Australia Catches Roblox Safety Deficiencies, Forcing Binding Child Protection Overhaul

Australian safety regulators discovered lingering vulnerabilities in Roblox that permitted adult interaction with minors, prompting the gaming platform to sign a court-enforceable agreement to overhaul its protections against grooming and sexual abuse. Australia’s eSafety commission revealed the gaps were found during recent testing, following two years of direct regulatory discussions and several security updates by the company.

Official testing by eSafety demonstrated that adults remained capable of dispatching friend requests to Australian minors without parental approval, while unverified users could access and participate in community forum discussions alongside children. The regulator further determined that account profiles, biographies, user handles, avatars, and friend lists belonging to underage players remained visible to all platform users without privacy toggles.

Australia’s Online Safety Act gives the eSafety Commissioner broad authority to enforce systemic safety standards across digital services, backed by civil penalties for non-compliance that can reach millions of dollars.

Roblox rolled out mandatory age verification in late 2025, starting in Australia in large part because of eSafety’s pressure. Despite early problems where children managed to spoof the age check system, Roblox maintained that its technology functions properly. Following that initial rollout, Roblox began requiring age verification in the US to access in-game chat. By mid-May this year, the platform divided users into three age tiers: Kids, Select and regular Roblox, restricting Kids accounts to experiences with Minimal or Mild content ratings, disabling chat by default, and enabling complete parental controls before launching the age-gated tier system globally in June.

The company “believes it is meeting its obligations under the Online Safety Act,” according to eSafety. Nevertheless, Roblox agreed to introduce changes and additional safety measures, including mechanisms preventing adults from contacting unknown children without parental consent. The binding agreement requires default private settings on child accounts, accessible user reporting mechanisms, and an assessment by a third-party auditor to evaluate safety effectiveness, giving Roblox three months to implement the changes before eSafety can seek a court order to compel compliance.

Roblox has dealt with child safety issues for years and faces lawsuits filed by several states in the US. In May, it agreed to pay Nevada a $12 million settlement and to introduce a verification system that requires users to submit government-issued IDs and to go through facial age estimation, replacing its current system where users only complete one of those two methods. The agreement also requires Roblox to block users under 16 from messaging adults unless connected as a “trusted friend” assigned via QR code.