Roblox & child safety — lessons for online gaming platforms

Roblox, the popular online gaming platform that allows users to play, create and share games, as well as chat and interact with other players, has recently come under scrutiny for its handling of child safety. 

The company has this year faced legal action in the US, including claims arising from allegations that it failed to protect a child in Galveston, Texas from online predators. In August 2025, the State of Louisiana also filed a formal lawsuit against Roblox Corporation, alleging that the platform facilitated child sexual abuse material and exploitation of minors. 

Roblox has strongly denied the allegations and asserts that it has invested heavily in child-safety measures and content moderation. However, this isn’t the first time that the company has been criticised for its approach to protecting children on the platform.

Despite ongoing concerns, the company continues to grow as one of the world’s major gaming platforms, especially popular among UK children aged eight to twelve, with some users as young as five.

Here, Paddy Fearnon and Andreas Petrou from our games and interactive entertainment team explore the allegations against Roblox, outline the wider challenges of protecting children online and break down the steps that platforms are expected to take to safeguard young users.

The hidden dangers behind online play

The platform's social and interactive features, known as user-to-user (U2U) interactions, together with age-inappropriate experiences and illegal and harmful content, are significant areas of online risk for all users — but particularly for children. 

In 2024, the BBC created two fake Roblox user accounts to investigate its safety protections. It was reported that while Roblox's AI systems could detect overt attempts of the fake accounts to move chats to other platforms, it was possible to rephrase these messages in a way that circumvented those safeguards. 

The investigation also reported that user-generated games and experiences containing harmful or age-inappropriate content could still be encountered on the platform, with some such content being recommended to the BBC's test accounts. While Roblox does have parental controls, there have been reported cases where groomers have encouraged children to bypass them, leading some parents to question whether the platform is doing enough to keep their children safe online.

The Louisiana lawsuit alleges a number of failures, including examples of predators using voice-altering technology to impersonate children, the existence of games like ‘Escape to Epstein Island’ and groups openly trading child sexual abuse material. It also claims that Roblox’s design and moderation systems are deliberately inadequate, prioritising growth and engagement over child safety.

In response to growing scrutiny, Roblox has since implemented mandatory age verification measures for chat functionality and introduced age-based communication restrictions designed to reduce contact between children and adults on the platform. Whether these measures will adequately address regulatory and parental concerns remains to be seen.

Holding platforms accountable: what the law demands

As the digital landscape continues to evolve, online safety has become paramount for governments and regulatory bodies worldwide, with particular focus on the protection of children. Various laws and regulations have been established internationally to safeguard users from potential harm and exploitation. These legal frameworks aim to create a safer online environment by holding service providers accountable for the content and interactions that they facilitate. 

In the UK, the Online Safety Act 2023 (the Act) is the primary piece of legislation that governs this. The Children's Code (the Code) also sets stringent standards for online platforms, while the EU and the US have implemented their own comprehensive measures to enhance child safety in the digital age. 

1. The Online Safety Act 2023

The Act is aimed at regulating online content and protecting both children and adults online, with the strongest protections having been designed for children. 

The Act applies to search and U2U services, which are online services that allow content generated, uploaded or shared by a user to be encountered by another user or users, including social media, cloud storage, video-sharing platforms, online forums, dating services and instant messaging platforms. Regulatory oversight is carried out by Ofcom, the independent regulatory and competition authority for the UK's communications industries. Notably, games and games platforms that include U2U functionality are likely to be caught by the Act — depending on the nature of the platform.

The Act isn’t limited to companies located in the UK, however. If the service in question has links with the UK (for example, they have a significant number of UK users, the UK is a target market or the service is capable of being accessed by UK users and there’s a material risk of significant harm to others), then it would be considered a ‘regulated service’ and therefore subject to the provisions of the Act. 

Key duties that concern affected providers of U2U services include:

