Roblox Signs Legal Agreement with Australian Regulators After Adults Found Able to Contact Children Without Parental Consent
Australia's online safety watchdog found that adult accounts on Roblox could see children's profiles and send them connection requests, all without a parent ever knowing. Now Roblox has put its promises in writing.
Key points
- Australia's eSafety Commissioner found in 2024 testing that adult Roblox users could view child accounts and send connection requests without parental consent.
- Children and adults could also read and reply to each other's posts on forums outside game environments, again without parental approval.
- Roblox has signed a formal legal agreement with the regulator committing to specific privacy changes on its platform.
- The eSafety Commissioner described verifiable safety measures as "critical" to Roblox's continued viability as an online service.
Roblox, the gaming platform used by hundreds of millions of people worldwide and popular with children as young as six, has signed a formal legal agreement with Australia's eSafety Commissioner after regulators caught a serious gap in how the platform handles contact between adults and minors.
What did regulators actually find?
Adults could contact children directly, and parents had no say in it. Testing by the eSafety Commissioner, Australia's government body responsible for enforcing online safety rules, found that adult accounts could view the profiles of child accounts and send them connection requests, the platform's equivalent of a friend request, without any parental knowledge or approval.
The problem went beyond direct connections. Children and adults could also see and reply to each other's posts on public forums that sit outside game environments entirely. Again, no parental consent was required.
For context: Roblox asks users for their date of birth when they sign up. The platform is supposed to use that information to apply stricter privacy settings to younger accounts. What regulators found suggests those restrictions were not working as parents would reasonably expect.
What has Roblox agreed to do?
Roblox has provided a legal agreement to the eSafety Commissioner promising changes. The regulator described verifiable safety measures as "critical" to whether the platform can continue operating as it currently does. That is not gentle language from a safety body.
The specifics of every technical change are not yet public, but the legal nature of the agreement means Roblox cannot simply announce good intentions and move on. Regulators can hold the company to what it signed.
Guardian Australia first reported the story.
Should parents be worried right now?
Worried, no. Alert, yes. If your child uses Roblox, a few straightforward steps make a real difference today, while the platform rolls out its promised fixes.
Check that your child's account has their correct date of birth entered. Roblox uses that date to decide which privacy settings apply. An incorrect birth year could leave a young child with adult-level account visibility.
Look at the privacy settings inside your child's account directly. Roblox does offer parental controls through a feature called Parental Controls and a supervision system. If you have not set those up, now is a good time.
Talk to your child about not accepting connection requests from people they do not know in real life. That conversation costs nothing and works regardless of what the platform does or does not restrict.
Would stronger authentication, meaning better ways of verifying who is actually logging in, have prevented this specific problem? Probably not on its own. This was a design gap in privacy defaults, not a case of someone stealing a password. The fix is policy and product change, which is exactly what regulators are now requiring.
