Gaming giant Roblox has been forced to overhaul its privacy settings to shield children from adult strangers, signing a legally binding agreement with Australia’s online safety regulator.

eSafety accepted the court-enforceable undertaking after concluding the company was not meeting its obligations under the Online Safety Act’s codes and standards, including an alleged failure to stop contact between adults and children under 16.

About 1.7 million Australian children use Roblox, according to Roy Morgan research from December 2025, making it the second most popular game with children in the country.

Regulator testing earlier this year found adults could send connection requests to young Australian children without a parent’s consent.

It also found children’s connections were visible to anyone on the platform, as were their profiles and biographies, including account names, avatar images, the names and number of their connections and their stated interests. Children had no option to restrict who saw that information. Children and adults could also read and reply to each other’s posts on forums outside game environments.

Australia’s electronic services standard – a mandatory national code for online gaming and messaging services – requires children’s accounts to be private by default and reporting tools that tell users the outcome of their complaints.

Roblox says it believes it is already meeting its obligations. It has nonetheless agreed to prevent adults from contacting unknown children without parental consent, strengthen default privacy settings on children’s accounts and provide reporting mechanisms that notify users of complaint outcomes.

The company has three months to make the changes.

It has also agreed to hire an independent auditor to assess whether its safety measures work, including the deployment of its age-estimation system. It is the first time third-party auditing has been required under the Online Safety Act.

“Critically, the inclusion of third-party auditing ensures Roblox cannot mark their own homework,” eSafety Commissioner Julie Inman Grant said.

Inman Grant said the regulator had engaged with Roblox at senior levels for some time and the company had responded with improvements, but warned eSafety would not hesitate to take further enforcement action if the commitments were not delivered. If Roblox breaches the undertaking, the regulator can ask the Federal Court to order it to comply.

A Roblox spokeswoman said the undertaking followed “constructive dialogue” with eSafety and came after the rollout of the company’s Kids and Select accounts for under-16s.

“We have delivered on the commitments we made to eSafety over the last 12 months and will continue to work towards our shared goal of keeping Australian children safe online,” the spokesperson told this masthead.

It comes during a year in which Roblox rebuilt access to its social features around age. Australia was one of the first three markets, alongside New Zealand and the Netherlands, where facial age estimation became mandatory for chat in December, ahead of a global rollout in January. Roblox said this month the system had processed 338 million age checks.

The video game giant is currently facing lawsuits from several US state attorneys-general, including one filed by Nebraska in March, which alleged Roblox exposed children to predators while marketing itself as safe. Roblox disputes those claims.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.

David Swan is the technology editor for The Age and The Sydney Morning Herald. He was previously technology editor for The Australian newspaper.Connect via X or email.