• Regulatory fees: A requirement to notify Ofcom if the provider meets particular revenue thresholds and is liable to pay regulatory fees and, where applicable, to pay those fees to Ofcom.
• Illegal content: Online platforms must conduct (and keep records of) suitable and sufficient risk assessments that take into account a number of requirements set out in the Act. They must also implement proportionate measures relating to design and operation of their services to prevent the dissemination of illegal content, reduce the risk of the service being used for commission or facilitation of priority offences and mitigate and manage risks of harm to individuals. Platforms must also use proportionate systems and processes to minimise the length of time that illegal content is available and swiftly take down such content when alerted of its presence. The Act sets out a wide range of illegal content, including child sexual exploitation and abuse, terrorism, harassment, hate offences, assisting suicide, encouraging or assisting serious self-harm, threats to kill, sexual exploitation and images, fraud and a number of other offences. Illegal content protection must be set out in a platform’s terms of service and the provider must apply these provisions consistently.
• Children's safety: Platforms must assess whether children can access their service to determine whether there’s a significant number of child users or if the service is likely to attract children. Providers are only entitled to conclude that children can’t access a service if age verification or estimation confirm that children aren’t normally able to use it. Platforms that are likely to be accessed by children must conduct suitable and sufficient children's risk assessments and implement safety measures in the design and operation of the service to protect children from harmful and age-inappropriate content. These protections must be detailed in the provider’s terms of service.
• Content reporting & complaints procedures: Platforms must establish clear procedures for reporting harmful content and handling user complaints. They must also operate systems and processes that, so far as possible, ensure that all detected and unreported child sexual exploitation and abuse content is reported to the National Crime Agency. Additionally, major platforms must be transparent about potentially harmful content and give users more control over what they see. Providers of services likely to be accessed by children face additional content reporting duties and complaints procedures. 

Ofcom is empowered to enforce the Act and can take action against non-compliant companies. Companies can face fines up to £18m or 10% of their worldwide revenue (whichever is higher) for non-compliance. Criminal action can be taken against senior managers who fail to comply with information requests or enforcement notices.

2. The Children's Code 

The Code, also known as the Age-Appropriate Design Code, is a statutory code of practice developed by the Information Commissioner's Office (ICO) to ensure that online services that are likely to be accessed by children in the UK are designed with children's best interests in mind. It sets out 15 standards that online services need to follow to make sure that providers are catering to the fact that children’s personal data needs special protection and complying with their obligations under data protection law to protect it online. The Code applies to UK-based companies and companies outside the UK who process the personal data of children in the UK. 

The ICO has powers to take action against organisations that break the law, including tough sanctions like orders to stop processing data and fines of up to £17.5m or 4% of global turnover, whichever is higher. 

3. International regulations on child safety

In addition to the Act and the Code, the EU has implemented various regulations to enhance child safety online, in particular the Digital Services Act (the DSA). This requires risk assessments of the impacts on children's rights online and prohibits targeted advertising to children. These regulations aim to create a safer digital environment by holding online platforms accountable for the content and interactions that they facilitate. 

The US also has several laws aimed at protecting children online, such as the Children's Online Privacy Protection Act (the COPPA) and the Kids Internet ​and Digital Safety Act which was recently passed by the US Congress. Additionally, the Trafficking Victims Protection Reauthorization Act and the Adam Walsh Child Protection and Safety Act address issues related to child exploitation and abuse. 

How game companies can stay compliant & keep players safe

Game companies can take several measures to comply with regulations and mitigate risks. These include implementing robust content detection and moderation systems, age verification measures, comprehensive parental controls and conducting regular risk assessments. At a minimum in the UK, providers of services that are covered by the Act must comply with the duties set out in it or face enforcement and stringent fines.

As demonstrated by Roblox, even where technical measures are in place, these controls can be questioned. It’s therefore key that all measures taken are as robust as possible and legally compliant with providers’ duties. 

Additionally, companies can offer educational resources for parents and children on safe online practices. Providers should also consider the impact of these measures on their operations and strive to create a safe and enjoyable online environment for all users. 

Key takeaways & looking ahead 

The increasing scrutiny of Roblox and other similar online platforms underscores the critical need for robust online safety measures, concerning both adult and child users. The implementation of the Act and the Code in the UK and various EU and US laws represents a significant step forward in creating a safer online environment, particularly for children. These comprehensive legal frameworks are designed to hold online service providers accountable, ensuring that they prioritise the well-being of users. Online games and other services are often accessed globally and providers may need to consider international laws as well as domestic when assessing online safety and whether they’re caught by them.

The digital world is evolving and it’s imperative that providers of online services adapt and enhance their safety protocols to protect users from potential harm, as the consequences of non-compliance for a provider could be severe. 

Talk to us

Our games and interactive entertainment team works with founders and businesses across the games, tech and digital creative sectors, providing legal and strategic advice from company set‑up and investment through to tech and software development, publishing, supply of services, IP protection and management, regulatory compliance and dispute resolution.

As the sector continues to evolve, proactive collaboration supported by strong legal foundations will be key to unlocking innovation and growth. 

To discuss your next collaboration project or any other aspect of doing business in the games, interactive entertainment, creative and tech spaces, call us on 0333 004 4488, send us an email at hello@brabners.com or complete our contact form.