Roblox bound to court-enforceable deal after eSafety finds adult contact loopholes

Australia’s eSafety Commissioner, Julie Inman Grant, announced that gaming giant Roblox has entered a court-enforceable agreement to address significant gaps in its child safety protections. The binding undertaking follows regulatory testing that revealed the platform failed to prevent adult strangers from contacting young users, despite changes implemented in the previous autumn. Under the agreement, Roblox must make children’s accounts private by default and prevent unwanted contact without parental consent within three months.

The investigation found that adult users could send connection requests to children without triggering parental alerts. Furthermore, children’s profiles, biographies, and contact lists were visible to anyone on the platform, with no option to restrict visibility. eSafety noted that bad actors could search these visible contact lists for additional targets. In some cases, adults were able to comment on children’s posts in forums outside game environments without parental or carer consent.

Roblox, which is used by 1.7 million Australian children, has agreed to strengthen its account settings to ensure privacy by default. The platform will also introduce accessible reporting mechanisms that notify users of complaint outcomes. Inman Grant stated that the regulator’s testing suggested Roblox could no longer be trusted to independently verify its compliance with Australian laws. Consequently, the platform has agreed to submit to independent third-party audits, a first under the Online Safety Act.

The audits will provide eSafety with a direct window into Roblox’s age-estimation tools to verify their effectiveness. This is a critical oversight mechanism, as the regulator can impose steep fines if Roblox is found to be mislabelling children as adults, thereby exposing them to adult content or predators. Last October, eSafety warned it was prepared to seek penalties of up to $49.5 million if the platform failed to address ongoing reports of exploitation.

Roblox maintains that its in-house Facial Age Estimation system, which uses artificial intelligence, has processed 338 million age-check records. The company claims its model’s age-band estimates agree with human consensus labels for adults more than 80 percent of the time, with over 99 percent of users remaining in the same broad age band on consecutive days. However, eSafety remains cautious, planning to continually audit the tool to ensure it is not blindsided by self-evaluations that rate the system more highly than the regulator might.

In a statement, a Roblox spokesperson said the undertaking follows constructive dialogue with eSafety and comes after the recent rollout of new safety features, including Roblox Kids and Select accounts for under-16s. The company stated it has delivered on commitments made over the last 12 months and will continue working towards keeping Australian children safe online.