Roku

Roku

Basic information
Founded	2002
Legal Structure	Public
Industry	Media Streaming
Also known as
Official website	https://roku.com/

Roku, Inc. is an American technology company, founded in 2002, known for its "Roku" line of streaming players & Smart TVs and for Roku OS, the operating system that powers its devices. In early 2024, Roku pushed an updated set of Dispute Resolution Terms to existing customers as an accept-only on-screen notice that made a television or streaming player unusable until the user tapped "Agree," with no option to decline and an opt-out available only by mailing a written notice to the company's general counsel. Within weeks, Roku disclosed two credential stuffing data breaches: a first incident affecting 15,363 accounts and a second affecting more than 576,000, in which attackers took over accounts and used stored payment methods to make fraudulent purchases.

On June 15, 2026, Fox Corporation announced an agreement to acquire Roku for about $22 billion, a transaction the companies said they expected to close in the first half of 2027.

Consumer impact summary

Overview of concerns that arise from the conduct towards users of the product (if applicable):

• User freedom
• User privacy
• Business model
• Market control

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

User privacy

• Roku collects personal information such as the user's device information, usage data, viewing activity, and location data.
• This data is used for purposes such as providing and improving services, personalizing content, and targeted advertisements.
• Roku retains personal data for as long as needed to fulfill the purposes for which it was collected.
• On many of its devices and services, Roku treats the "sale" of personal information as opt-out rather than opt-in; users exercise the opt-out through Roku's Your Privacy Choices page or the Privacy section of the device Settings menu.

Transparency

• In early 2024, Roku required existing customers to accept updated Dispute Resolution Terms through an on-screen notice that offered no way to decline; Roku said the change was not related to its data breaches.

Incidents

This is a list of all consumer-protection incidents this company is involved in. Any incidents not mentioned here can be found in the Roku category.

"HDMI-customized ad insertion" patent (2023)

In 2023, Roku filed a patent (US20230388589A1) for a system to insert advertisements over the display output of any non-Roku device connected to a Roku TV. The system would detect when a viewer paused a video feed and display an advertisement personalized using data collected through Roku services.

A related Roku feature, "More Ways to Watch," uses automatic content recognition to identify what is playing on connected devices and to suggest streams and target ads.

Post-purchase EULA modification (2024)

The on-screen notice Roku showed existing customers in early 2024. The only button is "Agree"; there is no option to decline.

In early 2024, Roku modified its Dispute Resolution Terms and pushed them to existing customers through a full-screen message on their televisions and streaming players. The updated terms took effect on February 20, 2024, and by early March the notice was appearing on devices and blocking their use until the customer agreed. TechCrunch's Devin Coldewey, who documented the rollout on March 5, 2024, wrote that [t]here was no accessing the device without agreeing to the new terms.

The notice allowed a customer to accept the terms but offered no button to decline. The only way to opt out was to mail a written notice to Roku's general counsel within 30 days of the terms taking effect, addressed to Stephen Kay, General Counsel, Roku, Inc., in San Jose, California, listing the customer's name, contact information, the email used to register the Roku account, and the product "at issue." A forced arbitration agreement barring customers from suing Roku or joining lawsuits against it was already part of Roku's terms; what the 2024 update added was an "Informal Dispute Resolution" step requiring anyone with a legal complaint to first bring it to Roku's lawyers in a "Meet-and-Confer" call. Writing about the change, Gizmodo's Lucas Ropek said the agreement compelled users to accept forced arbitration and that, for companies, the benefit of forced arbitration is that they can avoid class-action lawsuits.

Roku's terms let customers opt out only by mailing a written notice to General Counsel Stephen Kay in San Jose, California.

