Published on Aug 28, 2025
As Roblox (RBLX) continues to announce new safety features and policies amid a growing wave of lawsuits alleging the company facilitates the sexual exploitation of children and teens, one thing remains constant—it is remarkably easy for individuals claiming to be any age to create accounts on the immensely popular online gaming platform.
How easy? Last week, The Capitol Forum created 95 separate Roblox accounts in the span of one hour using the same computer. Each account was created with a fake 10-year-old birthday, although at time of publication Roblox allows users to input birth years as recent as 2020 to sign up and gain access to millions of user-generated “experiences” where players can interact in real time.
After Louisiana Attorney General Liz Murrill filed a child protection lawsuit against the company on August 14, Roblox posted a public response claiming it “has rigorous safety features built in, and its policies are purposely stricter than those found on social networks and other user-generated content platforms.”
But unlike most social media sites, Roblox directly caters to users under 13 and does not require any phone number, email address, or age/identity verification to initially sign up and begin accessing its services. Individuals must simply submit a birthday, username, password, and, optionally, their gender.
When signing out of their account for the first time, users under 13 will be prompted to provide a “parental recovery email” or risk losing access to “any game progress, items, and [Roblox virtual currency] Robux.” But as stated in Roblox’s Privacy and Cookie Policy, which all users must agree to when signing up, “Children are encouraged to provide a parent’s email address, but are not required to do so to create an account.”
“Why not require [children under 13 to provide their parents’ email]?” Martin D. Gould, a founding partner at Stinar Gould Grieco & Hensley (SGGH), which, alongside Milberg Coleman Bryson Phillips Grossman, PLLC, is representing over 400 alleged victims of abuse on platforms like Roblox and Discord, said in an interview. “What parent would want their 10-year-old on some app where they can talk to adults from who knows where? You know, it just adds an additional layer of protection and it would serve as a deterrence if other people know that these kids that are 13 and under are using their parents’ email,” Gould opined.
Gould, who co-chairs SGGH’s Sexual Abuse Practice Group and has three children himself, including a six-year-old who earlier this year asked if they could join Roblox, said he understands the appeal of a platform that combines creative, gaming, and social elements, but that Roblox’s open-world design and historical lack of age verification requirements pose unique safety risks compared with other sites.
As of November 2024, users under 13 can no longer directly message others outside of games or experiences and this month Roblox announced that only users who are ID-verified and 17 or older would be able to access social hangout experiences that depict private spaces like bedrooms or bathrooms. But critics call the efforts too little too late and note that players of all ages can still communicate through public chats within experiences or lie about their birthday to get around certain age-restricted features or defaults.
“You had a uniquely high number of pedophiles and predators that were on this app, and they had an ability to get access to kids that you don’t really get from other apps,” Gould said. “Snapchat, you need somebody’s specific handle or phone number. Even social media, like on Facebook or Instagram, you have to message the person directly cold… Roblox, you can have a lot of interaction with tons of kids everywhere and I think that was one of the driving forces as to why there’s so many victims in horrific cases.”
Roblox did not respond to a request for comment.
Lack of email or phone verification leads to uniquely easy sign-up process, Capitol Forum test shows. Nearly all of the recent lawsuits follow a similar pattern of alleged abuse: a predator misrepresents their age on Roblox to befriend a younger user before shifting the conversation to a third-party messaging platform, where the child is further manipulated into sending nude photos and videos or meeting up in person.
The Capitol Forum tested how easy it was to set up multiple user accounts on Roblox compared with other social messaging platforms such as Facebook (META), Instagram, Snapchat (SNAP), TikTok, and Discord. To ensure consistency, all accounts were created using the same private web browser (Google Chrome) on the same MacBook Air computer.
Over the course of an hour, a Capitol Forum reporter managed to create 95 separate Roblox accounts, an average of more than 1.5 accounts per minute. Each account was created using a different 2015 birthday, representing a fake 10-year-old user.
Roblox’s account creation page. Accessed August 27, 2025. Source: Roblox.
