Two years of talks. Multiple rounds of new safety features. And when Australia‘s eSafety commission ran its own tests earlier this year, adults could still send connection requests to Australian children without a parent signing off.
That’s the finding underneath the deal announced this week. Roblox has committed to a “court-enforceable undertaking” with the regulator, agreeing to changes meant to better protect kids from grooming and sexual abuse on the platform.
What the regulator’s tests actually turned up
The connection requests were one piece. eSafety also found children and adults could still see and reply to each other’s posts on community forums.
And anyone on the platform could still view an underage user’s connections, profiles, biographies, account names, avatar images and other information. There was no option to restrict any of it from view.
That’s the part worth sitting with. Not a chat loophole or an edge case in a moderation queue, but a kid’s profile data sitting open by default, with no switch to close it.
Roblox thinks it’s already compliant
The company “believes it is meeting its obligations under the Online Safety Act,” eSafety said. It signed the undertaking anyway.
Under the agreement, Roblox has to build a way to stop adults from contacting children they don’t know without parental consent. Children’s accounts have to be private by default. Users need accessible reporting mechanisms. And a third-party auditor has to assess whether the safety measures work.
Three months to deliver. Miss the window and eSafety can go to court to compel compliance.
The age verification timeline tells its own story
Roblox rolled out mandatory age verification in late 2025, starting with Australia, most likely because of eSafety’s work. The rollout had problems: kids spoofed the age check system. Roblox was adamant its technology works.
After that first release, the company started requiring age verification in the US for in-game chat. By mid-May this year, it had split users into three tiers: Kids, Select and regular Roblox.
Kids accounts can only reach games rated Minimal or Mild, with chat off by default and a full set of parental controls. The tiered system went global in June.
So the fixes were shipping while the gaps eSafety documented were still open. Both things were true at once.
The legal bill is adding up elsewhere
Roblox has been dealing with child safety problems for years and faces lawsuits from several US states. In May it agreed to pay Nevada a $12 million settlement.
That deal also requires a verification system built on government-issued IDs and facial age estimation. Under the current system, users only need to complete one of the two methods to verify their age.
The company also vowed to prevent users under 16 from messaging adults unless the adult has been designated a “trusted friend,” a status assigned through a QR code.
Watch the default, not the announcement
If you’re a parent trying to figure out whether any of this matters to your kid’s account, the single most useful thing to check is whether their profile is private, and whether you had to go find that setting yourself. Under the undertaking, private-by-default is now something Roblox owes the regulator in writing, on a three-month clock.
