← Gaming
F

Roblox

Fail
Roblox · 🇺🇸 United States
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
Manufacturer: Roblox Corporation

⚠️ The bottom line

On October 8, 2024, Hindenburg Research called Roblox "an X-rated pedophile hellscape." Searching "adult" revealed a group called "Adult Studios" with 3,334 members openly trading child sexual abuse material. Hindenburg tracked members to 38 connected groups — one with 103,000 members. Former employees said Roblox deliberately chose not to implement parental controls because it would hurt growth metrics. The company decided child safety was less important than user numbers. Stock dropped 9%. The SEC and FTC both opened investigations. Roblox — valued at $24 billion — outsources child safety moderation to workers paid $12 a day. That's $1.50 per hour to protect 380 million users, most of them children, from predators trading CSAM. These moderators can't even permanently ban the predators they catch — offenders just return. A company that made $2.9 billion in revenue in 2023 chose to protect children with the cheapest labor it could find, then told parents their kids were safe. Twelve dollars a day is what they think your child's safety is worth.

Legal jurisdiction
🇺🇸 United States (headquarters)
CLOUD Act read more →
US govt can demand your data from this company even if stored overseas
FISA §702 / PRISM read more →
NSA collects stored emails, photos, messages without individual warrants
Geofence warrants read more →
Police can demand location data for everyone near a crime scene
Spying
3/4 HIGH
Is someone spying on me?
Kids at risk
Data Sharing
4/4 EXTREME
Who gets my data?
Kids at risk
Security
4/4 EXTREME
Is it actually secure?
Kids at risk
Honesty
4/4 EXTREME
Can I trust what they say?
Kids at risk
REPLACE Extreme risk. Look for alternatives or lock down hard.
23Contradictions
19Critical
3High
1Medium
27Sources
Findings by concern
Spying 3/4 HIGH 3 findings
⚠️ criticalpolicy vs third party research
To prove you're old enough for Roblox, you now hand your face to Persona — a company whose own tools run facial recognition against watchlists and hold your biometrics for three years. Discord already walked away from Persona. Roblox didn't. And verified accounts are selling on eBay for five dollars, so the whole system is theatre.

What they claim: Roblox introduced mandatory facial age verification in January 2026 to protect children, partnering with identity vendor Persona.

What we found: Researchers found Persona's exposed frontend reveals facial recognition against watchlists, collection of government IDs, device fingerprints, and biometric data retained for up to three years. Discord already dropped Persona over these concerns. Age-verified Roblox accounts are selling on eBay for $5.

⚠️ criticalmarketing vs third party research
Roblox now requires every user — including children — to scan their face to use chat. Roblox says the biometric data is deleted immediately. The company they hired to do the scanning, Persona, says in its own terms it can keep your face data for three years. A child can complete the entire biometric scan without a parent ever knowing.

What they claim: Roblox states biometric data from facial age estimation is "deleted immediately after the age result is returned."

What we found: The facial scanning is performed by third-party vendor Persona, whose own terms of service allow retention of biometric data for up to 3 years. All 144M+ users — including children — must scan their face to access chat features. Children can complete the biometric scan without parental approval.

⚫ mediumpolicy claims vs regulatory findings
Hindenburg found Roblox was inflating user numbers by 25-42% and possibly overstating engagement hours by more than double. If your company claims 66 million daily users but 25-42% are bots, you don't have 66 million users — you have 38-50 million, and you've been lying to Wall Street. The SEC opened an enforcement probe. Investors valued Roblox at $24 billion partly on these numbers. Roblox doesn't just inflate safety claims — it inflates the numbers it reports to financial markets. Every metric this company publishes should be treated with suspicion.

What they claim: Roblox reports Daily Active Users as a key metric showing consistent growth.

What we found: Hindenburg found Roblox inflating user numbers by 25-42% and possibly overstating engagement hours by more than double through bot accounts and manipulated metrics. The SEC opened an enforcement probe. Investors valued Roblox at $24 billion based partly on these numbers.