After the first three accounts were created, the Roblox site began asking the reporter to solve a one-step CAPTCHA puzzle consisting of an object that needed to be rotated a certain direction so that Roblox “know[s] you are a real person.” However, if the reporter switched their IP-based geolocation using a virtual private network (VPN), the CAPTCHA requirement would go away for subsequent attempts, and they could continue creating accounts unimpeded.
For Facebook, Instagram, Snapchat, TikTok, and Discord, The Capitol Forum tried to create multiple accounts using one phone number or email address per platform as the verification method. None of the non-Roblox sites allowed the reporter to create multiple accounts using the same phone number or email, unless (in the case of Facebook and Instagram) they submitted a video selfie for verification.
While individuals can set up alternative email accounts or phone numbers to create multiple accounts on the other platforms, by not requiring any form of email or phone verification Roblox creates an especially frictionless sign-up process, particularly for children who might lack the ability to create an email or access their parents’ inboxes.
“Capitol Forum’s testing shows that while other social media platforms add at least some friction to account creation, Roblox makes it unusually easy for children to create fake accounts,” Holly Grosshans, Senior Counsel for Tech Policy at Common Sense Media, said in an email. “This means kids can also quickly set up accounts claiming to be 18+, either to avoid safety and privacy settings or because they were encouraged to do so by others online.”
“As a result, Roblox likely has far more under 13 users than it reports,” Grosshans added.
In its latest annual filing, Roblox reported that of the average 82.9 million daily active users that visited the platform in calendar year 2024, approximately 40% were under the age of 13. As of August 15, the company claims that “64% of the user base is now 13 or over.”
Roblox blurs the line between social media and gaming, raising potential COPPA concerns. CEO David Baszucki calls Roblox the “next phase of human interaction” and says he wants to target “10% of the global gaming content market on the platform” but critics argue that Roblox serves as a de-facto social media site for preteens while avoiding much of the regulatory scrutiny faced by major social media platforms.
Under the Children’s Online Privacy Protection Act of 1998 (COPPA), Roblox would have to obtain verifiable parental consent to collect the personal information, such as a name, phone number, or email address, of persons under 13. Most social media companies require users be over 13 to avoid such obligations, but, as privacy advocates point out, platforms are only subject to the law if they collect or have “actual knowledge” that they are obtaining kids’ personal information. Sites can claim ignorance of users’ ages to take advantage of this “knowledge standard” loophole.
“Updating COPPA’s knowledge standard, as proposed in COPPA 2.0, would help address this gap by holding Roblox accountable for users that they know, as fairly implied on the basis of objective circumstances, are under the age of 13,” Grosshans said.
Roblox explains in its privacy policy that the optional parent email address is the “only personal information as defined by COPPA we collect from child accounts” and explicitly tells individuals on its sign-up page to not use their real name when coming up with a username.
But Roblox’s policy elaborates that if a user is 13 years old or over, “you can share your Personal Information through chat, forums, messages or similar ways of sharing on our Service,” including “add[ing] links to your other social profiles on your Roblox account,” and that the company is “not responsible for how your Personal Information is used if you shared it yourself.”
“At minimum, Roblox should make all accounts default to the highest safety and privacy settings and require some friction in account creation,” Grosshans said. “This would not solve every moderation issue, but it would make the platform safer for all users.”
Roblox permits users 13 and up to link to third-party social media sites, despite cracking down on “vigilantes” for shifting conversations off platform. While stating in its privacy policy that users 13 and older are allowed to add links to third-party social media accounts, Roblox maintains in blog posts that players who shift conversations to other social media platforms impede its safety efforts and ability to hold bad actors accountable.
In an August 13 post, Chief Safety Officer Matt Kaufman elaborated on why Roblox had recently decided to remove “vigilantes” from the platform. The previous week, 22-year-old content creator “Schelp” announced on X that the company had sent him a cease-and-desist letter and terminated all his accounts.
