Australia regulator: Roblox still allows adults to contact children; company agrees to fixes

Australia's eSafety Commissioner tested Roblox and found multiple ways adults could contact or view children's accounts. The regulator identified four concrete failings in how the platform handled underage users' visibility and interactions. Roblox has agreed to an enforceable legal undertaking to fix those problems within three months.

• Adults could send connection requests to young Australian children without parental or carer consent. This means adults can initiate friend-type relationships with child accounts even when parents have not approved those connections.
• Children and adults could view and respond to each other's posts on forums outside game environments without parental or carer consent. Interactions were not restricted to gameplay and could occur in broader community spaces on the platform.
• Children's connections were visible to anyone on the Roblox platform. There was no option to hide or restrict the list of people a child account was connected with.
• Children's profiles and biographies — including account names, number and names of connections, avatar images, and non-sensitive biographical details such as interests — were visible to anyone on Roblox, with no built-in option to restrict that visibility.

Roblox provided a court-enforceable undertaking that requires it to implement several measures within three months:

• Strengthen children's account settings so accounts are private by default.
• Provide accessible reporting mechanisms that notify users of complaint outcomes.
• Engage an independent third-party auditor to assess the effectiveness of safety measures, including deployed age-estimation approaches.

Roblox reports more than 380 million active users, and the majority are younger than 16. The regulator's findings focus on how default visibility and connection mechanics expose children to unsolicited contact and make their basic profile information broadly visible. The undertaking makes these specific operational changes time-bound and legally enforceable in Australia.

Roblox introduced mandatory age verification starting in late 2025, with deployment in Australia among the first moves. eSafety's testing shows that despite prior changes and extended engagement between the regulator and Roblox over two years, significant gaps remained. The new undertaking also requires independent auditing, which creates a process for external assessment of both policy and technical controls such as age-estimation.