Gaming platform Roblox will now require all users to verify their age using its AI-powered facial age-estimation system or by uploading a government-issued ID to access its full range of features. Eliza Jacobs, the company’s vice president of safety product policy, told NBC News that the platform’s new video selfie age check process, which includes facial analysis, typically estimates ages “within 1.4 years” for users under 18.
However, the gaming company has not published any data showing how often children are misidentified as older users. Furthermore, Roblox’s age-verification measures raise key questions about user privacy and the workarounds users have found to circumvent the system.
Is ticking a box to say you’re 16 or older enough? Roblox already requires users to complete an age check before they can use chat features. In April, it announced plans to sort players into age brackets. Users under 16 and 9 are placed under Roblox Select and Roblox Kids accounts, respectively. Those who do not undergo age checks have restricted access to chat and the content library.
- However, age checks can go wrong. Parents were recently found to be completing age checks on behalf of their children on Roblox, resulting in some children being classified as 21+ and gaining access to adult content.
- In January, WIRED reported that age-verified Roblox accounts for minors as young as 9 were being sold on eBay for as little as $4, allowing bad actors to bypass the age-verification process by using pre-verified accounts. When an adult seeking children’s data, or a child seeking access to adult content, can simply purchase their way past the checks, the verification process ceases to be a barrier and becomes a commodity.
Children have found ways to bypass facial age-estimation technology: A recent survey by Internet Matters revealed that 32% of children in the UK had already bypassed age checks by entering fake birthdates, using someone else’s login credentials, or even drawing fake moustaches.
- In a recent MediaNama roundtable discussion, a speaker pointed out a shortcoming in facial age-estimation, saying, “Someone put up a Barbie doll instead of their own face, and the AI guessed their age as 102.”
- Another speaker said they would not be comfortable with any company or government running facial recognition on a child. “I use DigiYatra quite frequently myself. But I’m trading convenience for this. We need to look at building resilience in the child against the harms, because the harms are not going away,” they said.
- Earlier this year, in April, the Australian eSafety Commissioner confirmed that children could easily bypass facial age-estimation technology deployed by social media platforms if they were within two years of turning 16. In many cases, platforms such as Facebook, Instagram, Snapchat, TikTok and YouTube reportedly encouraged users to bypass security checks.
- In 2025, the UK-based Age Check Certification Scheme’s trial of Australia’s age assurance technology revealed that most age assurance systems had an accuracy rate of 92%. The trial report noted that around the 16+ age gate, the systems had false rejection rates of 8.5% and 2.6% for 16 and 17-year-olds, respectively, which is above the acceptable level.
Concerns around user privacy: To verify their ages on Roblox, users need to take a video selfie using a device camera, which is processed by the company’s third-party vendor, Persona. Alternatively, they can upload a government-issued photo ID if they are 13 or older.
Roblox claims that Persona immediately deletes biometric data after estimating users’ ages. However, several users online have raised privacy concerns. One user on X wrote: “Facial scans, ID checks, age verification systems, once they’re built and normalised for one purpose, they don’t need a fresh decision to be used for something else later.”
“Age-verification systems are, at their core, surveillance systems. By requiring identity verification to access basic online services, we risk creating an internet where anonymity is a thing of the past,” writes Electronic Frontier Foundation.
AI can mis-age players: MediaNama has reviewed several posts from players and parents claiming that Roblox’s system misidentified players’ ages.
One user, who claimed to be 23 years old and was incorrectly classified as a minor, wrote on X: “I don’t want to be chatting with fucking children.” Another alleged that their 10-year-old sibling had been sorted into the over-18 age bracket.
Another X user wrote: “I have a full-ass beard and it put my alt on a 13-16 age range.”
Roblox says it uses a system of “continuous age estimation” that runs in the background to monitor potential discrepancies between a user’s account age and their “behavioral age.”
However, the company did not explain how this process works or whether users are notified.
Bans won’t stop access: According to Roblox, parents can block certain games and manage direct messages until a child turns 16. However, Nikhil Pahwa, founder and editor of MediaNama, believes such strict barriers may prompt children to find workarounds, ultimately undermining their safety.
“Children will use VPNs. They’ll lie about their age. They are smart. In fact, the best thing that will probably happen with these bans is that children will figure out workarounds to unexpected and unwelcome censorship that doesn’t respect their need for agency. The outcome is that they access it unsupervised, without parental involvement, and via workarounds. And that’s not necessarily safer,” Pahwa said.
Why this matters: These concerns come amid growing global pressure on tech firms to protect children online. On June 15, 2026, the UK government announced it would ban social media for children under 16, effective early 2027. The ban will cover platforms such as Snapchat, TikTok, YouTube, Instagram, Facebook and X. However, messaging apps WhatsApp and Signal will remain unaffected. It is also unclear if the rules will apply to gaming platforms, including Roblox and Discord. When Australia banned social media for under-16s in December last year, it was criticised for not including gaming platforms. In the US, Roblox and Discord are facing a lawsuit by a 13-year-old, who claims he was groomed and solicited on both of these platforms by a sexual predator, who was later arrested for his crimes against more than two dozen children.
In India, platforms face new duties under the Digital Personal Data Protection Law. They are required to obtain verifiable parental consent for internet access for children under 18. However, Pahwa has described this move as “foolish” and “idiotic”.
“What MEITY has now done with the Rules is to incorporate a (probably illegal) bypass, by allowing children to self-declare their age: the illustrations on page 28 of the rules completely ignore the possibility of a child not declaring that they’re a child. A rule cannot override the law, but I guess it will only be struck down when the Committee of Subordinate Legislation does their job, or someone takes it to court. The platform doesn’t because this carve-out serves them the most. Self-declaration makes the law redundant because Children will lie about their age. If a child does not disclose that they are a child, then parental consent is never triggered, he said.
India is also considering age-based restrictions for minors’ use of social media. However, it remains unclear whether the upcoming rules will apply to gaming companies such as Roblox. Indonesia has placed Roblox into the “high-risk” platform category, similar to TikTok, Facebook and Instagram, and said it will restrict access to these platforms for users under 16. Malaysia is also said to be considering similar restrictions.
Also read:
