Roblox has entered into a court-enforceable undertaking with Australia's online safety regulator after the regulator's own testing found weaknesses in how the platform separates adults from children. The eSafety Commissioner, Julie Inman Grant, accepted the undertaking after Roblox signed it. It runs for three years.
What the testing found
According to the regulator, adults were able to send connection requests to young children, and children's profile details and connections remained broadly visible to others. It also found that children and adults could see and reply to one another's posts in forums that sit outside the game environments themselves, without a parent or carer having agreed to it.
That last point is the one parents are least likely to have considered. A great deal of attention goes to what happens inside a game, where a child is visibly playing something. The surrounding layer of profiles, friend lists and forums is where contact is initiated, and it is easy to overlook precisely because it does not look like playing.
What Roblox has to do
The company has three months to roll out a set of measures: stopping adults from contacting children they do not know without parental consent, making children's accounts private by default, and improving both how complaints are handled and how users are told what came of them.
The requirement with the longest reach is the last one. Roblox must commission an independent third party to assess whether the new controls actually work, including its age-estimation technology and whether users can get around it. Regulators have generally accepted platforms' own accounts of their safety systems, and an external assessment sets a different standard of proof.
What happens if it does not
The undertaking took effect on acceptance. If Roblox breaches it, eSafety can apply to the Federal Court for orders requiring compliance, along with other orders the court thinks appropriate. That is the difference between an undertaking of this kind and a voluntary commitment: the regulator does not have to start from the beginning to enforce it.
Roblox's position
Roblox has said it delivered on the commitments it made to eSafety over the past year and will keep working toward what it describes as a shared goal of keeping Australian children safe. The company points to changes already made, including age assurance for access to chat features and communication features switched off by default for Australian users.
Both accounts can be accurate at once, and largely are. Roblox did make substantial changes; the regulator's testing then found gaps that those changes did not close. The disagreement is less about what was done than about whether doing it was enough.
The wider setting
Roblox sits in an unusual regulatory position in Australia. It is not covered by the country's social media age restrictions, but it remains subject to the Online Safety Act and to the codes and standards made under it, which is the authority eSafety is using here.
Australia has become the jurisdiction where these questions get tested first, and platforms tend to build one system rather than several. Controls engineered to satisfy an Australian regulator have a way of appearing in other markets some months later, which is why an undertaking covering one country is worth the attention of parents in all of them.
