Roblox has agreed to a court-enforceable undertaking with Australia’s eSafety commissioner, Julie Inman Grant, pledging to overhaul its child safety controls after an investigation revealed adult users could still easily send connection requests and message unknown children on the platform.
The eSafety Findings and Technical Lapses
Despite rolling out new restrictions over the past year, Roblox failed to prevent structural safety gaps. Testing conducted earlier this year by Engadget and Australia’s eSafety commission flagged that adult strangers could initiate connection requests with Australian children without parental consent. Furthermore, underage users’ profiles, biographies, account names, avatar images, and contact lists remained visible to anyone on the platform, lacking options to restrict visibility.
These requests did not trigger parental alerts. Bad actors could easily harvest data from children’s publicly visible contact lists to find more targets.
Global Age-Gating and Regulatory Penalties
Roblox has faced mounting international scrutiny over child safety. The platform rolled out mandatory age verification in late 2025, starting in Australia, and subsequently expanded age verification requirements to the United States to control in-game chat access. By mid-May, Roblox segregated users into three distinct age tiers: Kids, Select, and regular Roblox. Kids accounts were restricted to games with Minimal or Mild content ratings, featuring default chat-off settings and comprehensive parental controls. This tier system was implemented globally in June.
Regulatory actions extend far beyond Australia. In May, Roblox agreed to pay Nevada a $12 million settlement. That agreement mandated a verification system requiring users to submit government-issued IDs and undergo facial age estimation. Additionally, Roblox vowed to block users under 16 from messaging adults unless explicitly designated as a “trusted friend” via QR code assignment.
The Court-Enforceable Undertaking
Although the platform previously asserted it was meeting its obligations under the Online Safety Act, eSafety’s findings prompted a strict corrective roadmap. Under the new court-enforceable undertaking, Roblox has three months to implement sweeping architectural changes.
The platform must deploy mechanisms to ensure adults cannot contact children they do not know without explicit parental consent. Accounts belonging to children must become private by default. Roblox is also required to provide accessible reporting mechanisms and appoint a third-party auditor to evaluate the real-world effectiveness of its safety measures. Failure to meet the three-month deadline could lead eSafety to ask the court to compel compliance.
