Roblox agrees to third-party child safety audits after Australian regulator finds gaps

Australia's online safety regulator, eSafety, has announced a court-enforceable agreement with Roblox that will require the gaming platform to make significant changes to protect children from adult contact and grooming. The agreement follows testing by eSafety that found Roblox was still allowing adults to contact children in ways that could facilitate abuse, despite changes the company made last fall.

eSafety's testing flagged several persistent issues: adults could send connection requests to children without parental consent, children's profiles and connections were visible to anyone on the platform, and adults and children could interact on forums outside of game environments. The regulator said these gaps "put children at risk" and that Roblox could no longer be trusted to independently verify its own safety tools.

"Roblox cannot mark their own homework," said eSafety commissioner Julie Inman Grant, announcing that the company would be subject to third-party auditing for the first time under Australia's Online Safety Act. The agreement requires Roblox to make changes within three months, including making children's accounts private by default and preventing adults from contacting unknown children without parental consent.

The move comes amid broader scrutiny of Roblox's child safety practices. In the US, the company faces a Senate subcommittee investigation and lawsuits from multiple states. Roblox has also been rolling out its own safety features, including facial age checks and new "Roblox Kids" accounts for users under 16. The company says it has delivered on its commitments to eSafety over the last year and will continue working toward keeping children safe.

The third-party audit will also give eSafety visibility into Roblox's age-estimation system, which the company describes as a homegrown AI tool that has processed "338 million age-check records." While Roblox says its model agrees with human reviewers for adults more than 80 percent of the time, eSafety will independently assess whether it accurately labels children and teens to prevent them from accessing adult content.

For developers and platform operators, this case signals a growing regulatory trend: governments are moving beyond requiring platforms to self-report safety measures and are demanding independent verification. As Inman Grant put it, "Where safety by design has not been deployed comprehensively at the front end, we won't hesitate to ensure that these risks have been responsibly remediated."