Roblox forced into court-enforceable safety deal, and it’s yet more proof our age verification obsession isn’t working

Roblox has been forced into a court-enforceable undertaking with the eSafety Commissioner, agreeing to a raft of changes after the regulator’s own testing found serious gaps in how the platform protects kids from being contacted by adult strangers.

It’s a big deal. Roblox is the second most popular gaming platform with kids in this country, with an estimated 1.7 million Australian children using it. eSafety’s testing found adults could send connection requests to young Australian children without a parent even knowing, kids and adults could interact on forums outside the actual game, and children’s profiles, including their connections, avatar and interests, were visible to literally anyone on the platform.

Roblox has now committed to preventing adults from contacting unknown kids without parental consent, making children’s accounts private by default, building in proper reporting tools, and bringing in an independent third-party auditor to check its safety measures actually work, including its age-estimation technology.

That last point is where I want to focus, because it’s the bit that should worry everyone pushing Australia’s age verification agenda.

eSafety Commissioner Julie Inman Grant made a point of saying the third-party audit means Roblox “cannot mark their own homework” when it comes to its age-estimation tools. Read between the lines and what that tells you is pretty clear: even the regulator isn’t confident these systems are doing what they’re supposed to do without someone independent checking their work.

We keep being told age verification and age estimation technology is the answer to keeping kids safe online. It’s the entire premise behind the social media minimum age ban. But here we have the government’s own regulator finding gaps in one of the biggest platforms kids use, specifically around age-related safety controls, and having to force an independent audit just to find out if it’s working at all.

And this isn’t an isolated case. eSafety’s own research into the under-16 social media ban, which has been in effect since December, found more than eight in ten Australian teens are still using banned platforms months later. Kids are using VPNs, printed face masks and their parents’ ID to sail straight through the age checks these companies swear are robust. The government’s response was to double the penalties for platforms, up to $99 million, rather than admit the technology underpinning the whole policy has holes in it.

So we’ve got a social media ban that most affected teens are simply working around, and now a gaming platform used by 1.7 million Australian kids where the regulator has had to step in and mandate independent checking of the age tools in place. That’s not a coincidence, that’s a pattern.

Roblox, for its part, says it has delivered on the commitments it made to eSafety over the past year. A spokesperson told EFTM the undertaking follows “constructive dialogue” with the regulator and comes after the rollout of new Roblox Kids and Select accounts for under-16s in Australia.

“We have delivered on the commitments we made to eSafety over the last 12 months and will continue to work towards our shared goal of keeping Australian children safe online,” the spokesperson said.

To be fair to Roblox, they’ve made some genuine moves. They were the first major online gaming platform to require facial age checks for all users, of any age, just to access chat, specifically to limit adults talking to kids. They don’t allow image or video sharing in chat, and they deliberately don’t encrypt chat so they can actually monitor for dodgy behaviour. Their parental controls cover content ratings, screen time, spending limits and now extend some features up to age 15.

None of that is nothing. But it also doesn’t change the fact that eSafety’s testing found real holes, and that an independent auditor is now needed to confirm the age-estimation side of things actually works as advertised.

Roblox will have three months to make the changes required under the undertaking. If it doesn’t comply, eSafety can take it to the Federal Court.

The bigger picture here is the one that matters. We keep legislating and regulating around the assumption that age verification technology is basically solved and just needs enforcing harder. What we’re actually seeing, again and again, is that the technology is patchy, kids find the gaps faster than platforms can close them, and regulators are having to force independent audits just to check whether the tools everyone’s relying on actually do the job.

And this isn’t a shock, the Government’s own commissioned research into age verification technology found this – before we pushed the social media ban onto families.

The answer here is to let parents be parents, and give them the tools to parent in a digital age.