Australia's eSafety Regulator Puts Roblox Under Court-Enforceable Child Safety Rules
Australia's eSafety regulator has found that adults could send connection requests to young Australian children on Roblox without parental consent, one of several safety failures that now place the platform under a court-enforceable undertaking backed by external audits The Verge ABC News.
The findings, published on 20 August 2026, describe a pattern of exposure across Roblox's social features. Children and adults could view and respond to each other's posts on forums outside of games without parental consent. Children's connections were visible to anyone on the platform. Profiles, including account names, the number and names of connections, avatar images, and biographical details like interests, were similarly open to all users with no option to restrict who could see them The Verge.
Under the enforceable undertaking, the eSafety Commissioner can take Roblox to court if it finds the platform is not meeting its commitments. Roblox will also face external audits to prove it is safe for children ABC News.
These findings follow months of escalating regulatory pressure. In September 2025, Roblox committed to implementing safety measures agreed with eSafety by the end of that year, after the regulator engaged with the platform eSafety.gov.au. By February 2026, eSafety had told Roblox it intended to directly test whether the platform had actually implemented nine safety measures required under Australia's Online Safety Act. The regulator titled its media release 'Roblox on notice over ongoing concerns about online child grooming' and said it remained highly concerned by reports of children being exploited on the service and exposed to harmful material eSafety.gov.au.
In April 2026, eSafety confirmed that Roblox had earlier committed to key changes to protect children, including stricter age verification and changes to accounts eSafety.gov.au. The regulator's notices to Roblox covered the period from 20 March 2025 to 20 March 2026, which included Roblox's introduction of age-verified chat eSafety.gov.au.
The gap between what Roblox said it would do and what the regulator actually found is what the August 2026 findings expose. The features eSafety identified — publicly visible friend lists, adult-to-minor connection requests without consent, and forum interaction between adults and children with no parental gates — are the same categories of safety gaps that child safety researchers have flagged across social platforms for years. What differs here is the regulatory tool. The enforceable undertaking turns what would otherwise be a reputational issue into a legal obligation, with a court pathway and mandated third-party auditing.
For platform engineers and trust and safety teams, the practical implications are clear. Default visibility settings for accounts belonging to minors, consent requirements for interactions between adults and children, and detailed access controls on profile data are no longer design choices that can be pushed to a future development cycle. The Australian precedent shows that a regulator can and will directly test whether a platform's implementation actually meets statutory requirements, rather than simply accepting a platform's stated compliance.
Roblox's introduction of age-verified chat during the notice period suggests the company was already moving toward tighter controls. The eSafety findings indicate those measures had not sufficiently addressed the underlying problems by the time the regulator conducted its assessment.
The specificity of the technical failures is worth pausing on. The inability to restrict profile visibility, the absence of consent requirements for adults initiating connections to minors, and the open forum interaction channel are not obscure edge-case bugs. They are core social features operating as designed, without adequate safety constraints for underage users layered on top.
The enforceable undertaking model, combining external audit, court enforceability, and direct regulatory testing, may become a template that other jurisdictions study. For a platform with a substantial underage user base, the cost of retroactively fixing these problems under audit and legal deadline is considerably higher than building safety in from the start. The broader lesson for the industry is straightforward enough that it barely needs stating: when a regulator begins directly testing your implementation rather than your policy documents, the gap between the two becomes the story.
