Roblox Signs Legal Agreement with Australian Regulators After Adults Found Able to Contact Children Without Parental Consent
Australia's online safety watchdog found that adult accounts on Roblox could see children's profiles and send them connection requests, all without a parent ever knowing. Now Roblox has put its promises in writing.
Key points
- Australia's eSafety Commissioner found in 2024 testing that adult Roblox users could view child accounts and send connection requests without parental consent.
- Children and adults could also read and reply to each other's posts on forums outside game environments, again without parental approval.
- Roblox has signed a formal legal agreement with the regulator committing to specific privacy changes on its platform.
- The eSafety Commissioner described verifiable safety measures as "critical" to Roblox's continued viability as an online service.
Roblox, the gaming platform popular with children as young as six, has signed a formal legal agreement with Australia's eSafety Commissioner after regulators found a serious gap in how the platform handles contact between adults and minors.
What did regulators actually find?
Adults could contact children directly, and parents had no say in it. Testing by the eSafety Commissioner, Australia's government body responsible for enforcing online safety rules, found that adult accounts could view the profiles of child accounts and send them connection requests (the platform's equivalent of a friend request) without parental knowledge or approval.
The problem went beyond direct connections. Children and adults could also see and reply to each other's posts on public forums sitting entirely outside game environments, again with no parental consent required.
For context: Roblox asks users for their date of birth at sign-up and is supposed to use that information to apply stricter privacy settings to younger accounts. What regulators found suggests those restrictions weren't working as parents would reasonably expect. Our earlier story on the 764 grooming network, filed 29 July 2026, is a reminder of what uncontrolled adult access to children on gaming platforms can enable in the worst cases.
What has Roblox agreed to do?
Roblox has provided a legal agreement to the eSafety Commissioner promising changes. The regulator described verifiable safety measures as "critical" to whether the platform can continue operating as it currently does. That's not gentle language from a safety body.
The specifics of every technical change aren't yet public, but the legal nature of the agreement means Roblox can't simply announce good intentions and move on. Regulators can hold the company to what it signed. Guardian Australia first reported the story.
Should parents be worried right now?
Alert, yes. Worried into paralysis, no. A few steps make a real difference today, while the platform rolls out its promised fixes.
Check that your child's account holds their correct date of birth. Roblox uses that date to decide which privacy settings apply, and an incorrect birth year could leave a young child with adult-level account visibility.
Look at the privacy settings inside your child's account directly. Roblox does offer parental controls and a supervision system; if you haven't set those up, now's the time.
Talk to your child about not accepting connection requests from people they don't know in real life. That conversation costs nothing.
Would tighter authentication have prevented this? Probably not. This was a design gap in privacy defaults, not a stolen-password problem. The fix is policy and product change, which is exactly what regulators are now requiring. Vendors love to sell authentication upgrades as a cure-all; this case is a good reminder that defaults are often the real vulnerability.
