'Get undressed': Roblox knows the risks. Why aren’t children better protected?

“you take a pic”

“Of me, Or u”

“you, I will rate”

Then came another message: “why are you taking so long”.

The exchange was among several that a mother discovered involving her young daughter on Roblox, the gaming platform she believed her child was using safely.

The girl, referred to here as Sophie to protect her identity, had been playing with what her mother described as the strictest parental controls switched on. Yet the conversations her family uncovered included requests for photographs, sexual references and discussion of removing clothes.

“We were absolutely horrified when we read the messages. We thought she was playing an educational game and was safe as we had the strictest parental controls set,” her mother told Mediaweek.

Sophie’s experience predates eSafety’s subsequent action involving Roblox. It does not establish what could happen under the platform’s current settings.

But her family’s complaint, Roblox’s acknowledgement, and the regulator’s later findings raise a question that another announcement about safety features cannot answer on its own: why hasn't a platform aware of these risks faced tighter restrictions on how children can be contacted?

Roblox has faced regulatory investigation and a court-enforceable undertaking. It has not escaped scrutiny. But after testing found adults could still contact children without parental consent, the company was given three months to make further changes and required to commission an independent audit.

For families relying on the protections already offered, the concern is what happens while those changes are being made.

The messages beneath the game

Sophie’s mother began investigating after noticing a change in her daughter’s behaviour.

“She became increasingly secretive about what she was doing on her iPad, which made us quite suspicious. When we checked the game, we didn’t find any inappropriate interactions. It wasn’t until we found another chat, disguised and embedded within the game, that we saw the extent of it,” she said.

In an email seen by Mediaweek, she told Roblox that most of the conversations appeared to have taken place through an in-game messaging feature within Life Together, an experience she said was classified as “all ages”.

She wrote that her daughter’s account had been set to “child”, with a date of birth entered. The exchanges nevertheless included adult and sexual themes.

The conversations were not limited to messages directed at Sophie. In one exchange, the child herself tells another user to “get undressed” during a discussion about “spicy” content.

In another, a user introduces a sexual reference, and Sophie asks: “What does that mean?”

A separate exchange makes her stated age explicit.

“I’m younger,” she writes.

When asked how old she is, she replies, “8”.

“im literally double ur age,” the other user responds, before asking how she knows about “spicy stuff”.

“My friend in Roblox,” Sophie replies.

The messages do not establish the identities or actual ages of the other users. The person claiming to be twice Sophie’s stated age said she was 16. Her mother suspected adults were involved and described the exchanges as grooming in her complaint.

What the messages document is sexualised conversation involving a child who, at points, did not understand what was being said.

READ MORE: New law could allow Australians to opt out of social media algorithms

READ MORE: 'Can't unsee it': Minns backs social media algorithm rules

What “all ages” actually covered

Roblox’s written response expressed concern and said it was investigating.

“We are deeply troubled to hear of your daughter’s experience,” the company wrote.

“Our team is actively conducting a thorough investigation into the user accounts associated with the chat interactions you shared, as well as the content of the game in which those interactions took place. Our investigations remain ongoing.”

The company outlined measures including screening uploaded content, filtering text chats, moderation and parental controls.

It said its standards prohibit sexual conversations with minors and predatory behaviour. Users found engaging in such conduct would be banned and, where appropriate, reported to law enforcement.

But its response also explained a distinction relevant to the mother’s complaint about the game’s age classification.

“User behaviour within experiences is dynamic and always changing, so the user behaviour that may occur within an experience is not rated within Experience Guidelines.”

Those guidelines assess an experience’s content, with creators completing a questionnaire about what they made. They do not cover every interaction players might have.

For a parent deciding whether to let a child play, that distinction matters. An “all ages” classification does not assure parents about the conversations that can take place inside the game.

Sophie’s mother said the response left her concerns unresolved.

“We contacted Roblox, and they gave us a generic reply and didn’t take any of our concerns seriously,” she told Mediaweek.

The correspondence shows Roblox committed to investigating. It does not include the outcome.

It does, however, establish that the company was alerted to this child’s experience. Regulators have also engaged with the broader risks over time.

The question is therefore what restrictions should apply when a company knows children can encounter sexualised interactions, and how quickly those restrictions should take effect.

A gaming exemption does not settle the safety question

An eSafety spokesperson told Mediaweek that Roblox currently does not meet the criteria for an age-restricted social media platform under Australia’s social media minimum age legislation, which provides specific exemptions for gaming and messaging platforms.

“Being outside the social media minimum age requirements does not mean Roblox is outside Australia’s online safety framework,” the spokesperson said.

The spokesperson said the minimum age requirements were one regulatory tool alongside mandatory codes and standards covering eight technology sectors under the Online Safety Act 2021.

For Roblox, that includes the mandatory industry standard for gaming services. eSafety investigated the company’s compliance by testing its safety features and settings.

