eSafety tested Roblox's child-safety controls itself, then extracted an enforceable undertaking

Roblox has agreed to a court-enforceable undertaking in Australia after the eSafety commission ran its own tests and found adults could still make contact with children on the platform ^[1][2]. The detail that matters to anyone shipping trust-and-safety features is that the regulator did not read the release notes and move on: it probed the live product and wrote the remedy against what it found.

According to eSafety, its tests showed adults could still send connection requests to Australian children without parental consent, and that children and adults could view and respond to each other's posts on community forums ^[3][4]. It also found that anyone could view an underage user's connections, profile, biography, account name and avatar image, with no option to restrict that visibility ^[5]. Those findings came earlier this year, after Roblox had rolled out new measures over the preceding months and after two years of engagement with the regulator ^[2].

Set that against the shipping record. Roblox made age verification mandatory in late 2025, starting with Australia, most likely because of eSafety's work ^[6]. That rollout had problems, including children spoofing the age check, though Roblox maintained its technology works ^[7]. Verification was then extended to in-game chat in the US ^[8]. By mid-May this year the platform had split users into three tiers, Kids, Select and regular Roblox, with Kids accounts limited to Minimal or Mild content, chat off by default and parental controls attached ^[9][10]. The tier system went global in June ^[11].

So the age gate existed and the tiers existed, and the contact path was still open. That is the useful lesson: age assurance is an input, not an outcome. Knowing a user is twelve does not by itself make that user's connections list private, close a forum reply, or stop an inbound request. eSafety's findings read as a catalogue of defaults that were never changed to match the new age signal ^[3][4][5].

The undertaking is written accordingly. Roblox has agreed to stop adults contacting children they do not know without parental consent, make children's accounts private by default, provide accessible reporting mechanisms, and have a third-party auditor assess whether its safety measures actually work ^[13]. It has three months to deliver, after which eSafety can ask a court to compel compliance ^[14]. eSafety says Roblox believes it is already meeting its obligations under the Online Safety Act ^[12]. Three months is one eighth of the two years the regulator spent engaging before it got a signed instrument ^[19].

The auditor clause is the part to copy into your own risk register. Self-attestation that a control is live is no longer the end of the conversation, and "our technology works" is a claim a regulator can now test and contradict ^[7].

None of this sits alone. Roblox faces lawsuits from several US states ^[15], and in May agreed to pay Nevada $12 million and to introduce verification using government-issued IDs and facial age estimation ^[16] - though under the current system a user need only complete one of those two methods ^[17]. It also committed to blocking under-16s from messaging adults unless the adult is a designated "trusted friend", assigned by QR code ^[18].