Data Sharing 4/4 EXTREME 4 findings
⚠️ criticalmarketing vs regulatory
The Australian government formally put Roblox "on notice" after children as young as 4 were groomed on the platform. The Communications Minister summoned Roblox executives to explain themselves. The eSafety Commissioner started testing whether Roblox actually does what it promised. Potential fine: $49.5 million. They're also reviewing whether the PG rating should be stripped. Roblox only acted after being called to account.

What they claim: Roblox claims to maintain robust safety systems that go "beyond the regular practices of other platforms."

What we found: In February 2026, Australian Communications Minister Anika Wells formally put Roblox "on notice" after disturbing reports of children as young as 4 being sexually groomed on the platform. The eSafety Commissioner began direct compliance testing of Roblox's safety commitments. Potential penalty: $49.5 million under the Online Safety Act. The government also asked the Classification Board to review whether Roblox's PG rating remains appropriate. In April 2026, Roblox CEO David Baszucki met with the Minister and announced safety improvements for under-16s — but only after being summoned.

⚠️ criticalpolicy vs regulatory
Three US states extracted $35.4 million from Roblox in eight days in April 2026. Alabama, West Virginia, and Nevada each forced settlements over child safety failures. Seven more states are lining up. The company that says it protects kids keeps writing cheques to governments that say otherwise.

What they claim: Roblox claims to provide a safe platform for children with robust age verification and parental controls.

What we found: In April 2026, Alabama ($12.2M), West Virginia ($11M), and Nevada ($12M) settled with Roblox in eight days — $35.4 million total — over child safety failures. Texas, Florida, Louisiana, Iowa, Nebraska, Kentucky, and Tennessee are pursuing similar claims.

⚠️ criticalmarketing vs regulatory
Los Angeles County sued Roblox in February 2026, saying the platform hands predators "powerful tools" to target children. It's the first California government body to take them to court. Eighty families in California alone have filed federal lawsuits. The "safe creative platform" is being sued by the people whose job it is to protect kids.

What they claim: Roblox markets itself as a creative platform where kids can safely play, build, and socialise.

What we found: In February 2026, Los Angeles County became the first California government body to sue Roblox over child safety, alleging the platform gives predators "powerful tools" to target children. Nearly 80 federal lawsuits filed by families in California alone.

⚠️ criticalmarketing vs regulatory
Two children were abducted after meeting a predator on Roblox. Georgia's attorney general launched a formal investigation. Florida opened a criminal probe. Roblox says it takes "swift action" — but two girls had to be recovered by state police first.

What they claim: Roblox claims it "takes swift action" against bad actors and works closely with law enforcement

What we found: Two girls disappeared from Florida after connecting with a 19-year-old on Roblox. Georgia State Patrol recovered them. Georgia AG Chris Carr launched a formal investigation and issued a Civil Investigative Demand. Florida announced a criminal probe. The AG required Roblox to produce documents on child safety, abuse reports, and moderation features.

Security 4/4 EXTREME 8 findings
⚠️ criticalpolicy claims vs app permissions
On October 8, 2024, Hindenburg Research called Roblox "an X-rated pedophile hellscape." Searching "adult" revealed a group called "Adult Studios" with 3,334 members openly trading child sexual abuse material. Hindenburg tracked members to 38 connected groups — one with 103,000 members. Former employees said Roblox deliberately chose not to implement parental controls because it would hurt growth metrics. The company decided child safety was less important than user numbers. Stock dropped 9%. The SEC and FTC both opened investigations.

What they claim: Roblox markets itself as a safe digital space with robust safety systems protecting children.

What we found: Hindenburg Research's October 2024 report called Roblox an X-rated pedophile hellscape. Searching adult revealed Adult Studios with 3,334 members trading CSAM and soliciting children. 38 connected groups, one with 103,000 members. Former employees said Roblox chose not to implement parental controls because it would hurt growth metrics. Stock dropped 9%. SEC and FTC opened investigations.

⚠️ criticalpolicy claims vs regulatory findings
Roblox — valued at $24 billion — outsources child safety moderation to workers paid $12 a day. That's $1.50 per hour to protect 380 million users, most of them children, from predators trading CSAM. These moderators can't even permanently ban the predators they catch — offenders just return. A company that made $2.9 billion in revenue in 2023 chose to protect children with the cheapest labor it could find, then told parents their kids were safe. Twelve dollars a day is what they think your child's safety is worth.