Schelp, who is now defended by SGGH and Milberg, runs a YouTube channel with more than 1.7 million subscribers where he and his team expose adults who contacted their underage “decoy” Roblox accounts in search of real-world meetups. Schelp’s ban sparked a viral #FreeSchlep protest movement and a petition posted August 9 calling for Baszucki’s removal as CEO has over 250,000 signatures to date.
“Instead of just reporting on safety issues, vigilantes started impersonating children and actively sought to connect with adult users,” Kaufman wrote on August 13. “Those conversations mimicked inappropriate behavior and actively encouraged other users to connect on other social media and messaging platforms—thus bypassing Roblox’s own safety systems.”
Kaufman said this kind of behavior “created an unsafe environment” and that Roblox’s “policies prohibit directing other users off Roblox to another platform through chat and having/simulating sexually explicit conversations.”
But in Roblox’s own official community standards for user behavior, the platform says users over 13 are permitted to link YouTube, Facebook, Discord, X, Guilded, and Twitch URLs to their Roblox profile or an experience description page. The standards qualify that “Any other efforts to direct users off of Roblox to an external website or service”—such as sharing links through chat instead of a profile—are prohibited.
It appears that no age verification is required to publicly display such links in a profile, so long as the user claims to be 13 or older when signing up. After creating a Roblox account using a 13-year-old birthdate, The Capitol Forum was able to publicly link to a Facebook profile on their account page (Discord did not appear as an option in The Capitol Forum account’s backend settings, despite being included on the list of permitted third-party sites in Roblox’s community standards).
Account info settings for The Capitol Forum’s 13-year-old avatar that enable the user to publicly link to their Facebook, X, YouTube, Twitch, and Guilded accounts on their Roblox profile. Accessed August 27, 2025. Source: Roblox.
The Capitol Forum’s 13-year-old avatar Roblox profile was able to publicly display an icon linking to a Facebook profile page. Accessed August 27, 2025. Source: Roblox.
“We’ve had clients where the predator took their number straight off their [Roblox] account and reached out to them on Snapchat or off some other platform,” Gould said. “The only reason that they do these things is because they have an army of people at the company running the numbers, finding out what’s the best way to maximize the growth and, irrespective of the risk of harm to the kids, are running with those policies,” he opined.
Lawmakers voice concerns as public protests and lawsuits grow. As new child protection lawsuits continue to be filed against Roblox in California, Iowa, Texas, and other states, state and federal lawmakers have increasingly voiced concerns with the platform’s approach to safety and called for changes.
“[The Capitol Forum’s account creation] findings don’t surprise me,” Louisiana State Rep. Laurie Schlegel said in an email. “What makes Roblox’s lack of child protections especially egregious compared to other platforms is that some of the youngest children use it precisely because it was designed and marketed as a ‘kids’ game.’ The sheer number of news articles and lawsuits makes it clear that Roblox has failed to put the necessary guardrails in place to protect children.”
Schlegel, a Republican, co-sponsored a 2023 Louisiana bill clarifying that minors needed the consent of a parent or legal representative to enter into a contract—“including the creation of an online account”—with an interactive computer service.
“Even so, Roblox continues to allow minors to contract with them and open accounts without parental consent,” says Schlegel, who also helped pass the state’s Kids Online Protection and Anti-Grooming Act earlier this year.
The act, which becomes effective June 1, 2026, makes child grooming a crime in Louisiana, and establishes a duty of care for online platforms that contract with minors, “faced heavy opposition, including direct lobbying from one of [Roblox’s] executives,” according to Schlegel.
The anti-grooming law received broad bipartisan support and passed both state legislative chambers unopposed in June. At the federal level, Rep. Ro Khanna (D-CA), whose district includes Roblox’s San Mateo County headquarters, launched a petition this month calling on Roblox “to do more to protect children, provide more support to parents, and strengthen law enforcement protocols that help bring predators to justice.”
“When their own community of users raised the alarm about predators on the site, Roblox doubled down instead of taking responsibility, revealing where their priorities truly lie,” Schlegel said regarding the company’s decision to ban Schlep. “That episode also demonstrated that Roblox is fully capable of removing material they do not want on their site, making their inaction on child safety even more telling.”
