Roblox has had a difficult year. At least seven US states have sued the platform over child safety failures. Dozens of individual lawsuits have been consolidated into federal multidistrict litigation. Earlier this year a 19-year-old was jailed in Manchester after grooming a 14-year-old girl he met on the platform. When a company under that kind of pressure announces meaningful changes, they deserve to be taken seriously, and these are meaningful. But the system holding them up has a documented $4 vulnerability.
What Roblox announced today
From early June, Roblox is introducing three age-based account types. Accounts will be assigned automatically using the platform's age-check technology, and will update as a child gets older.
Roblox Kids (ages 5–8)
- Content: Minimal or Mild ratings only
- Chat: Off by default, parents can approve specific contacts only
- Controls: Full parental management
Roblox Select (ages 9–15)
- Content: Up to Moderate ratings
- Chat: Limited to users in a similar age group
- Controls: Parents can approve or block individual games, manage direct chat until age 16
Roblox (ages 16+)
- Content: Full platform access
- Chat: Standard, with existing safety filters
- Controls: Standard safety settings remain active
Any child who has not completed an age check will default to the most restricted experience. Minimal or Mild content only, no chat, effectively making age verification mandatory for anyone who wants to use the platform as designed. Parents also gain two new specific controls: the ability to block any individual game, and the ability to approve specific games outside their child's default age bracket, handling the common scenario of a younger sibling wanting to play alongside an older one.
On developer accountability: before any game reaches a child's account, Roblox now requires developers to verify their identity and pass through age-checked testing with older users before games open to younger children. This is a meaningful structural change, it builds a gatekeeping step into the development pipeline rather than relying solely on content rating after publication.
"We're introducing two new age-based accounts for younger users on Roblox: Roblox Kids for users ages 5 to 8 and Roblox Select for users ages 9 to 15. These accounts will more closely align content access, communication settings, and parental controls with a user's age."
, David Baszucki, CEO, Roblox, 13 April 2026
The system underneath it: how the age check actually works
The new account tiers depend entirely on one thing working reliably: knowing how old a user actually is. Since January 2026, Roblox has made age verification mandatory for all users who want to access chat. The same technology will assign users to these new account types.
The mechanism is facial age estimation, powered by a third-party provider called Persona. Users scan their face through the platform; Persona's AI model estimates their age and places them into one of six brackets: under 9, 9–12, 13–15, 16–17, 18–20, or 21+. Crucially, biometric data is deleted immediately after the scan, no facial images are stored.
In testing certified by the UK's Age Check Certification Scheme, Persona's models achieved a mean absolute error of 1.4 years for users under 18. That sounds reassuring. But when age brackets are as narrow as three years, and the difference between a 12-year-old and a 13-year-old determines whether chat is enabled, a 1.4-year margin of error is not trivial.
The vulnerability
Age-verified Roblox accounts were on sale on eBay for $4 within days of launch.
Wired reported in January 2026 that within days of the mandatory rollout, age-verified Roblox accounts were appearing for sale on eBay for as little as $4. Anyone, including adults specifically seeking access to children's chat spaces, could purchase a pre-verified account and bypass the entire system.
The mechanism is straightforward: someone over 18 completes the facial age scan legitimately on a new account, verifying it as an adult. They then sell that verified account. The buyer inherits the verified status. No scan needed.
The new account tier system is only as strong as the integrity of its age verification. If verified accounts can be purchased for the price of a coffee, the tiers describe intended behaviour, not guaranteed behaviour.
This is not a reason to dismiss the changes Roblox has announced today. It is a reason to understand them honestly. Facial estimation is better than a checkbox. A tiered account system is better than no tiers. Developer identity verification is better than open publishing. These are real improvements. They are also improvements built on a foundation that has a known bypass, and that bypass costs $4.
What good age assurance looks like
The ICO has been explicit on this point since it fined Reddit £14.47 million in February 2026: self-declaration of age is not enough when children may be at risk. Facial estimation alone, which Roblox uses, sits between self-declaration and robust verification. It is harder to bypass than a date-of-birth field, but easier to bypass than document-backed identity verification.
