Tech Corner: Roblox agrees to child safety changes after eSafety testing

Roblox, the online gaming and game-creation platform used by millions of children worldwide, has agreed to a court-enforceable undertaking with eSafety, Australia's online safety regulator, after testing found gaps in the platform's protections against grooming and sexual exploitation. The undertaking, accepted by eSafety on last week, addresses three specific breaches of the Online Safety (Relevant Electronic Services – Class 1A and Class 1B Material) Industry Standard 2024. Roblox has committed to ensuring it does not, or is unlikely to, breach: section 18(4)(f), which requires tools and settings preventing adult users from contacting a child under 16 without a parent or carer's consent; section 18(4)(g), which requires a young Australian child's account to be private by default; and section 28(3)(b), which requires easily accessible reporting tools for flagging class 1A and class 1B material on the service. Testing by the regulator had found that adults could send connection requests to children without a parent's consent, that children and adults could interact through forums outside games without parental approval, and that children's connections and profiles remained visible to other users. The agreement follows almost two years of engagement between eSafety and Roblox over compliance with these standards, including transparency notices issued to Roblox and other gaming platforms in April requiring them to report on the steps taken to protect children from harms such as child sexual exploitation, violent material and cyberbullying. A report on the findings from those notices is expected later this year. Under the new undertaking, Roblox has three months to prevent adults from contacting unknown children without parental consent, make children's accounts private by default, and improve reporting systems so users are notified of the outcome of any complaint. The company has also agreed to engage an independent third-party auditor to assess whether its safety measures actually work, including the age-estimation technology it uses to guess a user's age. eSafety said this is the first time it has required this kind of external safety audit from a tech company. If Roblox fails to meet these commitments, eSafety can apply to the Federal Court for an order requiring compliance, and can seek other orders as well. Breaches of eSafety's industry codes and standards can also carry penalties of up to $49.5 million. eSafety commissioner Julie Inman Grant said the regulator would not rely on the platform's own assurances, telling reporters "Roblox cannot mark their own homework". Inman Grant noted Roblox is the second most popular game with children in Australia, with national research estimating about 1.7 million Australian children use the platform. A Roblox spokesperson said the company had delivered on the commitments it made to eSafety over the past 12 months and would continue working toward keeping Australian children safe online. For families with children using Roblox or similar platforms, this is a timely reminder to check account privacy settings are set to private, and to talk with children about only accepting connection requests from people they know offline. eSafety's website, esafety.gov.au, has guidance for parents on setting up child accounts safely across major gaming and social platforms.