Australia’s online safety regulator has accepted a court-enforceable undertaking from gaming giant Roblox to put in place robust measures designed to protect children from grooming, sexual exploitation and abuse.
eSafety accepted the undertaking following concerns that Roblox was not meeting its obligations under the Online Safety Act’s codes and standards, including allegedly failing to have sufficient measures in place to prevent contact between adults and children under 16.
The Relevant Electronic Services (RES) Standard which covers online gaming platforms like Roblox, also requires children’s accounts to be set to private by default and to provide accessible reporting mechanisms that notify users of complaint outcomes.
eSafety has engaged extensively with Roblox over the past two years over compliance with these obligations, prompting the company last year to announce a range of measures aimed at improving safety for children on its service.
However, testing by eSafety earlier this year identified gaps in Roblox’s safety systems which eSafety considered continued to put children at risk, including allowing contact between children and adult strangers. The testing found:
- adults could send connection requests to young Australian children without parental or carer consent;
- children and adults could view and respond to one another’s posts on forums outside game environments without parental or carer consent;
- children’s connections were visible to anyone on the Roblox platform;
- children’s profiles and biographies, including account names, number and names of connections, avatar images, and non-sensitive biographical information such as their interests were visible to anyone on the Roblox platform, with no option to restrict the visibility of this information.
Although Roblox believes it is meeting its obligations under the Online Safety Act, the platform has committed to implementing a range of additional measures, including:
- preventing adults from contacting unknown children without parental consent
- strengthening the account settings of children's accounts so they are private by default
- accessible reporting mechanisms that notify users of complaint outcomes
- engaging an independent third-party auditor to assess the effectiveness of its safety measures, including the deployment of its age-estimation measures.
Roblox will have three months to implement the changes. If they breach the undertaking, eSafety may apply to the Federal Court for an order directing Roblox to comply and any other order the Court considers appropriate.
eSafety Commissioner Julie Inman Grant welcomed the enforceable undertaking from Roblox to improve safety for children on the service, but stressed the regulator would not hesitate to take further enforcement action if the company failed to deliver on its commitments.
“Roblox is the second most popular game with children in Australia and recent national research estimates there are about 1.7 million Australian children on the platform. We want to ensure that any platform with a high preponderance of kids to be a safe place where they can enjoy the benefits of online gaming, creativity and connection, including building their own worlds and experiences online,” Ms Inman-Grant said.
“But those benefits can only be realised when effective safeguards are in place to protect children from serious harms such as grooming, child sexual exploitation, sextortion or recruitment into violent extremism. We also want to give Australian parents both the tools and the peace of mind that they will be notified when strangers are reaching out to their children on co-mingled platforms.
“We have been engaging with Roblox for some time at senior levels about our concerns and the company has responded, making a number of improvements to its service. Their executives clearly understand that verifiable safety measures are critical to their long-term viability and success.
"Critically, the inclusion of third-party auditing ensures Roblox cannot mark their own homework, and there will be robust independent evaluation of these commitments. This is the first time such third-party auditing has been required under Australia’s Online Safety Act.
“Ultimately, our goal is to drive companies to make their services safer for children and young people. Where safety by design has not been deployed comprehensively at the front end, we won’t hesitate to ensure that these risks have been responsibly remediated.
“Holding Roblox to the binding safety improvements through this enforceable undertaking is a great example of how these systemic powers can deliver real and meaningful results.”
The enforceable undertaking forms part of eSafety’s broader work to improve safety and accountability across the online gaming sector.
In April, eSafety also issued transparency notices to Roblox and other online gaming services under the Basic Online Safety Expectations requiring them to report on how the steps they are taking to protect children from harms including child sexual exploitation and abuse, violent material and activity, cyberbullying and online hate. A report on the findings from these notices is expected later this year.
The enforceable undertaking is available at eSafety.gov.au.