eSafety Finds Gaps in Roblox Child Protections, Secures Court-Enforceable Undertaking

Australia's eSafety Commissioner has secured a court-enforceable agreement against Roblox Corporation following direct testing that revealed persistent gaps in Roblox's child safety mechanisms.

Under the legally binding agreement, Roblox has three months to strengthen its child privacy settings and submit its systems to an independent third-party audit—marking the first time the eSafety Commissioner has used powers under the Online Safety Act to mandate external auditing.

What eSafety Found

According to the regulator’s investigation, direct testing uncovered critical gaps in how Roblox manages adult-to-child contact. Adults were able to send connection requests to Australian users under 16 without parental or carer consent. Furthermore, while Roblox implemented chat restrictions inside games, adults and minors could still interact in platform-hosted forums outside game environments without parental oversight.

The regulator also identified broad privacy failures across youth accounts. A child's number and names of connections, along with their profile details and personal biographies, remained visible to other registered users. Roblox provided no settings or user toggles allowing parents or children to restrict or opt out of this public exposure.

What Roblox Must Do

Under the terms of the three-month undertaking, Roblox must strengthen its systems to prevent adults from contacting young Australian children under 16 without parental or carer consent.

In addition, Roblox must configure under-16 accounts to be private by default and strengthen controls over the visibility of children's profile information. The agreement also obligates the platform to provide accessible reporting mechanisms for high-harm material that notify reporters of complaint outcomes.

To verify compliance, Roblox must hire and fund an independent external auditor to evaluate the effectiveness of its safety measures, including its age-estimation systems.

"Critically, the inclusion of third-party auditing ensures Roblox cannot mark their own homework," eSafety Commissioner Julie Inman Grant said.

Roblox's Response

In a statement issued to media, a Roblox spokesperson said the agreement follows "constructive dialogue with eSafety" and comes after the recent rollout of new safety features, including dedicated account settings for users under 16.

"We have delivered on the commitments we made to eSafety over the last 12 months and will continue to work towards our shared goal of keeping Australian children safe online," the spokesperson said.

What Led to the Undertaking

Roblox had previously told eSafety that it had delivered on a series of child-safety commitments made in 2025. eSafety then directly tested the implementation and effectiveness of those measures in 2026, identifying gaps that led to the new undertaking.

The enforcement action follows two years of regulatory engagement between eSafety and Roblox. If Roblox breaches the undertaking, eSafety can apply to the Federal Court for enforcement and other orders. Commissioner Julie Inman Grant has said potential court action could expose the company to penalties of up to $100 million.

OSN will continue to analyze and track Roblox's technical rollout as the compliance deadline approaches. Follow ongoing updates on our Developing Stories page.