Roblox Defends Expanded Age Verification System After Parents Report Errors

On January 7, 2026, Roblox flipped a switch that affected more than 144 million daily users: every account on the platform now requires a facial age estimation scan — or government ID — to access chat [1]. The mandate, the most ambitious age-gating system ever deployed on a consumer platform, was supposed to separate children from adults and make predatory contact harder. Three months in, the system has produced a cascade of unintended consequences — misclassified accounts, a black market for pre-verified profiles, a collapse in chat usage, and a growing list of parents who say the technology is failing the children it claims to protect [2][3].

How the System Works

Roblox's age verification relies on facial age estimation (FAE) technology provided by Persona, a San Francisco-based identity verification vendor [4]. When users open the app, they are prompted to take a brief selfie-style video. Persona's algorithms analyze facial geometry to estimate the user's age, then sort them into one of six brackets: under 9, 9–12, 13–15, 16–17, 18–20, and 21+ [5]. Each bracket carries different permissions. Users in lower age bands face stricter chat restrictions — those under 9 can only use preset phrases — while those 21 and older receive full communication access [6].

Source: Roblox Newsroom

Data as of Jan 7, 2026CSV

Roblox says the selfie data is processed by Persona and deleted immediately after the age estimate is generated. The company states it does not receive or store the raw video or any biometric data [4]. Users who dispute their estimated age can appeal through government ID verification or through parental controls that allow a parent to update a child's bracket [7].

An alternative path exists for users 13 and older: submitting a government-issued ID document. But Roblox has made facial estimation the default and fastest route, which means the overwhelming majority of age checks run through the AI system [5].

The Accuracy Problem

Persona's FAE technology achieved a Mean Absolute Error (MAE) of 1.4 years for users younger than 18 in testing by the UK's Age Check Certification Scheme [8]. That figure — meaning the algorithm's estimate is, on average, within 1.4 years of a user's actual age — sounds precise. In practice, it has produced widespread misclassification.

A 23-year-old user reported being placed in the 16–17 age bracket. An 18-year-old was classified as 13–15 [2]. On Roblox's developer forum, users documented cases of the algorithm assigning wildly inaccurate ages [9]. The errors run in both directions: adults classified as children lose access to features, while children classified as adults gain access to less-restricted communication pools — a scenario that directly undermines the system's safety rationale.

Facial age estimation is inherently less reliable at developmental extremes. Children from diverse racial and ethnic backgrounds, those with atypical facial development, and users who wear glasses or have skin conditions may face higher error rates [8]. Roblox has not published demographic breakdowns of misclassification rates, making it impossible to assess whether the system produces disparate impacts across racial or ethnic groups.

Roblox has not disclosed the total number of accounts flagged, locked, or misclassified since the rollout. Chief Safety Officer Matt Kaufman told reporters the company was "happy" with millions of users verified but acknowledged that improvement "will take time" given the scale of 150 million daily active users [3].

The Black Market

Within days of the January mandate, age-verified Roblox accounts appeared for sale on eBay [10]. Listings included accounts verified as 13–15 for $5, 16–25 accounts for $4.45, and 18–20 accounts for $2.99 [11]. Wired reported finding accounts verified as young as nine years old listed for purchase [10].

The implications are severe. A buyer — including a potential predator — can purchase a pre-verified account and enter age-restricted chat spaces matching any desired bracket. An adult purchasing a 9–12 verified account could communicate directly with children in that age band, bypassing the six-tier system entirely [11].

eBay removed the listings after press inquiries, with a spokesperson saying they violated the site's policies [10]. But the supply chain for verified accounts is not limited to eBay. Roblox's senior director of product policy stated the company runs "continuous age-check systems" in the background to detect suspicious behavior, and deployed a machine learning system called Roblox Sentinel to flag accounts whose behavior is inconsistent with their verified age [8]. The company has not published data on how many accounts Sentinel has flagged or how effectively it catches purchased accounts.

Parents Making Things Worse

One of the most counterintuitive failure modes involves parents themselves. Frustrated by the technical friction of age verification — or by their children being locked out of chat features — some parents completed the facial scan on behalf of their children [11][3]. By using an adult's face to verify a child's account, these parents inadvertently placed their children in the 21+ bracket, the least restricted tier on the platform.

Roblox acknowledged this problem and said it was "working on solutions" [2]. Parents can reset age checks and re-verify using ID or the parental controls dashboard. But the existence of this workaround reveals a design tension: the system relies on individual compliance with a process that many users — particularly those with limited technical literacy — do not fully understand.