What they claim: Roblox employs robust content moderation and safety monitoring.

What we found: Hindenburg found safety monitoring outsourced to workers in Asia paid $12 per day — $1.50 per hour. These moderators have limited authority to permanently ban offenders. For a company with a $24 billion market cap, $12/day per moderator is a deliberate decision to minimize safety investment.

⚠️ criticalpolicy claims vs app permissions
Roblox added mandatory age verification in January 2026 requiring facial scans. It immediately backfired. Parents completed the scans for their kids, which labeled children as 21+ adults — placing them in the highest-risk category with full access to adult content and unrestricted communication with strangers. Malwarebytes researchers created a child account in December 2025 and found it could access cybercrime communities. Roblox's answer to "your platform is a pedophile hellscape" was a system that reclassifies children as adults.

What they claim: Roblox's age verification system protects children by restricting unsafe content.

What we found: When Roblox mandated facial verification in January 2026, parents completed scans for their children — labeling minors as 21+ adults with unrestricted access to adult content and communication. Malwarebytes found child accounts could access communities linked to cybercrime. The safety system actively made children less safe.

⚠️ criticalpolicy claims vs regulatory findings
In July 2025, an online cult called "Spawnism" formed in Roblox communities, targeting vulnerable children and pressuring them into degrading acts. By early 2026, Azerbaijan, Kazakhstan, and Kyrgyzstan had all issued public warnings about predators on the platform. When three countries' child protection agencies tell parents to keep kids away from your app, you don't have a moderation problem — you have a platform designed for predation. Roblox's response: more AI filters. The same AI that missed a 103,000-member predator group.

What they claim: Roblox monitors content and communities to prevent harmful experiences.

What we found: In July 2025, Spawnism cult emerged in Roblox communities where predators pressured children into degrading acts. Azerbaijan, Kazakhstan, and Kyrgyzstan child protection authorities all issued public warnings about pedophiles on the platform. When multiple countries warn parents about your platform, moderation has failed.

⚠️ criticalmarketing vs regulatory
146 child exploitation lawsuits. Three US states settled for $35.8 million. Two countries banned it. Australia's eSafety Commissioner issued legal notices demanding answers about child grooming. Roblox's slogan is "Reimagine the Way People Come Together." For 146 families, what came together was a lawsuit.

What they claim: Roblox promotes a safe platform for children to play, create, and socialise

What we found: 146 child exploitation lawsuits were consolidated into a federal MDL in December 2025. Roblox settled with West Virginia, Alabama, and Nevada for $35.8 million. Iraq banned Roblox in October 2025. Egypt banned it in February 2026. Australia's eSafety Commissioner issued legally enforceable transparency notices to Roblox in April 2026 demanding explanation of child grooming safeguards, with penalties of $590,783 per day for non-compliance.

⚠️ criticalmarketing vs third party research
Scammers use AI-generated YouTube videos to trick kids into giving up their Roblox passwords. The fake sites test your child's password against the real Roblox login in real time. Kids aged 8-14 lose their accounts, their items, and their parents' credit cards. Families find hundreds or thousands in unauthorised charges. Roblox's own confusing multi-currency system is what makes the scams work — kids don't understand what they're giving away.

What they claim: Roblox provides a safe environment where children can play and create without risk.

What we found: In 2026, AI-generated YouTube videos now produce convincing fake "proof" that free Robux generators work, luring children aged 8-14 into phishing sites. These sites test credentials against the real Roblox API in real time. Children lose their accounts, in-game items worth hundreds of dollars, and often expose parents' stored credit cards. Families report discovering unauthorised transactions of hundreds to thousands of dollars after children attempt to recover lost items by purchasing more Robux. The scam ecosystem thrives because Roblox's own currency design (multiple currencies, complex exchange rates, limited items) creates confusion that scammers exploit.

