Australia Forces Roblox to Overhaul Child Safety Flaws

Australia’s eSafety regulator has exposed a raw truth: Roblox’s child safety measures are failing at their most basic task, and the company can no longer be trusted to fix the problem on its own. Despite rolling out new Kids and Select accounts and processing 338 million facial age checks, platform testing revealed a suite of critical flaws allowing adult strangers to connect with children. This triggered a court-enforceable undertaking that compels Roblox to enact specific fixes within three months and, for the first time, submit to independent third-party audits of its safety systems according to The Verge. The story here isn’t just a compliance failure, it’s a fundamental test of whether a platform valued for its young user base can be engineered to protect them.

How Regulator Testing Cut Through Roblox's Safety Veneer

The eSafety Commissioner’s probe moved past policy statements into live, tactical testing. The findings were precise and damning:

• Adults could send direct connection requests to children’s accounts without parental consent.
• Children and adults could interact on forums outside of game environments, bypassing in-game safety settings.
• A child's entire social graph, their connections list, was visible to anyone on the platform.
• Children’s profiles, biographies, avatar images, and stated interests were publicly visible with no option to restrict access.

“Critically, the inclusion of third-party auditing ensures Roblox cannot mark their own homework,” eSafety Commissioner Julie Inman Grant said.

This list reveals a safety model reliant on obscurity and user opt-in, not enforced, systemic barriers. For a platform with over 380 million active users, a majority under 16, these are not marginal flaws. They are fundamental design choices that facilitate contact between adults and children, contradicting Roblox’s public safety narrative. As we reported in Erin Patterson Appeal Hinges on Catastrophic Hotel Receipt, rigorous external scrutiny is often the only way to uncover critical failures in a system.

The Unfulfilled Promise: A Timeline of Reactive Safeguards

Roblox’s safety strategy has been a series of reactions, not preventions. The company points to its December 2025 rollout of mandatory facial age estimation for chat in Australia, New Zealand, and the Netherlands, later expanded globally. It highlights the recent introduction of age-restricted account tiers. Yet, the eSafety testing occurred after these measures were in place.

The chronology is telling:

1. September 2025: Roblox gives eSafety nine specific safety commitments.
2. December 2025: Facial age estimation becomes mandatory for chat in key markets.
3. 2026: eSafety conducts new tests, finding the core problems of adult-child contact persist.
4. August 20, 2026: eSafety secures a legally binding undertaking, citing ongoing failures.

The company maintains it is “meeting its obligations” while simultaneously agreeing to the regulator’s demanded fixes, a contradiction that underscores the gap between corporate self-assessment and external reality. This pattern of scandal, response, and continued vulnerability mirrors other sectors where regulatory action follows public pressure, as seen in the political maneuvering around Major Parties Cut Weak Gambling Deal Gutting Reforms.

The New Benchmark: Third-Party Audits and Court-Enforceable Orders

The most significant element of this settlement is the mandatory independent audit. It’s the first time eSafety has imposed this requirement under the Online Safety Act, creating a powerful new template for enforcement. Roblox has three months to:

• Prevent adults from contacting unknown children without parental consent.
• Make children’s accounts private by default.
• Improve reporting tools that notify users of outcomes.
• Hire an auditor to assess all safety measures, including age-estimation tech.

The auditor’s role transforms the dynamic. No longer can Roblox issue a press release about its “industry-leading trust and safety tools.” It must now open its systems to an independent examiner who will judge their actual effectiveness. Failure to comply allows eSafety to seek Federal Court orders.

This shifts the regulatory playbook from negotiation to verification. For a platform where 1.7 million Australian children are users, the stakes are tangible. The mechanism echoes a global push for accountability beyond corporate statements, a theme in other areas of Australian regulatory action.

A Global Ripple Effect: Why This Isn't Just an Australian Problem

Australia’s action sets a direct precedent other regulators can follow. The Online Safety Act provides a framework with real teeth, including codes that mandate default private settings for children and transparent reporting mechanisms. By successfully forcing changes on a U.S.-based gaming giant, eSafety demonstrates that national legislation can have extraterritorial impact on global platforms.

The implications for the industry are stark:

• Compliance costs will rise as engineering resources must shift to build truly restrictive default architectures, not just optional settings.
• Third-party audits could become a standard regulatory demand for any platform serving underage users.
• The business model of social discovery and connection, a key driver of engagement on platforms like Roblox, comes directly into conflict with child safety mandates.

For Roblox, the path forward is now externally dictated and monitored. The company must prove that its platform, engineered for open social play, can be retrofitted into a locked-down safe space for children. If it cannot, it risks not just fines, but a permanent rupture in the trust of its core user base, parents. The next three months are not just a compliance deadline, but a test of whether a virtual world built on openness can survive a new era of enforced confinement.

Why This Changes Everything

• A major global platform popular with children is being forced by regulators to implement verifiable, audited safety systems, setting a new precedent.
• The core safety flaws identified (adult-child contact, public profiles) are fundamental design issues that undermine parental trust in the platform.
• The requirement for independent third-party audits removes the company's ability to self-report on safety, increasing accountability for all social platforms.