Key Takeaways
- The undertaking is legally binding. Roblox signed it on August 17, 2026; eSafety accepted it on August 19, and it stays in force for three years.
- The core problem: eSafety’s testing found adults could send connection requests to children without triggering any parental notification, and children’s profiles — including names, interests, and connections — were visible to anyone on the platform.
- Roblox has three months to roll out fixes, including an independent third-party audit of its safety systems, including its age-estimation technology.
- If Roblox doesn’t comply, eSafety can take the matter to Australia’s Federal Court and seek a binding order.
- This isn’t isolated to Australia — Roblox is also facing a Texas Attorney General lawsuit and a U.S. Senate inquiry over similar child-safety concerns.
How We Got Here: A Two-Year Timeline
This undertaking didn’t come out of nowhere — it’s the outcome of an extended, escalating conversation between eSafety and Roblox that’s been building since 2025.
What eSafety’s Testing Actually Found
The regulator’s investigation centered on whether Roblox was meeting its obligations under Australia’s Online Safety Act — specifically the Relevant Electronic Services Standard, which covers platforms like Roblox and requires children’s accounts to default to private, with accessible complaint-reporting tools. eSafety’s own testing turned up several gaps between what Roblox claimed and what its systems actually did:
- ⚠️Adults could send connection requests to children without any parental consent required — and without triggering an alert to a parent or guardian.
- ⚠️Children’s profile information was publicly visible to anyone on the platform, including account names, stated interests, and existing connections.
- ⚠️Children and adults could interact on forums outside the games themselves — viewing and responding to each other’s posts without parental approval, even though the account-level protections were supposed to prevent this kind of contact.
- ⚠️The complaint-reporting system fell short of the standard’s requirement to give users accessible ways to report harmful content and be notified of the outcome.
In effect, the safety measures Roblox introduced in December 2025 — private-by-default accounts for under-16s — didn’t hold up under the regulator’s own testing.
What Roblox Has Committed to Fix
Under the undertaking, Roblox has three months to implement a specific set of changes, with an independent auditor brought in to verify the work actually gets done rather than taking the company’s word for it.
- ✅Block adults from contacting unknown children without explicit parental consent.
- ✅Strengthen default privacy settings so children’s accounts stay private without requiring extra setup from a parent.
- ✅Improve complaint and reporting tools, including clearer notification when a report has been resolved.
- ✅Bring in an independent third-party auditor to assess Roblox’s safety systems, including its age-estimation technology — the tool meant to flag when an account is likely being used by a child or an adult.
A Roblox spokesperson responded that the company had “delivered on the commitments we made to eSafety over the last 12 months,” and said it would keep working toward the shared goal of child safety on the platform. Commissioner Inman Grant, for her part, said eSafety would not hesitate to pursue further enforcement if Roblox fails to deliver on what it’s now legally committed to.
| Requirement | What It Means in Practice |
|---|---|
| Consent-gated contact | Adults cannot message or send connection requests to an unknown child’s account without a parent approving it first. |
| Private-by-default accounts | Under-16 accounts stay private out of the box — no manual setup required by parents to get baseline protection. |
| Independent safety audit | A third party — not Roblox itself — reviews whether the age-estimation and safety tools actually work as claimed. |
| Reporting transparency | Users who report harmful content are told what happened with their report, rather than submitting it into a black box. |
Bigger Picture: Roblox’s Global Regulatory Pressure
Australia isn’t the only jurisdiction scrutinizing Roblox right now. In the United States, Senators Josh Hawley and Dick Durbin have opened a congressional inquiry, requesting records related to abuse cases and the financial exploitation of younger players on the platform. Separately, Texas Attorney General Ken Paxton has filed suit against Roblox, alleging the company marketed itself as safe while predators were able to expose children to explicit material; Roblox has already paid roughly $91 million to settle a number of related cases, though the Texas case — with a potential trial date in 2028 — remains contested, including a dispute over whether internal emails from CEO David Baszucki must be produced.
What This Means If Your Child Plays Roblox
None of this means Roblox is uniquely dangerous compared to other platforms with large child audiences — but the findings are a useful, concrete reminder of where the gaps actually are, rather than where the marketing says they are.
Don’t assume default settings are correctly applied — verify privacy and contact settings directly in your child’s account rather than trusting they’re on by default.
A common grooming pattern is moving a conversation off the platform — to email, texting apps, or other messaging services. Treat any request to “chat somewhere else” as a red flag.
Names, interests, and connections were found to be publicly visible under the old settings. Check what’s currently exposed on your child’s profile and lock it down manually if needed.
Settings can lag behind what’s actually happening on a platform, as this case shows. An ongoing, judgment-free conversation about who your child talks to online is still the most reliable safeguard.
Frequently Asked Questions
Roblox remains widely used and hasn’t been banned or restricted by regulators. The undertaking requires Roblox to fix specific, verified gaps in its safety systems — it’s a regulatory correction, not a platform-wide ban.
eSafety can apply to Australia’s Federal Court for an order compelling Roblox to comply, along with any other remedy the court considers appropriate.
The undertaking itself is an Australian legal agreement. However, Roblox is facing separate scrutiny in the United States, including a Texas lawsuit and a congressional inquiry, over related child-safety concerns.
The undertaking remains in force for three years from its acceptance date of August 19, 2026, though Roblox must implement the specific required changes within three months.
