Here's the thing: Roblox already made changes last fall to block adults from messaging unknown children. Australia's eSafety commissioner, Julie Inman Grant, says those changes were not enough.
Testing conducted by eSafety earlier this year found that adult strangers could still send connection requests to kids without triggering parental alerts. Children's profiles — account names, number and names of connections, avatar images, and biographical details like interests — were visible to anyone on the platform, with no option to restrict that visibility. Adults could also search kids' contact lists for more targets, and comment on children's posts in forums outside game environments, all without parental or carer consent.
Roblox, which 1.7 million Australian kids use, maintains it 'believes it is meeting its obligations' under Australia's Online Safety Act. Regulators disagreed enough to put the company under a court-enforceable agreement. Roblox now has three months to deliver: private-by-default accounts for children, a block on adults contacting unknown kids without parental consent, accessible reporting tools with outcome notifications, and — the headline item — an independent third-party auditor to assess whether any of it actually works.
Inman Grant was direct about why that last piece matters: Roblox can no longer 'mark their own homework.' This is the first time Australia has required third-party auditing since the Online Safety Act became enforceable, she said.
The stakes are not abstract. eSafety warned last October that it was prepared to seek penalties of up to $49.5 million under the Online Safety Act if Roblox's age-estimation tools were found to be mislabeling kids as adults or exposing them to adult content and predators.
Roblox has been building its own Facial Age Estimation system, described in a company blog post as built 'completely in-house,' using machine learning to keep 'age checks current.' The system has 'processed 338 million age-check records,' the company says. Roblox acknowledged that 'a single accuracy number is not very meaningful' for evaluating the system, which is either a sophisticated caveat or a convenient hedge, depending on your read.
Meanwhile, in the US, Roblox is under investigation by a Senate subcommittee and has been sued by multiple states over alleged child safety issues, according to The Verge. It has settled some of those state lawsuits. According to Engadget, Roblox agreed to pay Nevada a settlement of $12 million and to introduce a verification system requiring government-issued IDs alongside facial age estimation.
Roblox's global head of public policy, Nicky Jackson Colaço, called the Australian agreement the result of 'constructive dialogue' and pointed to the rollout of Kids and Select accounts for under-16s as evidence of commitment.
Voltage's read: Regulators demanding third-party audits instead of self-certification is the right call — not because Roblox is uniquely bad, but because self-reported compliance metrics from any platform are structurally unreliable. The free-market principle here is accountability, not bureaucratic expansion: if you build a walled garden where 1.7 million children play, you own the safety architecture inside it. The audit requirement is the market signal that 'trust us' is no longer a product feature.