⚠️ criticalmarketing vs regulatory
Nebraska's Attorney General called Roblox "a playground for child predators." LA County sued for exploiting children. 162 lawsuits are now consolidated in federal court. Nevada extracted $10 million. The platform that markets itself as safe for kids is being sued by half of America.

What they claim: Roblox markets itself as a safe platform for children with parental controls and content moderation

What we found: Nebraska Attorney General Mike Hilgers sued Roblox in March 2026, calling it a "playground for child predators." LA County filed a parallel lawsuit in February 2026 for "unfair and deceptive business practices that endanger and exploit children." The federal MDL now includes 162 lawsuits. Nevada settled for $10 million in April 2026.

⚠️ criticalmarketing vs regulatory
Roblox has paid $35 million to three US states for failing to protect children. 170 families have sued, alleging the platform facilitated child sexual abuse. Texas calls it "a digital playground that conceals predators." As part of one settlement, Roblox agreed to stop encrypting children's messages — admitting the encryption was hiding predators, not protecting kids. In July 2026, a state lawmaker was charged with grooming a student on Roblox.

What they claim: Roblox claims robust safety features protect children on the platform

What we found: 170 lawsuits pending in MDL No. 3166 (N.D. Cal.) alleging Roblox facilitated child sexual exploitation. State settlements exceeding $35M: Alabama ($12.2M), West Virginia ($11M), Nevada ($12.5M). Texas AG Paxton sued Roblox as a "digital playground that conceals predators." As a settlement condition, Roblox agreed to stop encrypting communications involving minors to aid law enforcement. July 2026: West Virginia lawmaker charged with grooming an 8th grader on Roblox.

Honesty 4/4 EXTREME 8 findings
⚠️ criticalpolicy claims vs regulatory findings
In April 2026, West Virginia AG JB McCuskey forced Roblox to pay $11.08 million after finding the platform "allowed children to be exposed to sexual predators, grooming, and inappropriate content." The settlement terms reveal what should have existed all along: mandatory age verification, safe-content defaults for under-16s, restricted adult-to-minor contact. These features weren't there before — for years children could chat with adults and be groomed on a platform marketed to kids. Roblox spent more on executive compensation than on the safety features it was forced to build.

What they claim: Roblox provides age-appropriate experiences with robust safety measures for minors.

What we found: In April 2026, West Virginia AG JB McCuskey announced an $11.08 million settlement after finding Roblox allowed children to be exposed to sexual predators, grooming, and inappropriate content. Settlement requires mandatory age verification, safe-content defaults for under-16s, restricted adult-to-minor contact — confirming these features didn't exist before.

⚠️ criticalpolicy claims vs regulatory findings
One hundred and forty-six lawsuits. That's how many had been filed against Roblox by April 2026 — nearly double from months earlier. LA County accused Roblox of giving "predators powerful tools to target children." In Seitz v. Roblox, a family alleged their 13-year-old was pushed to suicide by violent extremists she found on the platform. Chris Hansen released a documentary called "Dangerous Games: Investigating Roblox" in February 2026. This isn't a company with occasional complaints — this is a company drowning in evidence of systemic child harm.

What they claim: Roblox claims to maintain a safe environment and respond proactively to safety concerns.

What we found: By April 2026, 146 lawsuits filed — up from 85 at start of year. LA County alleged Roblox gives predators powerful tools to target children. In Seitz v. Roblox, a 13-year-old was allegedly pushed to suicide by extremists she found on the platform. Chris Hansen released documentary Dangerous Games: Investigating Roblox in February 2026.

⚠️ criticalmarketing vs third party research
Researchers at the University of Sydney called it "literally just child gambling." Roblox uses lootboxes, pressure timers, and artificial scarcity on kids as young as 8. Australia banned these mechanics for under-15s. Roblox kept running them. Kids don't understand the multi-currency system and accidentally spend their parents' money. The researchers urged "swift regulation."

What they claim: Roblox markets itself as a fun, creative platform for children with transparent in-game purchases.

