Two years of negotiations. Several waves of new safety tooling. Yet when Australia’s eSafety commission carried out its own testing earlier this year, adults were still able to fire off connection requests to Australian children with no parental sign-off required.
That result sits at the heart of the agreement unveiled this week. Roblox has entered into a “court-enforceable undertaking” with the regulator, signing up to changes designed to give children stronger protection from grooming and sexual abuse on the platform.
What the regulator’s tests actually turned up
Connection requests were only one part of it. eSafety also determined that children and adults could still view and respond to one another’s posts across community forums.
On top of that, any user on the platform could still pull up an underage account’s connections, profiles, biographies, account names, avatar images and other details. Nothing could be restricted from view.
That’s the detail worth pausing on. This isn’t a chat loophole or some edge case buried in a moderation queue — it’s a child’s profile data left open by default, with no switch available to shut it.
Roblox thinks it’s already compliant
According to eSafety, the company “believes it is meeting its obligations under the Online Safety Act.” It put its name to the undertaking regardless.
The agreement obliges Roblox to build a mechanism blocking adults from contacting children they don’t know without parental consent. Accounts belonging to children must be private by default. Reporting mechanisms have to be accessible to users. And an outside auditor must evaluate whether the safety measures actually do their job.
The deadline is three months. Blow past it and eSafety can head to court to force compliance.
The age verification timeline tells its own story
Roblox rolled out mandatory age verification in late 2025, beginning in Australia — most likely a direct consequence of eSafety’s work. That rollout hit trouble: children spoofed the age check system. Roblox insisted its technology works.
Following that initial launch, the company began mandating age verification in the US for in-game chat. By the middle of May this year, it had divided its user base into three tiers: Kids, Select and standard Roblox.
Kids accounts are limited to games rated Minimal or Mild, with chat switched off by default and a complete suite of parental controls. That tiered setup expanded worldwide in June.
So the fixes were going live even as the gaps eSafety catalogued remained open. Both were true simultaneously.
The legal bill is adding up elsewhere
Child safety troubles have dogged Roblox for years, and the company is facing lawsuits brought by several US states. In May it consented to a $12 million settlement with Nevada.
That arrangement also mandates a verification system underpinned by government-issued IDs and facial age estimation. As things stand today, users only have to complete one of those two methods to prove their age.
Roblox further pledged to bar users under 16 from messaging adults unless the adult carries “trusted friend” status — a designation granted via QR code.
Watch the default, not the announcement
For any parent trying to work out whether this changes anything for their child’s account, the most useful check is simply whether the profile is set to private — and whether you had to hunt down that setting on your own. Under the undertaking, private-by-default is now an obligation Roblox owes the regulator in writing, with a three-month clock running.