Australia Forces Roblox into First-Ever External Safety Audit Over Child Protection Failures

Australia's online safety regulator has forced Roblox to overhaul its child protection systems after finding the platform's safety measures inadequate. The eSafety Commissioner secured a court-enforceable undertaking that mandates immediate technical changes and the company's first-ever independent external safety audit.

Regulator testing identified critical failings in the platform's architecture. Specifically, eSafety found that adults were able to send connection requests to children without parental consent and that both adults and children could interact on forums outside of games without approval. Additionally, the regulator discovered that children's profiles, biographies, and connection lists remained publicly visible to other users. In response, Roblox has three months to implement measures that prevent adults from contacting unknown children without consent and to ensure children's accounts are private by default.

A Shift in Regulatory Oversight

Roblox has faced long-standing criticism regarding grooming and sexual predation. While the company previously claimed to have improved its safety features, subsequent testing by the Australian government proved these fixes were insufficient to comply with the Online Safety Act. This regulatory action marks a pivot toward active verification over corporate promises.

As part of the agreement, Roblox must hire an independent third-party auditor to assess its safety measures and age-estimation technology. This is the first time the eSafety Commissioner has mandated an external audit for a technology firm, signaling an end to the era of self-reporting. "Roblox cannot mark their own homework," said eSafety Commissioner Julie Inman Grant. Communications Minister Anika Wells added that the safety of children online is "non-negotiable."

Global Pressure and Industry Precedent

The Australian crackdown coincides with intensifying scrutiny in the United States. The US Senate Judiciary Subcommittee on Crime and Counterterrorism has opened an investigation into Roblox, citing a public record of arrests for kidnapping, rape, murder, and sexual abuse of children who met via the platform.

This case sets a significant legal precedent for the gaming industry. By utilizing court-enforceable undertakings and mandated third-party audits, regulators are demonstrating that they will no longer accept company-led safety reports. The move signals a broader shift toward using active, adversarial testing to verify compliance with child protection laws across the tech sector.

What to Watch

Industry observers are now monitoring whether Roblox can meet the strict three-month deadline for its technical upgrades. The results of the independent audit will be critical, as they will provide the first external validation of the platform's age-estimation tools. It remains to be seen if other global regulators will adopt the Australian model of court-enforceable undertakings to compel similar changes from other social gaming giants.