The Developer Fallout

The age verification rollout hit Roblox's developer ecosystem hard. Developer reports posted to the Roblox Developer Forum showed chat feature usage plummeting from approximately 90% to 36.5% following the mandate [2].

Source: Developer Forum Reports / Engadget

Data as of Jan 15, 2026CSV

Developers described their games as feeling like "a total ghost town" and "lifeless" [2]. For games built around social interaction — a significant portion of Roblox's catalog — the drop in chat engagement represents an existential threat. Thousands of developers posted complaints on the forum, with some arguing the mandatory requirement "completely cripples entire genres and small games on Roblox" [12].

The company has responded with a "Fast Follow Roadmap" published on the Developer Forum, promising iterative improvements to the system [12]. A March 2026 update acknowledged ongoing concerns and outlined planned changes, but developers report that engagement has not recovered to pre-mandate levels [13].

The Scale of the Platform

Roblox's growth trajectory provides context for both the urgency and the difficulty of age verification. The platform reached 144 million daily active users in Q4 2025, up from 85 million a year earlier — a 69% increase in twelve months [14]. Full-year 2025 revenue hit $4.9 billion, a 36% jump from 2024 [14]. The company is guiding 2026 revenue between $6 billion and $6.2 billion [14].

Source: Roblox Quarterly Earnings Reports

Data as of Feb 13, 2026CSV

A significant majority of Roblox's user base is under 13. The platform has deployed more than 400 AI models across content moderation, discovery, and safety [14], and employs approximately 3,000 moderators [15]. Despite these investments, Roblox reported a net loss of $1.07 billion for 2025, up from $940 million the prior year [14]. The company has not disclosed what portion of its losses or operating expenses are attributable to age verification specifically, including vendor contracts with Persona and engineering overhead.

The Bypass Problem

The age verification system has proven porous beyond the black market. Reports surfaced of users fooling the facial estimation by drawing wrinkles and stubble on their faces — one child was instantly rated 21+ [2]. Another user submitted a photo of Kurt Cobain and received an adult classification [2]. VPN services publish guides on how to circumvent Roblox's age restrictions, though these primarily affect regional access rather than the facial scan itself [16].

For access to 17+ and 18+ restricted experiences, government ID is required — a higher bar than facial estimation [16]. But the chat system, which is where most social interaction and potential predatory contact occurs, is gated only by the more easily spoofed FAE technology.

Roblox has stated that using VPNs or other methods to bypass safety systems violates its Community Standards and could result in account suspension or permanent ban [16]. The company has not published data on enforcement actions taken against users who circumvented age verification.

The Legal Context

The age verification rollout coincides with mounting legal pressure. At least 35 lawsuits allege Roblox failed to protect minors from predators and harmful interactions [17]. In December 2025, the Judicial Panel on Multidistrict Litigation consolidated these cases in the U.S. District Court for the Northern District of California [17]. In January 2026, Louisiana Attorney General Liz Murrill filed a separate state-court lawsuit accusing the company of failing to protect children from exploitation [17].

State attorneys general in Texas, Louisiana, and Kentucky have launched investigations into Roblox's safety practices [11]. One notable case, Seitz v. Roblox Corp., involves a 13-year-old who was allegedly pushed to suicide by extremist community members on the platform [11].

As of April 2026, no verdicts or settlements have been reached, and Roblox denies that its platform is inherently unsafe [17].

How Roblox Compares to Global Standards

Roblox is not operating in a regulatory vacuum. The UK's Online Safety Act, fully live as of July 2025, requires platforms to implement "highly effective" age assurance for access to harmful content, with Ofcom able to impose fines up to £18 million or 10% of global turnover [18]. Australia's Online Safety Act mandates that platforms prevent users under 16 from creating accounts on age-restricted social media, with fines up to AUD 49.5 million per breach [19]. The EU published a second blueprint for age verification in October 2025, built on the same technical specifications as European Digital Identity Wallets [20].

None of these jurisdictions has published a specific acceptable error rate for age estimation technology. Australia's code establishes reporting requirements but leaves accuracy thresholds unspecified [19]. The UK's Age Check Certification Scheme tests vendors like Persona but certifies them based on methodology rather than mandating a maximum error rate [18]. This regulatory gap means there is no external benchmark against which to measure whether Roblox's misclassification rate is acceptable or excessive.

