Australia's Regulator Orders Roblox to Fix Child Protection Failings

AFFILIATE_PRODUCTS:

Regulator’s Findings

Based on a report by Ashley Belanger in Ars Technica.

Australia’s eSafety Commissioner, Julie Inman Grant, announced on August 20, 2026, that online gaming platform Roblox still has deficiencies in its measures to prevent adults from contacting children.

“Despite making changes last fall to help block adults from messaging unknown children, Roblox is still failing to stop adults from creeping on kids in other ways, Australia’s eSafety commissioner, Julie Inman Grant, said on Thursday.”

The eSafety agency conducted tests earlier this year and confirmed significant gaps in Roblox’s security measures. Specifically, it found that adult strangers could still send connection requests to children.

“The agency found that adult strangers could still send connection requests to kids, whose ‘profiles and biographies, including account names, number and names of connections, avatar images, and non-sensitive biographical information such as their interests were visible to anyone on the Roblox platform, with no option to restrict the visibility of this information.’”

These requests did not trigger parental alerts, and malicious actors could also search children’s publicly visible contact lists for further targets.

“Such requests did not trigger parental alerts, eSafety found, and bad actors could also search kids’ visible-to-anyone contact lists for more targets.”

Furthermore, adults could search for and comment on children’s posts in platform forums without parental or carer consent.

“Perhaps even more concerning, adults could also search for kids and comment on their posts ‘without parental or carer consent’ in ‘forums outside game environments,’ eSafety said.”

Roblox’s Response and Legal Agreement

Australia’s Online Safety Act requires platforms to prevent unwanted contact between adults and minors and mandates that children’s accounts be private by default.

While Roblox stated it “believes it is meeting its obligations,” the platform—which is used by 1.7 million Australian children—has entered into a legally binding agreement to make changes.

“Although Roblox ‘believes it is meeting its obligations,’ the online gaming platform—which 1.7 million Australian kids use—has entered a court-enforceable agreement to make changes in the next three months.”

Roblox has committed to introducing measures across its platform within the next three months to prevent adults from contacting children without parental consent. According to eSafety, providing better protection begins with “enhancing account settings for children’s accounts to make them private by default,” followed by features to easily report unwanted contact, and concludes with notifying users of report outcomes.

Agreement for Third-Party Auditing

Inman Grant stated that the eSafety test results indicate Roblox can no longer be trusted to independently verify that its child safety tools comply with Australian law.

“Moving forward, Roblox cannot ‘mark their own homework,’ Inman Grant said, adding that the platform has agreed to third-party auditing.”

Going forward, Roblox will be subject to audits by third-party organizations to verify its regulatory compliance.

Editorial Opinion

In the short term, this agreement could have ripple effects beyond Roblox, potentially impacting all child-oriented online platforms. The three-month deadline is tight, and the company will be forced to concentrate engineering resources on child safety features. With other companies facing similar regulatory pressure, this could serve as a turning point for raising safety standards across the industry.

In the long term, the introduction of third-party auditing can be seen as putting a definitive end to platform companies’ self-assessments and re-emphasizing the importance of independent governance. It is expected that within one to three years, a market for child safety-focused auditing and consulting will grow, and privacy by design in digital service development will become an implicit standard.

The challenge lies in the effectiveness of the audits and the cost burden. Whether third-party organizations possess sufficient technical and legal auditing capabilities, and whether the industry can absorb these costs, remains an untested question. Whether platforms can simultaneously scale and advance protective measures is another unresolved point.

References

• “Roblox must make changes after failing to block adults creeping on kids”, by Ashley Belanger — Ars Technica, 2026-08-20T17:14:08.000Z (CC BY-NC-ND)
• Source URL: https://arstechnica.com/tech-policy/2026/08/weak-roblox-safeguards-failed-to-stop-adults-contacting-kids-regulator-says/