Australia’s eSafety commission has been working with Roblox for two years. Two years of meetings, feedback, and public pressure. And when regulators went back to test the platform earlier this year, adults could still send connection requests to children without parental consent. Still. After all that.
According to Engadget, eSafety’s tests found a string of failures that went well beyond one missed setting. Adults and children could still see and respond to each other’s posts on community forums. Anyone on the platform could view an underage user’s connections, biography, account name, avatar image, and profile, with no way for the child or their parent to restrict that visibility. These aren’t edge cases. They’re basic privacy controls that most platforms have had for years.
Roblox has now signed what eSafety calls a “court-enforceable undertaking,” committing to a list of specific changes. The platform must make children’s accounts private by default, block adults from contacting unknown children without parental consent, provide clearer reporting tools, and bring in a third-party auditor to assess whether its safety measures actually work. It has three months to get this done. If it doesn’t, eSafety can go to court to force compliance.
The company’s response to all this is telling. eSafety noted that Roblox “believes it is meeting its obligations under the Online Safety Act.” So the company thinks it’s fine, and regulators found it isn’t. That gap between corporate self-assessment and independent testing is exactly why enforceable regulatory action matters.
This isn’t Roblox’s first attempt at fixing things. The company rolled out mandatory age verification starting in Australia in late 2025, then extended it to the US for in-game chat access. By mid-May this year, it introduced three account tiers: Kids, Select, and standard Roblox. Kids accounts come with content filters, chat off by default, and parental controls. The system went global in June. But the eSafety tests suggest that structural changes to account tiers don’t automatically translate into real protection if the underlying contact and visibility settings are still too open.
The legal pressure on Roblox extends well beyond Australia. Several US states have filed lawsuits over child safety failures on the platform. In May, Roblox agreed to pay Nevada $12 million and to build a verification system using government-issued IDs and facial age estimation. It also committed to blocking users under 16 from messaging adults unless that adult has been marked a “trusted friend” through a QR code system.
The pattern here is worth paying attention to. Roblox announces a fix, regulators test it, gaps remain, and a new commitment follows. For the millions of children using the platform right now, that cycle is the problem.