Still Caught After Two Years of "Fixes": Australian Regulator Finds Kids' Roblox Accounts Can Still Be Contacted by Strangers

Two years of back-and-forth talks, round after round of new features rolled out — and testing still turns up holes. Australia's eSafety Commissioner announced that Roblox has agreed to sign a "court-enforceable undertaking," committing to patch up protections for children's accounts within three months, or eSafety can seek court enforcement.

So what's the actual problem? eSafety's tests earlier this year showed adult users could still send friend requests to Australian children's accounts without parental consent. Kids and adults could also still see and reply to each other's posts on community forums. Even worse, anyone could view a minor's friend list, profile, bio, username, and avatar images — with no option to restrict who sees this information.

The timing is a bit awkward, since Roblox has actually made plenty of moves. In late 2025, the platform rolled out mandatory age verification in Australia first — though it was caught with kids finding workarounds to fool the system, the company maintained the tech itself wasn't the issue. Then the U.S. market also began requiring age verification to use in-game chat. By mid-May this year, Roblox split users into three age tiers: Kids, Select, and standard accounts. Kids accounts can only play games rated Minimal or Mild, chat is off by default, and a full suite of parental controls comes bundled in. This tiered system rolled out globally starting in June.

According to eSafety, Roblox "believes it already complies with" the Online Safety Act, but still agreed to add several more measures — including making sure adults can't contact unfamiliar children without parental consent, setting kids' accounts to private by default, offering an easier-to-use reporting system, and having third-party auditors assess how effective the safety measures actually are.

Roblox is also tangled up in lawsuits in the U.S., with multiple state governments suing the company. This past May, Roblox agreed to pay a $12 million settlement to Nevada and pledged to roll out a verification system combining government-issued ID submission with facial age estimation — though under the current setup, users only need to complete one of the two methods. The platform also committed that users under 16 won't be able to message adults unless they designate the other person as a "trusted friend" via QR code.