The Persona Security Incident

In February 2026, security researchers reported that Persona's frontend had been left exposed, revealing that the vendor's system runs processing far beyond basic age estimation [21]. Behind the age check interface, researchers found Persona's system executes 269 distinct verification checks, runs facial recognition against watchlists and politically exposed persons databases, and screens users across 14 adverse media categories including terrorism and espionage [21].

Persona pushed back against the findings, stating its default setting is to delete all personal data immediately after processing [22]. However, Persona's own privacy policy allows data retention for up to three years in some circumstances and permits the use of cloud service providers including AWS, Google Cloud, and MongoDB for processing biometric data [22]. Discord, which also uses Persona for age verification, delayed its own global rollout following the incident [23].

The gap between what users believe is happening — a simple age scan — and what the backend infrastructure is capable of processing raises transparency questions that Roblox has not publicly addressed.

The Steelman Case for Critics

Critics argue the age verification system is a liability shield, not a safety measure. Roblox faces at least 35 lawsuits, consolidated MDL proceedings, and multiple state attorney general investigations [17]. Deploying a visible, technically novel age-gating system allows the company to demonstrate proactive compliance in court — regardless of whether the system works.

The underlying moderation infrastructure remains the subject of litigation. The lawsuits allege that predators have contacted, groomed, and exploited children on the platform despite existing safety measures [17]. If the core content moderation and predator-detection systems are inadequate, an age verification layer that sorts users into brackets — but can be bypassed with drawn-on stubble or a $5 eBay purchase — does not address the root problem. The system creates the appearance of safety without necessarily producing it.

Kaufman's own framing — "building for the next decade of the internet, not the next news cycle" [2] — implicitly concedes that the current system is incomplete. Critics ask whether an incomplete system that misclassifies children as adults is worse than no system at all, because it creates a false sense of security for parents.

The Steelman Case for Roblox

Roblox operates at a scale that makes perfect age verification functionally impossible. With 144 million daily active users and a user base skewed heavily toward minors, any system — no matter how well-designed — will produce false positives and false negatives [14]. A MAE of 1.4 years, while imperfect, represents the current state of the art in facial age estimation [8].

The parent complaints that have driven headlines represent a fraction of the total verification events. Roblox has verified millions of users since January [3]. If the error rate is even 1–2%, that translates to millions of affected accounts at this scale — a large absolute number that can look systemic even if the per-user failure rate is low.

The alternative to imperfect age verification is no age verification, which is the status quo that produced the lawsuits, attorney general investigations, and congressional scrutiny the company now faces. No platform of Roblox's size has attempted mandatory facial age estimation for its entire user base. The company is absorbing the cost of being first — in engineering resources, in reputational damage, and in the $1.07 billion annual loss that partly reflects safety investments [14].

The bypass methods, while real, require deliberate effort. A child drawing wrinkles on their face or a predator buying an account on eBay are adversarial behaviors that no verification system can fully prevent. The question is whether the system raises the floor for the average user, not whether it stops determined bad actors.

What Parents Can Do — and What They Can't

Parents whose children have been misclassified can reset the age check through the Parental Insights dashboard, submit government ID for re-verification, or contact Roblox support [7]. Roblox has not published data on how long the appeals process takes or what percentage of appeals are resolved in the parent's favor.

The company's recommended recourse assumes a level of technical engagement that not all parents can provide. For families without government-issued ID for their children, or those in jurisdictions where children's identity documents are uncommon, the appeals path may be effectively inaccessible.

Roblox has stated that users may be prompted to re-verify if their behavior appears inconsistent with their estimated age [7]. This suggests the system is designed to self-correct over time. But the company has not disclosed how frequently re-verification is triggered, what behavioral signals activate it, or whether the process generates its own false positives.

What Remains Unknown

Several critical questions remain unanswered. Roblox has not published the total number of misclassified accounts, a breakdown of errors by direction (minors classified as adults versus adults classified as minors), demographic accuracy data, resolution rates for appeals, or the financial cost of the verification system including vendor contracts and lost revenue from locked accounts. Without this data, the public cannot independently assess whether the system is producing acceptable tradeoffs or generating more risk than it mitigates.

The absence of regulatory benchmarks compounds the problem. Until regulators in the US, UK, EU, or Australia define what error rate is acceptable for age estimation on platforms used primarily by children, the debate will remain a contest of anecdotes — parents with misclassified children on one side, Roblox's scale arguments on the other — with no agreed-upon standard for resolution.