On 2 October 2026, Australia's eSafety Commissioner published a transparency report on how four online game services handle child grooming and radicalisation. The report follows legally enforceable notices issued on 22 April 2026 to Roblox, Minecraft, Fortnite and Steam, according to Digital Policy Alert's tracker. It is a useful test of a regulatory tool that deserves more attention than blunt bans get: compelled disclosure.
The strongest case for the regulator
The case for acting is serious. Commissioner Julie Inman Grant says predatory adults target children through grooming, and that gaming-adjacent services can be a child's first point of contact with an offender. She says the core player base is eight- to 13-year-olds. Games are also exempt from Australia's under-16 social media ban, so without scrutiny they could become the default place where the youngest users sit with the least oversight. Companies know far more about their own detection systems than any outsider does. A regulator that cannot see inside the systems cannot judge them.
What the law actually does
The notices rest on the Basic Online Safety Expectations, set out in Part 4, Division 2 of the Online Safety Act 2021. Reporting notices, periodic and non-periodic, sit in Division 3 of the same Part. The mechanism asks companies to explain what they do. It does not prescribe a technology or ban a feature. The April notices asked how each service handles grooming and radicalisation, covering systems, staffing and safety design. That is a proportionate instrument: the burden is a documented answer, and the regulator can compare answers across firms.
What the report reportedly found
We could not retrieve the full report text, so this analysis relies on press coverage of it. Per AAP's account in the Newcastle Herald, eSafety found that some platforms added safety mechanisms after receiving the notices, but that significant gaps remained. Those gaps could lead to immediate harm for children.
The differences between the four services are instructive.
- Mojang Studios (Minecraft) and Roblox took part in multiple industry initiatives against child sexual exploitation online. Valve (Steam) did not.
- Epic Games (Fortnite) and Mojang rely on users declaring their own age. Users who say they are 18 or over can reach high-risk features, including all-ages chatrooms and, in Minecraft's case, unmoderated third-party servers.
- Roblox, the second most popular game platform among Australian children, agreed to a court-enforced undertaking issued in August. It covers accessible reporting, blocking adults from contacting unknown children without parental consent, and private accounts for children by default. It also restricted certain features to Australians aged 18 and over from December.
Self-declared age is the clearest design flaw in this list. A child who types a false birth year gets adult-tier access, and no moderation team can offset that. It is a fixable, specific problem, which is the kind of finding a transparency regime is meant to surface.
Why transparency beats blanket restriction
The report also shows the mechanism changing behaviour. Some platforms improved while the process was still under way, before any penalty was imposed. Disclosure creates a reputational and legal incentive to close gaps quickly, and it does so without freezing product design. Compare that with the alternative of mandating one age-verification method across every service. A mandate would lock in one technology, push more sensitive data to more companies, and treat a small co-op creative game the same as a platform with millions of chat users.
There are real risks on the other side. Age assurance requirements took effect in March for all gaming platforms, according to the same coverage. Age checks can mean collecting biometric or identity data from children, which creates its own privacy risk. A regulator should therefore judge a platform on outcomes, such as how fast it takes down grooming attempts and how often adults can reach unknown minors. It should not simply count how many checks were run.
What to watch next
Three tests will show whether this is good regulation.
- Specificity. Follow-up should name the particular features at fault (open chat for self-declared adults, unmoderated servers) rather than demanding generic improvement.
- Evidence on outcomes. The next round of notices should ask for measurable results, such as report-to-action times and the share of child accounts with default-private settings, so regulators can compare services with the same yardstick.
- Proportionality across firms. Valve's absence from the industry initiatives is a legitimate concern. But a rule meant for a platform with a large child audience should not bind every small developer with a chat box.
Inman Grant herself said, "We'll have to see what they actually deliver in the coming months." That is the right posture. The report is a baseline, not a verdict.
The wider lesson
Other jurisdictions weighing game and chat regulation can take a practical point from Australia. Compelled disclosure, anchored in a statute and aimed at named design choices, gets better information than a ban and costs less than a mandate. It also keeps open the option of stronger action if companies do not improve. If gaps persist at the next review, the case for targeted obligations will be much stronger. Until then, publishing the evidence is the proportionate step.