Australia’s online safety regulator has forced Roblox into a court-enforceable agreement to overhaul its child safety protections after testing found that adults could contact minors without parental consent. The regulator, eSafety, said its testing revealed that adult strangers could send connection requests to children, whose profiles, biographies, contact lists, and avatar images were visible to anyone on the platform with no option to restrict that visibility. Those requests did not trigger parental alerts, and adults could also search children’s public contact lists to find more targets. The agency also found that adults could search for kids and comment on their posts in forums outside game environments without parental or carer consent.
The agreement, announced Thursday, comes under Australia’s Online Safety Act, which requires platforms to prevent unwanted adult-minor contact and set children’s accounts to private by default. Roblox, which is used by 1.7 million Australian children and is the country’s second most popular online game for kids, will have three months to make changes. Those changes include strengthening children’s account settings so they are private by default, requiring parental consent before adults can contact kids, making it easy to report unwanted contact, and notifying users of the outcomes of their reports.
eSafety Commissioner Inman Grant said the regulator’s testing suggested Roblox can no longer be trusted to independently verify that its child safety tools comply with Australian law. Grant said Roblox cannot “mark their own homework” and has agreed to third-party auditing. This is the first time Australia has required third-party auditing since the Online Safety Act became enforceable, Grant added. The regulator warned Roblox last October that it remained highly concerned about reports of child exploitation on the service and exposure to harmful material.
The third-party audit will also give eSafety a window into Roblox’s age estimation tools. If Roblox is mislabeling kids as adults, giving them access to adult content, or exposing them to predators, the company could face fines of up to $49.5 million under the Online Safety Act. Roblox has defended its age-estimation system, saying in a blog post that its in-house Facial Age Estimation system uses artificial intelligence to keep age checks current. The company said the system has processed 338 million age-check records to help users unlock age-appropriate chat and games.
Roblox said its fused model produces high-confidence estimates that remain consistent day to day, with more than 99 percent of users staying in the same broad age band on consecutive days. In tests against independent human reviewers, the model’s age-band estimate agreed with the adult label more than 80 percent of the time. The company said owning the system in-house lets it leverage Roblox-specific signals and iterate quickly, but eSafety plans to continually audit its effectiveness. Roblox’s spokesperson said the undertaking follows constructive dialogue with eSafety and comes after recent rollout of safety features including new Kids and Select accounts for under-16s.
In January, Roblox announced it would become the first large online gaming platform to require facial age checks. Those biometric checks have proven controversial, unpopular with users, and alarming to privacy advocates, who see even the latest age verification tools as flawed. While Roblox says it usually automatically deletes selfies submitted for age verification, it may retain that data for up to 30 days, leaving it open to potential breaches. Later this year, eSafety will release a transparency report detailing how well online gaming services like Roblox have mitigated harms to kids, requiring platforms to explain steps they take against child sexual exploitation, violent material, and cyberbullying.
More technology news from TechManNews.
