the Company updated its estimated paying user life from 23 months to 25 months, which was subsequently updated again to 28 months in the third quarter of 2022, where it stayed for the entire year ended December 31, 2023. Based on the carrying amount of deferred revenue and deferred cost of revenue as of December 31, 2021, these changes in estimates resulted in a decrease in revenue of $344.9 million and a decrease in cost of revenue of $79.3 million during the year ended December 31, 2022.

The Company offers prepaid cards through online and physical retailers, as well as on the Company website. The Company estimates expected breakage by taking into consideration historical patterns of redemption and escheatment laws as applicable.

Principal Agent Considerations

Other Revenue

The Company uses various distribution channels to collect and remit payments from users. As of December 31, 2023 and 2022, one distribution channel accounted for 30% and 37% of our accounts receivable, respectively, while a second distribution channel accounted for 26% and 19% of our accounts receivable, respectively.

For the years ended December 31, 2023, 2022, and 2021, one distribution channel processed 30%, 32%, and 35% of our overall revenue transactions, respectively, and a second distribution channel processed 17%, 18%, and 19% of our overall revenue transactions, respectively.

In determining fair value, the Company utilizes valuation techniques that maximize the use of observable inputs and minimize the use of unobservable inputs to the extent possible as well as considers counterparty credit risk in its assessment of fair value.

We had no restricted cash balances as of December 31, 2023 and 2022.

Debt Securities

For debt securities in an unrealized loss position, we first consider whether we intend to or it is more likely than not that we will be required to sell the individual security prior to recovery of its amortized cost basis and if so, we adjust the carrying value of security down to its fair value, with the amount of the write-down recorded as a realized loss within other income/(expense), net.

Otherwise, we determine whether a decline in fair value is attributable to a partial or full credit loss by reviewing factors such as the extent to which the fair value is less than the amortized cost basis, changes in interest rates since the purchase of the security, the financial condition of the issuer, including changes in credit ratings, the remaining payment terms of the security, as well as any adverse conditions specifically related to the security, the issuer’s industry or its geographic area. If a credit loss exists, we adjust the carrying value by recording expense within other income/(expense), net equal to the amount of the credit loss, with such amount limited to the amount of the unrealized loss. Subsequent recoveries of fair value originally attributed to a credit loss are subsequently recognized as income within other income/(expense), net. Finally, any unrealized loss not deemed to be attributable to a credit loss is recognized as component of other comprehensive income/(loss), net of tax.

For purposes of identifying and measuring credit losses, the Company excludes any related accrued interest from both the fair value and amortized cost basis of the investment. Accrued interest receivable, net of the allowance for credit losses (if any), is recorded as a component of prepaid expenses and other current assets in our consolidated financial statements.

Equity Securities with Readily Determinable Fair Value

The Company accounts for a transaction as an asset acquisition when substantially all of the fair value of the gross assets acquired is concentrated in a single identifiable asset or group of similar identifiable assets, or otherwise does not meet the definition of a business. Asset acquisition-related costs are capitalized as part of the asset or assets acquired.

Significant judgment is required to estimate the amount and timing of future cash flows and the relative risk of achieving those cash flows. Assumptions and estimates about future values and remaining useful lives are complex and often subjective. They can be affected by a variety of factors, including external factors such as industry and economic trends, and internal factors such as changes in the Company’s business strategy and internal forecasts.

The Company recognizes the expense associated with the Developer Exchange Program as Robux are earned by developers and creators that are qualified and registered in the Developer Exchange Program.

For all years presented, basic net loss per share is computed by dividing net loss attributable to common stockholders by the weighted-average number of shares of common stock outstanding during the period. Diluted net loss per share is computed by giving effect to all potentially dilutive common stock equivalents to the extent they are dilutive. For purposes of this calculation, convertible preferred stock, stock options, RSUs, RSAs, convertible preferred stock warrants, and common stock warrants, as applicable, are considered to be common stock equivalents but have been excluded from the calculation of diluted net loss per share attributable to common stockholders as their effect is anti-dilutive for all periods presented.