What we found: University of Sydney study (March 2025) found Roblox exposes children to deceptive lootbox-style spending mechanics — randomised rewards, pressure timers, artificial scarcity — that researchers described as "literally just child gambling." Children and parents described them as "scams" and "cash grabs." These mechanics are banned for under-15s in Australia, yet Roblox continues to operate them. Children struggle with complex multi-currency transactions (Robux, DevEx, limited items), leading to unintentional spending that often hits parents' credit cards stored in the account.

⚠️ criticalmarketing vs third party research
A child spent $5,000 in Robux without understanding it was real money. Child safety groups asked the FTC to investigate Roblox's gambling-like mechanics in May 2026. Brazil already classified the game as 18+ because the microtransactions look like gambling. Roblox says it doesn't allow gambling. An entire country disagrees.

What they claim: Roblox claims it does not allow gambling or real-money transactions by children

What we found: Child safety groups Fairplay and NCOSE formally petitioned the FTC in May 2026 to investigate Roblox's gambling-like mechanics and scarcity marketing targeting children. One parent documented a child spending over $5,000 in Robux without understanding it was real money. Brazil classified Roblox as 18+ in March 2026 due to microtransactions resembling gambling.

⚠️ criticalmarketing vs regulatory
Roblox says its safety is best-in-class. Regulators across multiple US states disagreed enough to extract $57 million in settlements. Nevada's attorney general called the practices so harmful he directed $10 million to Boys & Girls Clubs to undo the damage.

What they claim: Roblox claims its safety systems "go beyond the regular practices of other platforms"

What we found: Roblox accrued $57 million in state settlement expenses as of Q1 2026. Nevada alone extracted a $12 million settlement — described as "first-of-its-kind" — with $10M going to youth programs. 146 consolidated family lawsuits remain in federal court.

⚡ highpolicy claims vs app permissions
Roblox takes up to 75.5% of every Robux transaction. Children as young as 9 create games that generate revenue for a $24 billion company, keeping only a fraction. The purchasing flow uses dark patterns that obscure real-money costs — a child clicks "buy" on a virtual hat without understanding they just spent $12. Critics call this child labor. Roblox generated $2.9 billion in 2023, predominantly from children's spending. The company built an economy where kids are both the consumers and the unpaid workforce, taking three-quarters of every dollar.

What they claim: Roblox provides a creative platform where young developers can learn and earn.

What we found: Roblox takes up to 75.5% of every Robux transaction. Children as young as 9 create revenue-generating content, keeping only a fraction. Dark patterns obscure real-money costs. The platform generated $2.9 billion in 2023 largely from children's spending. Critics call it child labor.

⚡ highmarketing vs third party research
Roblox built an age-check system so broken that parents are accidentally making their kids less safe. A parent scans their own face to get past the prompt, and now their 9-year-old is classified as a 21-year-old adult — visible to every adult on the platform. Other kids buy pre-verified accounts on eBay.

What they claim: Roblox introduced facial age verification to protect children by placing them in age-appropriate tiers

What we found: Parents frustrated by the system are scanning their own adult faces to complete verification for their children, classifying minors as 21+ adults. These children are placed in the highest-risk social category with full exposure to adult users. Age-verified child accounts are being sold on eBay. Users bypass the system with celebrity photos, virtual avatars, and drawn-on facial hair.

⚡ highmarketing vs regulatory
Nevada's Attorney General forced Roblox to pay $12 million for failing to keep children safe — on a platform it markets as safe for kids. Texas and Kentucky are suing too. Roblox agreed to actually implement child safety features it should have had from the start.

What they claim: Roblox markets itself as a safe platform for children with robust parental controls and content moderation.

What we found: Nevada Attorney General secured a $12 million settlement against Roblox for child safety failures. Additional active lawsuits filed in Texas and Kentucky. The settlement requires Roblox to implement new child safety enhancements starting June 2026.

Latest Risks & Threats
New developments that compound existing privacy concerns. 1 emerging risk.
RISK Platform splitting into three tiers from June 2026 ⚠️ Platform Restructure Announced 2026-04-21
Roblox Kids (ages 5-8, no chat), Roblox Select (9-15), and standard accounts (16+). Major restructure under legal pressure from 10+ US states, EU Parliament, and Australia (A$49.5M fine threat).
Sources
Sources