The terms update and the breach disclosures fell within the same weeks. The updated terms took effect on February 20, 2024, and the accept-only notice began disabling devices in early March 2024; Roku disclosed the first of two credential-stuffing breaches in early March 2024, and its security team had detected that intrusion between January 4 and February 21, 2024. On March 11, 2024, BleepingComputer reported that a source told it the new Dispute Resolution Terms were in part related to the ongoing credential-stuffing attacks and financial fraud; after the article was published, Roku disputed this and stated that the new terms were not related to the hacked accounts.

2024 credential-stuffing data breaches

In March and April 2024, Roku disclosed two data breaches caused by credential stuffing, a technique in which attackers try username and password pairs stolen from unrelated third-party breaches against a target site. In a breach notice filed with the offices of the Maine and California Attorneys General, Roku said its security team detected the intrusion between January 4 and February 21, 2024, and determined that unauthorized actors had accessed accounts between December 28, 2023, and February 21, 2024; the Maine filing put the number affected at 15,363 customers.

Once an account was taken over, the attackers could change its password, email address, & shipping address, which locked out the legitimate owner and let the attackers use stored credit-card information to make purchases without the owner receiving order-confirmation emails. BleepingComputer reported that hijacked Roku accounts were sold on stolen-account marketplaces for as little as 50 cents each, and that buyers used the stored cards to purchase cameras, remotes, soundbars, & streaming boxes. Roku said it secured the affected accounts, forced a password reset, & moved to cancel fraudulent subscriptions and refund affected account holders; at the time, Roku did not support two-factor authentication.

The BleepingComputer report showed a marketplace offering hundreds of hijacked Roku accounts at about 50 cents each.

On April 12, 2024, Roku disclosed a second, larger breach affecting more than 576,000 accounts, again through credential stuffing. Roku said that across the two incidents there were fewer than 400 cases in which attackers made unauthorized purchases of streaming subscriptions & Roku hardware, and that the attackers did not gain access to full credit-card numbers or other full payment information. After the second incident, Roku enabled two-factor authentication for all accounts, including those not affected by either breach.

Security Affairs reported Roku's disclosure that a second breach compromised 576,000 accounts through credential stuffing.

Auto-playing ads before the home screen (2025)

In March 2025, reports surfaced that Roku was testing an advertising feature that played video ads before users could reach the Roku OS home screen. Users reported that when turning on a Roku TV or streaming device, they were shown a video advertisement, often for the movie Moana 2, before reaching the home screen; some found an option to skip the ad, while others reported no clear way to bypass it.

A Roku spokesperson confirmed that the auto-playing ads were part of a test but did not say whether they would become permanent, and said the company's business model relies on continuous testing in advertising. The report followed Roku's earlier patent for technology that could overlay ads on third-party devices connected to a Roku TV.

Antenna channels blocked without an internet connection (2026)

A Roku TV OS update combined the over-the-air (OTA) broadcast live-TV guide with free streams from The Roku Channel. Cord Cutters News reported that the change left OTA channels received through an antenna unreachable when the television had no internet connection, blocking free access to local ABC, CBS, FOX, & NBC broadcasts, and that on March 23, 2026, Roku announced a fix for what it described as a bug.

Products and services

Roku's products are streaming media players, licensed Roku TV sets, & the Roku OS software platform.

Streaming players

The streaming-player lineup includes the Roku Streaming Stick, the Streaming Stick Plus, the Streaming Stick 4K, the higher-end Roku Ultra, & the Roku Streambar SE.

Roku TV

In 2014, Roku began licensing its operating system to television manufacturers, creating the Roku TV platform; the first Roku TV sets, built by TCL & Hisense, began shipping that year.

Roku OS

Roku OS is the operating system that powers Roku devices; it provides universal search across streaming services & a home screen for switching between apps and connected devices.

Content and advertising

Roku earns revenue from licensing its operating system to television manufacturers & from advertising on its devices. In 2025, after years of unprofitability, Roku reported its first full-year profit, with net income of $88.4 million on revenue of $4.74 billion.

See also

• Amazon Fire TV
• Disney+
• HBO Max
• Netflix