Australia's eSafety Commission found Roblox still allowed adults to contact children. The platform now faces court-enforceable requirements to implement stricter protections.
By Adam Makins · 
Roblox is facing serious consequences after Australia’s eSafety Commission discovered the platform was still allowing adults to contact children, despite previous safety rollouts and two years of engagement with regulators.
The gaming giant has now agreed to a court-enforceable undertaking that could fundamentally reshape how the platform operates. If Roblox fails to implement required changes within three months, the eSafety Commission can ask a court to compel compliance. This isn’t a gentle nudge anymore - it’s a legal mandate.
eSafety’s testing was damning. Adults could still send connection requests to Australian children without parental consent. Kids and adults could view and respond to each other’s posts on community forums. Even worse, anyone on the platform could see an underage user’s connections, profiles, biographies, account names, avatar images, and other personal information with no privacy controls available.
This isn’t a minor oversight. These are fundamental vulnerabilities that create pathways for grooming and exploitation.
Roblox has been rolling out safety measures, including mandatory age verification starting in late 2025, initially in Australia. The company also introduced chat requirements for US users and globally implemented an age-tiered account system by June with three categories: Kids, Select, and regular Roblox. Kids accounts have chat disabled by default and come with parental controls. On the surface, these sound comprehensive.
But the eSafety findings prove the company’s efforts fell short. The gap between announced protections and actual implementation appears significant.
Under the undertaking, Roblox must now ensure adults cannot contact children they don’t know without parental consent. The company also has to make children’s accounts private by default, provide accessible reporting mechanisms, and submit to third-party audits to assess safety measure effectiveness.
These requirements address real vulnerabilities. Private-by-default children’s accounts alone would eliminate a major exposure vector. Mandatory parental consent for adult-child contact creates friction that deters predatory behavior.
The timing matters too. Roblox is already facing tech lawsuits from multiple US states and just agreed to a $12 million Nevada settlement in May. That deal required users to submit government-issued IDs and undergo facial age estimation, with users under 16 banned from messaging adults unless they’re designated “trusted friends” assignable via QR code.
The fundamental tension is that Roblox prioritizes user engagement and connection. The platform’s appeal stems from social features - the ability to build relationships, create content together, and form communities. Safety measures that restrict these features face internal resistance and can hurt user experience metrics that matter to investors.
Maintaining safety at scale is genuinely difficult, especially on a platform where 200 million monthly active users interact with diverse content. But difficulty isn’t an excuse when children’s safety is at stake. The eSafety Commission’s investigation shows that knowledge of vulnerabilities plus time to fix them should equal solved problems. Roblox had both.
The company claims it “believes it is meeting its obligations under the Online Safety Act,” but the evidence suggests otherwise. When a regulator’s independent testing discovers the exact vulnerabilities they warned about, the company’s self-assessment loses credibility.
Three months is tight. Roblox must fundamentally change how its systems work - not just add features but restructure core functionality. Default-private children’s accounts means rebuilding visibility settings. Preventing unknown adult contact requires sophisticated relationship tracking and enforcement.
The tech industry watches closely when regulators get teeth. Australia’s eSafety Commission has proven willing to pursue court enforcement. This matters beyond Roblox. Other platforms hosting minors are noting that ignoring safety concerns and banking on regulatory apathy no longer works.
The question isn’t whether Roblox will comply with the three-month deadline. The question is whether these changes will actually work, and whether a company that missed these obvious vulnerabilities can be trusted to build robust protections.
Source: eSafety Commission and Roblox reporting
