Australia Finds Adults Could Still Contact Kids on Roblox, Forces Legal Safety Agreement

Roblox has signed a legally binding agreement with Australia's eSafety Commissioner after regulator testing found adult strangers could still reach children on the platform, despite two years of promised fixes.

The testing, conducted earlier this year, found adults could send connection requests to Australian children without a parent ever finding out, according to eSafety Commissioner Julie Inman Grant. Children's profiles, biographies, account names, connections, and avatar images were visible to anyone on the platform, with no way to restrict who could see them. Adults and kids could also read and reply to each other's posts on forums outside the actual games, again without parental consent, eSafety found.

None of this triggered alerts to parents, according to the Australian findings reported by The Guardian and the Brisbane Times. Bad actors could reportedly also browse a child's visible connections list to find more targets.

About 1.7 million Australian children use Roblox, based on Roy Morgan research from December 2025, making it the country's second-most popular game with kids. A platform that size with these kinds of holes in it creates a large attack surface for grooming and exploitation.

What Roblox already did, and why it wasn't enough

This isn't Roblox's first round of safety changes. In late 2025 the company rolled out age-assurance checks for chat access, and by February 2026 eSafety had already put Roblox on notice over grooming concerns. Roblox responded by building new "Kids" and "Select" account tiers for under-16 users, restricting chat by default and giving parents more controls, changes that rolled out globally by June, according to Engadget and The Conversation.

Those changes clearly weren't the full fix. eSafety's follow-up testing this year found the gaps described above still existed even after the new account tiers launched. That's a second notice of concern from the regulator in roughly six months, according to The Conversation's Australia-based higher-education reporting on the case.

What Roblox has now agreed to do

Under the court-enforceable undertaking, Roblox has three months to:

• Prevent adults from contacting unknown children without parental consent, across the whole platform, not just in-game chat
• Make children's accounts private by default
• Build accessible reporting tools that tell users what happened after they file a complaint
• Hire an independent third-party auditor to check whether its safety measures, including its age-estimation technology, actually work

That last point is new territory. This marks the first time third-party auditing has been required under Australia's Online Safety Act, according to the Brisbane Times. "Critically, the inclusion of third-party auditing ensures Roblox cannot mark their own homework," Inman Grant said.

Roblox maintains it believes it is already meeting its obligations under the law. Nicky Jackson Colaço, Roblox's global head of public policy, said in a statement carried by The Verge that the undertaking "reflects our commitment to working with regulators and policymakers around the world to help keep kids safe online," pointing to the Kids and Select account rollout as evidence of that commitment. A company spokeswoman told the Brisbane Times the agreement followed "constructive dialogue" with eSafety.

If Roblox breaches the agreement, eSafety can ask Australia's Federal Court to order compliance, according to multiple outlets covering the announcement.

A fair question about whether age tech works at all

Outlet eftm raised a point worth taking seriously: if the government's own regulator is forcing an independent audit of age-estimation tools because it isn't confident they work, that suggests a real limitation in the broader premise that age verification technology can reliably keep kids away from strangers online. eftm also noted that eSafety's own research on Australia's under-16 social media ban found more than eight in ten affected teens were still accessing banned platforms months after the ban took effect, with some using VPNs or fake IDs to get around checks. That's a legitimate data point, and it should make regulators and parents alike skeptical of treating age-gating software as a silver bullet.

The Roblox findings, however, aren't really an age-verification failure. Even accounts that had already gone through the platform's age-estimation process were still discoverable and contactable by unknown adults. The problem eSafety flagged was about default privacy settings and consent, not about whether Roblox correctly identified who was a kid.

Roblox is also facing separate legal exposure in the United States. It's under investigation by a Senate subcommittee and has been sued by several states, according to The Verge. In May, Roblox agreed to pay Nevada a $12 million settlement and to require ID or facial-age verification for users, according to Engadget.

The Conversation's Australia-based analysis put the timeline in blunt terms: given how long each round of enforcement has taken so far, "it may be 2027 before we know" whether Roblox's next round of fixes actually satisfies eSafety's standards. That leaves parents relying on account settings that regulators themselves have twice found weren't doing the job.