Roblox Safeguards Failed to Stop Adults Contacting Children, Regulator Says

Australia’s online safety regulator says testing of Roblox found gaps that still allowed adult strangers to make contact with children, despite a series of safety changes introduced by the gaming platform.

The eSafety Commissioner announced on Aug. 20 that it had accepted a court-enforceable undertaking from Roblox, requiring the company to introduce additional protections for Australian users under 16 within three months.

The regulator said its testing found that adults could send connection requests to young Australian children without parental or carer consent. It also found that adults and children could interact in some forum posts, while children’s profiles and connection lists remained visible across the platform.

Roblox maintains that it is complying with its obligations under Australia’s Online Safety Act but has agreed to the additional measures.

Read eSafety’s official Roblox enforcement announcement.

What Australia’s Regulator Found

eSafety said it had been engaging with Roblox for roughly two years over child-safety protections and compliance with Australian online safety requirements.

Earlier in 2026, the regulator directly tested safeguards Roblox had introduced for younger users.

The testing identified several specific gaps.

According to eSafety, adults were still able to send connection requests to young Australian children without approval from a parent or carer.

Children and adults could also view and respond to each other’s posts on forums outside game environments without parental consent.

The regulator found that a child’s Roblox connections could be visible to anyone on the platform.

Profiles belonging to children could also expose information such as an account name, avatar, connection numbers and names, and non-sensitive biographical details, including interests. eSafety said users did not have an option to restrict the visibility of all of this information.

The findings do not mean eSafety determined that every adult-child interaction involved grooming or abuse. The regulator’s concern is that the platform architecture created opportunities for unknown adults to reach children despite safeguards intended to reduce that risk.

Roblox Has Three Months to Make Changes

The agreement with eSafety is not simply a voluntary promise.

It is a court-enforceable undertaking.

Roblox has committed to preventing adults from contacting unknown children without parental consent and strengthening privacy settings so children’s accounts are private by default.

The company must also provide accessible reporting systems that tell users what happened after a complaint was submitted.

Another requirement is particularly significant: Roblox must appoint an independent third-party auditor to evaluate the effectiveness of its safety measures, including its age-estimation technology.

eSafety Commissioner Julie Inman Grant said this is the first time third-party auditing has been required through an undertaking under Australia’s Online Safety Act.

Roblox has three months to implement the agreed changes.

If it breaches the undertaking, eSafety can apply to Australia’s Federal Court for an order requiring compliance and potentially seek other orders available to the court.

Roblox Had Already Introduced Major Safety Changes

The regulatory action comes after Roblox made substantial changes to the way younger users communicate on the platform.

In January, Roblox expanded mandatory age checks for chat globally.

Users who want access to communication features must complete an age check. Roblox uses facial age estimation or, for eligible users, identification-based verification to place people into age groups.

Roblox says the system is intended to limit communication between adults and children younger than 16.

Read Roblox’s official age-check announcement.

The platform places age-checked users into groups such as under 9, 9 to 12, 13 to 15, 16 to 17, 18 to 20 and 21 or older.

Normal chat is generally limited to users in similar age ranges, although Roblox also provides Trusted Connections for people who know each other.

Roblox says users who have not completed an age check cannot use chat features.

New Roblox Kids and Select Accounts Added More Controls

Roblox introduced another layer of protections in June with the global launch of Roblox Kids and Roblox Select accounts.

Roblox Kids is designed for users ages 5 through 8, while Roblox Select is designed for users ages 9 through 15.

The company says these account types restrict younger users to age-appropriate games and provide parents with more control over communications and content.

See Roblox’s official Kids and Select account announcement

Chat remains disabled by default for the youngest users, and age checks are required before communication features can be used.

Parents can also adjust standard chat settings for children until they turn 16.

Those protections address communication inside Roblox, but eSafety’s testing suggests there were still gaps elsewhere in the broader account and social system.

That distinction helps explain why the regulator remained concerned even after Roblox introduced age-based chat.

Age Verification Alone Does Not Solve the Problem

Roblox has invested heavily in age estimation as a safety measure.

The company uses facial age-estimation technology and says images and video submitted during the process are deleted after processing.

Roblox says third-party testing of its age-estimation technology produced a mean absolute error within 1.4 years for users under 18. The company also acknowledges that age estimation is not perfect.

Read Roblox’s explanation of its age-estimation system

The Australian regulator’s action illustrates why accurately estimating age is only one part of child safety.

A platform also needs to determine what adults and children can see about one another, who can initiate connections, where communication is allowed and what role parental consent plays.

An accurate age estimate has limited value if account settings still allow an unknown adult to reach a child through another feature.

The required independent audit will therefore examine not only whether Roblox can estimate ages but also whether the safeguards built around those age estimates work as intended.

Private-by-Default Accounts Are a Key Requirement

Australia’s Relevant Electronic Services Standard applies to services including online gaming platforms.

According to eSafety, the standard requires children’s accounts to be private by default and requires platforms to provide accessible reporting mechanisms that notify users about complaint outcomes.

eSafety said its concerns included whether Roblox had sufficient measures in place to prevent contact between adults and children under 16.

The new undertaking specifically requires Roblox to strengthen its child-account settings to satisfy those protections.

Private-by-default design can reduce exposure without requiring a child or parent to manually find and change several privacy settings.

That approach is increasingly important on platforms where children and adults use the same service.

Roblox Says Safety Is Built Around Age

Roblox presents its current safety model as an age-based system rather than one universal set of settings for every user.

Its Safety Centre says younger users receive more controlled account types, age-appropriate content restrictions and additional parental controls.

Visit the official Roblox Safety Centre.

The company also says Roblox chat does not allow users to share images or videos directly. That chat is not end-to-end encrypted, allowing the platform to monitor conversations for prohibited content.

Roblox has described mandatory age checks as part of a broader effort to make communication between adults and children more difficult.

The company’s position in the Australian matter is that it meets its obligations under the Online Safety Act.

By accepting the undertaking, however, Roblox has agreed to implement additional protections beyond its current system.

Australian Authorities Have Been Examining Roblox for Months

The Aug. 20 action follows months of pressure from Australian officials.

Government records show that authorities had raised concerns about reports involving grooming, child sexual exploitation, sexually explicit material and other harmful content accessible through Roblox.

eSafety was already monitoring Roblox before those concerns intensified and began directly testing the implementation of the company’s safety commitments earlier this year.

In April, eSafety also issued transparency notices to Roblox and several other major gaming services, asking them to explain how they protect children against child sexual exploitation and abuse material, violent content, cyberbullying and online hate.

The regulator says a broader report based on those transparency notices is expected later in 2026.

The Independent Audit Could Be the Most Important Part

Roblox has announced many safety changes over the past year, including age checks, age-based communication, additional parental controls and separate account systems for younger users.

The Australian action shifts the question from what features Roblox says it has built to whether those features actually work.

An external auditor will now evaluate the effectiveness of the safeguards.

That could include examining whether age-estimation systems reliably place users into appropriate categories, whether adults can bypass restrictions, whether children’s accounts default to sufficiently private settings and whether parental consent requirements operate consistently.

For eSafety, independent verification is central to the agreement.

The regulator said platforms cannot simply assess their own compliance when systems involve risks such as grooming, sexual exploitation and unwanted adult contact.

Roblox now has three months to demonstrate that its protections can close the gaps identified by Australia’s regulator.

The outcome could matter beyond Australia. The age checks and Kids and Select accounts at the centre of the dispute are part of Roblox’s broader global safety system, meaning weaknesses identified in one market may offer lessons for how the platform protects younger users elsewhere.