The UK Age Check Certification Scheme, which certified Persona's testing, exists to distinguish between levels of assurance. The level appropriate for a given platform depends on the risk profile, and a platform where 35% of users are under 13 and where grooming cases have resulted in criminal convictions is a high-risk platform.
Method · Bypassed by $4 account? · ICO-compliant?
-------- · ------------------------ · ----------------
Self-declaration (checkbox / DOB) · ✗ Bypassed instantly · ✗ Explicitly insufficient
Facial age estimation (Persona / Roblox) · ✗ $4 pre-verified account · ~ Depends on risk level
Liveness detection (Tuteliq) · ~ Harder, requires live face present · ✓ Suitable for moderate-risk platforms
Liveness + document verification (Tuteliq) · ✓ Requires real identity match · ✓ Strongest available standard
Identity verification + ban evasion (Tuteliq) · ✓ Blocks re-registration too · ✓ Closes the account resale loop
How Tuteliq approaches age verification differently
Tuteliq's age verification is designed for platforms where getting this wrong has real consequences. Two verification modes, configurable per jurisdiction, with every check returning an audit ID for compliance documentation.
Complete mode, liveness + document (highest assurance)
The user completes a liveness check (preventing pre-recorded face videos or photos from passing) and scans an official identity document. The document and live face are matched. This is the standard that closes the $4 resale bypass, a purchased account cannot be used because a new live face must match the document on file.
Appropriate for high-risk platforms with verified adult-child interaction, social features, or chat.
POST /v1/age-verify
{ "mode": "complete" }Liveness Only mode (moderate assurance)
A liveness check without document verification. Prevents photo and replay attacks, someone cannot hold up a printed face or use pre-recorded footage to pass. Appropriate for lower-risk platforms or as a first step before full verification at sensitive features.
Faster to complete, lower friction for users, suitable where the risk of harm is moderate rather than critical.
POST /v1/age-verify
{ "mode": "liveness_only" }On ban evasion prevention: age verification alone does not prevent a removed user from simply creating a new account. Tuteliq's identity verification layer with ban evasion detection identifies when a previously removed user attempts to re-register, closing the loop that account-level age checks leave open. Available at the Assure plan and above.
Every Tuteliq age verification call returns an audit_id, a permanent, verifiable record of when the check was performed, which method was used, and what result was returned. This is the documentation layer that sits behind a DPIA: evidence that your platform assessed age at the point of account creation, in a way that is defensible to a regulator.
What parents should do right now
The June rollout has not happened yet. Until it does, the current Roblox experience applies. And even after it does, platform controls are not a substitute for the conversation at home.
- Check whether your child has completed age verification on their Roblox account. If not, they will be defaulted to the most restricted tier in June, which may cause confusion if they suddenly lose access to games they have been playing.
- Review parental control settings now, before the new system lands. The transition period gives you a window to set controls deliberately rather than reactively.
- Understand that content ratings are a starting point, not a guarantee. "Moderate" does not mean "safe for your specific child." The labels describe general maturity thresholds, not the actual social interactions that happen within a game.
- The most important protection remains the conversation you have at home. A child who knows they can tell you if something feels wrong online is harder to groom than a child who has been handed a locked phone and told not to worry.
- If your child is under 9, review who is on their approved contact list. The new system allows chat only with parent-approved contacts for that age group, but that list needs to be actively managed, not set and forgotten.
For schools and safeguarding staff
These changes will affect millions of children who use Roblox, and many of them will talk about it, either because their favourite games are suddenly unavailable, or because they are trying to work out how to get their account to a higher tier. Both are moments where informed staff can have better conversations.
Being able to explain what changed, why, and what still matters is more useful than a blanket "be careful online" message. The fact that Roblox is making these changes in response to lawsuits and regulatory pressure is also relevant context for safeguarding conversations, it reinforces that online platforms are not inherently safe spaces, even when they are trying to be better ones.
---
Sources: Roblox newsroom, 13 April 2026 · TechCrunch, 13 April 2026 · NBC News, 13 April 2026 · The Next Web, April 2026, source for Persona mean absolute error figure, eBay bypass reporting, and verified user age distribution data. David Baszucki quote drawn directly from Roblox newsroom announcement.