That testing identified gaps the regulator considered continued to put children at risk.

Adults could send connection requests to young Australian children without parental or carer consent. Children and adults could also view and respond to each other’s forum posts outside game environments without that consent.

Anyone on Roblox could see children’s connections. Their profiles exposed information including account names, avatar images, interests and connection details, with no option to restrict its visibility.

These findings concern different features from the in-game conversations Sophie’s mother described. They do not establish that her daughter’s experience could be repeated under current settings.

They do show that the regulator found ongoing weaknesses in protecting children, despite earlier safety commitments.

Roblox’s exclusion from the social media minimum age requirements explains its current regulatory treatment. It does not answer whether that treatment adequately reflects the risks of its communication features.

For a child receiving a sexual message, the distinction between a gaming service and a social media platform offers little protection.

Three months to make the changes

Following its investigation, eSafety accepted a court-enforceable undertaking from Roblox in August to introduce additional protections against grooming, sexual exploitation and abuse, the spokesperson told Mediaweek.

The commitments include measures to prevent adults from contacting children without parental consent, make children’s accounts private by design and improve user reporting features.

“Roblox has three months to implement these changes,” the spokesperson said.

The undertaking also requires independent scrutiny of whether the changes work. The regulator has publicly reported on its investigation and the three-month implementation period. 

Roblox maintains it is meeting its obligations under the Online Safety Act.

“Importantly, Roblox cannot mark their own homework with the undertaking, including an obligation for it to appoint an independent auditor to provide a report on the efficacy of its implementation, indicating that it is truly creating a safer environment for young Australians,” the eSafety spokesperson said.

eSafety Commissioner Julie Inman Grant has previously described the requirement as the first time third-party auditing has been mandated under Australia’s Online Safety Act. She warned the regulator will take further enforcement action if Roblox fails to meet its commitments.

These are enforceable obligations, rather than voluntary assurances.

But the material provided to Mediaweek does not explain why the regulator considered the undertaking and its implementation period sufficient, or whether it considered tighter interim restrictions on the features identified as unsafe.

That is an accountability question for the regulator and the company: when testing identifies ways adults can contact children without consent, what level of access should remain while the platform fixes them?

The scrutiny extends beyond Roblox

eSafety’s transparency report, released on 2 October, examined safeguards across Roblox, Fortnite, Minecraft and Steam between 1 October 2025 and 31 March 2026.

The spokesperson said the report drew on information obtained through compulsory transparency notices under the Basic Online Safety Expectations framework.

It found significant differences between services’ child safety measures and continuing gaps in preventing and responding to serious harms.

“While Roblox has introduced stronger age assurance measures following extensive engagement with eSafety, there is still significant work to be done across the online gaming sector to prevent serious harms to children,” the spokesperson told Mediaweek.

Valve, which operates Steam and Steam Chat, was the only provider assessed that did not use hash-matching technology to identify known harmful content. Its proactive detection on Steam Chat largely relied on a tool targeting scam links.

Roblox and Valve relied exclusively on internal datasets to train language detection systems and did not regularly retrain those models.

Age checks were also inconsistent.

Minecraft and Fortnite offered protections for child accounts but generally relied on users declaring their own age. In some cases, users claiming to be adults could access higher-risk communication features without further checks.

During the reporting period, Steam relied on self-declared ages, although it has since introduced credit card age checks. eSafety is seeking additional age assurance options from the service.

Roblox introduced stronger age assurance measures in December 2025.

Responding to the report, a Roblox spokesperson said: “Roblox prioritises the safety of our Australian community, especially our youngest users”.

The company said it continued to strengthen safeguards, including detection technology and mandatory age checks for chat access.

Those measures need to be assessed against what they prevent. Announcing a protection and demonstrating that it works are separate tasks.

A family’s trust, gone

The eSafety spokesperson urged parents to enter children’s real ages when setting up accounts, use parental controls and limit risky communication features, including private messaging and gift-giving.

The spokesperson also said regular conversations about who children interact with are important. Warning signs include requests for private information, significant gifts, demands for secrecy and encouragement to move to a more private platform.

Sophie’s mother said she believed the account settings and parental controls were already protecting her daughter.

“She has never been allowed near Roblox again. Neither have any of our kids. We are so deeply scarred by the experience. The parental controls mean absolutely nothing,” she said.

That is her assessment of the protections her family used at the time. It is not a finding about every parental control now available on Roblox.

But it exposes the problem with placing so much responsibility on parents: they can enter an age, switch on controls and check a game’s classification, yet still misunderstand what those protections cover.

Roblox’s undertaking now sets a deadline for further improvements and requires an independent assessment of their effectiveness.

The unresolved question is why children should retain access to communication features found to put them at risk while those improvements are pending, and what would trigger tighter restrictions before another deadline passes.

For Sophie’s family, the decision has already been made. Their children will not be returning.