Roblox vows to make changes after Australian regulator found yet more child safety lapses
Roblox has agreed to a court-enforceable undertaking with Australia's eSafety Commissioner to introduce further child safety measures, after the regulator's own testing found the platform was still allowing adults to contact children without parental consent. The finding is notable because it comes despite two years of engagement between eSafety and Roblox and a series of safety updates the company had already rolled out, suggesting those measures fell short in practice. Roblox maintains it believes it is already meeting its obligations under Australia's Online Safety Act, but has nonetheless committed to the changes to avoid the regulator seeking court enforcement.
eSafety's tests found that adults could still send connection requests to Australian children without consent, that children and adults could view and respond to each other's posts on community forums, and that anyone could view an underage user's profile details, connections and avatar with no way to restrict visibility. Under the new undertaking, Roblox must within three months prevent unsolicited adult-child contact, make children's accounts private by default, improve reporting tools and submit to a third-party audit of its safety measures. The move follows Roblox's earlier rollout of mandatory age verification and a three-tier account system (Kids, Select and regular), as well as a $12 million (Nevada) settlement in May over similar child safety failings in the United States.
- Roblox to add child safety measures after Australian regulator's tests exposed gaps
- Adults could still contact children without consent despite prior fixes
- Roblox has three months to comply or face possible court action
New here? Start with this
Roblox is an online platform where mostly younger users create and play games made by other users, and it has been under scrutiny for years over how well it protects children from unwanted contact by adults. Australia's eSafety Commissioner is the government regulator responsible for enforcing online safety rules in the country, including the Online Safety Act, and has been engaging with Roblox on this issue for some time.
The current dispute centres on whether Roblox's existing safety features, such as age checks and privacy settings, actually work as intended when tested by the regulator. This matters because it raises broader questions about how much trust can be placed in tech platforms' own claims of compliance, and about the practical challenges regulators face in verifying child safety online rather than simply accepting a company's word for it.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Roblox operates one of the world's largest user-generated platforms facing genuinely complex technical challenges, and can point to years of engagement with eSafety and substantial safety investments including mandatory age verification and a three-tier account system as evidence of genuine commitment. The discovery of additional vulnerabilities after prior remediation efforts need not suggest bad faith, but rather reflects the inherent difficulty of securing an enormous platform where each iteration of testing reveals edge cases requiring further refinement. Viewed charitably, ongoing regulatory dialogue represents responsible engagement with continuous improvement being the realistic standard for such technically complex systems rather than perfection.
The case against
The pattern of findings is troubling: despite two years of regulatory engagement and multiple prior updates, eSafety testing still uncovered fundamental vulnerabilities including unsolicited adult-child contact and unrestricted profile visibility. This suggests that Roblox's previous measures and assurances have failed to match the stated severity of child safety concerns in practice, and the need for a court-enforceable undertaking indicates that voluntary approaches have not sufficed. When a platform has committed to addressing serious child safety risks multiple times and testing still reveals the same categories of vulnerability, stricter enforcement with mandatory timelines and third-party audits becomes necessary to protect children.