Australia’s online safety regulator has caught Roblox with its safety features down, and the company is scrambling to fix a child protection problem that won’t go away.

eSafety, the regulatory body that enforces Australia’s Online Safety Act, has been investigating whether Roblox complies with the law’s requirements to prevent adults from contacting children under 16 on its platform. The verdict: it doesn’t. Testing conducted this year found that Roblox “continued to put children at risk” even after the company implemented new safety measures in response to the regulator’s concerns.

This matters because Roblox isn’t just being scolded. It’s the first platform forced to submit to independent safety audits under Australia’s Online Safety Act, which means the company now has to prove it can actually protect kids or face potential penalties. The law gives eSafety real enforcement teeth, including the power to fine companies up to 2% of global revenue for serious breaches.

What eSafety Found

The specific findings are damning. eSafety alleges that Roblox failed to have “sufficient measures in place to prevent contact between adults and children under 16.” This isn’t theoretical risk. The platform has faced documented problems with predators using it to target children, and eSafety’s testing shows those problems persist.

Roblox has responded by promising more changes to its child safety features. The company has been adding restrictions, but the regulator’s testing proves those changes haven’t been enough. Getting caught in compliance testing is different from getting bad press. Australia’s regulatory framework doesn’t just ask platforms to try harder. It requires specific, measurable safeguards.

How Australia’s Law Works

The Online Safety Act takes a harder line than most countries. It requires platforms to proactively prevent harm to children, not just respond after something goes wrong. That includes blocking contact between adults and minors who don’t know each other, age-gating inappropriate content, and building safety features into product design from the start.

The independent audit requirement is the enforcement mechanism that makes this work. Instead of trusting companies to self-report compliance, eSafety can require third-party auditors to test whether safety measures actually function as promised. If platforms fail those audits, they have to fix the problems or face escalating penalties.

This is a stronger approach than the trust-and-verify model used in the US, where platforms largely regulate themselves until something explodes into public scandal. Australia is betting that mandatory testing will catch problems before children get hurt.

What Happens Next

Roblox now has to implement changes that will pass eSafety’s next round of testing. The company hasn’t specified exactly what those changes will be, but the regulatory pressure is real. Australia represents a significant market, and failing to comply could mean fines or even restrictions on operating in the country.

Other platforms should be watching closely. eSafety has made it clear that Roblox won’t be the last company subjected to this level of scrutiny. Any platform with significant youth audiences and social features is potentially subject to the same compliance requirements and audit process.

The case also sets a precedent for how safety regulations can actually be enforced. Laws requiring platforms to protect children are common. Laws that include mandatory independent testing to verify compliance are not. If Australia’s approach works, expect other jurisdictions to copy it.

For Roblox, this is an expensive problem that won’t go away with better PR. The company has to build safety measures that actually work and then prove it to auditors who will actively try to break them. That’s a much higher bar than issuing a press release about new safety features.

The bigger question is whether any platform with open social features can truly prevent determined adults from contacting minors. Roblox’s struggle suggests the answer might be no, at least not without fundamentally changing how these platforms work. Australia’s law is forcing that conversation out of the theoretical and into the practical. Either the technology can be made safe for children, or it can’t. We’re about to find out which.