What eSafety actually secured
On 20 August 2026, Australia's eSafety Commissioner accepted a court-enforceable undertaking from Roblox. eSafety acted on concerns that Roblox was not meeting its obligations under the Online Safety Act's codes and standards, including the Relevant Electronic Services Standard, because its testing found Roblox did not stop adults from contacting children under 16. The Bitdefender report on the undertaking says eSafety's testing earlier in 2026 found three problems. Adults could send connection requests to children without parental consent. Children and adults could reply to each other's posts in forums outside the games. Children's connections, account names, avatars and biographies were visible, with no way to limit that.
Roblox now has three months to do four things. It must block adult contact with unknown children unless a parent consents. It must default children's accounts to private. It must notify users of the outcomes of their complaints. And it must have its safety measures, including its age-estimation technology, assessed by an independent third-party auditor. eSafety says this is the first time it has required a tech company to undergo an external safety audit. If Roblox breaches the undertaking, eSafety can apply to the Federal Court for an order requiring compliance, along with any other orders the court considers appropriate. Roblox says it was already compliant and had "delivered on the commitments we made to eSafety over the last 12 months," according to Reuters coverage carried by The Star.
The strongest case for the regulator
The case for eSafety is a serious one and deserves a fair statement. Roblox is not a niche service. Bitdefender, citing Roy Morgan research quoted by eSafety, reports about 1.7 million Australian children use it, making it the country's second-most-popular game among children. A platform of that reach, built around user-generated worlds and open chat, is a natural place for adults to approach children. Voluntary commitments have a poor record when the company marks its own homework, and the Commissioner put it bluntly: "Roblox cannot mark their own homework." If a regulator tests a platform, finds adults can still reach children, and the platform replies that it already complies, the regulator has good reason to want something it can enforce.
Why this instrument is better than the alternatives
Our editorial view is that the tool matters as much as the target. Child safety on gaming platforms is a real problem, and a regulator that acts on it is not overreaching. The question is what kind of obligation it imposes. The Roblox undertaking has three features that fit proportionate, evidence-based regulation.
It targets a specific, testable harm. The duties are narrow: adults should not be able to cold-contact unknown children, children's profiles should not be public by default, and complaints should get a response. Each can be checked by trying it. That differs from open-ended "duty of care" language, which leaves companies guessing and tends to push them toward over-removal of lawful content.
It is aimed at design, not speech. Nothing in the undertaking requires Roblox to monitor or take down lawful expression. Contact controls and private-by-default settings change who can reach whom. They do not decide what may be said. For a publication that defends free expression, that is the right place for a child-safety rule to land.
It is auditable. An independent assessment of the age-estimation technology is the part with the most lasting value. Age assurance is the enforcement mechanism behind much of the world's new child-safety law, and regulators and platforms mostly assert that it works rather than show it. An outside audit that tests accuracy produces evidence that other regulators, and the platform's users, can read.
Where the model is exposed
The approach carries real risks, and they should be named. First, age estimation is a privacy trade-off. Estimating age usually means processing facial or behavioural data about children. An audit that checks accuracy but not data minimisation, retention and error rates across demographics would validate the wrong thing. The public should be told what the auditor is asked to test. The material we reviewed does not state the audit's scope, the auditor's identity or when reports are due, and those details will decide whether this is a real check.
Second, an undertaking is negotiated, and negotiated outcomes can drift into compliance theatre. The Roblox statement shows the gap: the company says it was already compliant, while the regulator says testing showed otherwise. Both cannot be fully right. A transparent follow-up test, published by eSafety after the three months, would resolve it and would show whether the undertaking worked.
Third, there is a displacement risk. Defaults that push children's contact toward private channels can move risky interactions to other apps with weaker moderation. A rule that works on one platform's front door should be judged on whether children end up safer overall, not only on whether Roblox's dashboards improved.
What other regulators should take from it
The wider lesson is about sequencing. eSafety tested first, found specific failures, secured specific fixes with a firm deadline, added outside verification, and kept court enforcement in reserve. That is a better template than blanket age-gating of whole categories of service or vague statutory duties enforced with after-the-fact fines. It gives companies a clear target and a fair chance to meet it. It also gives the regulator a standing method: test, require, audit, re-test.
The measure of success is simple. After 20 November 2026, three months from the acceptance date, eSafety should re-run its tests and publish the results. If adults can no longer cold-contact unknown children, if children's accounts are private by default, and if the auditor's findings are public, Australia will have shown that child safety rules can be specific, verifiable and compatible with an open, innovative internet. If the results are not published, the undertaking will be one more promise that cannot be checked.