Around June 16, 2026, Roblox rolled out three age-tiered account types¹ globally: Roblox Kids (5 to 8), Roblox Select (9 to 15), and Standard Roblox (16 and up). Every account has to land in one of those buckets via a mandatory age check. Roblox's parental panel is built into every account under 16 by default.

It's progress. But cramming a 9-year-old and a 15-year-old into one tier is the same mistake, just with tighter walls.

Compared to the platform that existed 12 months ago, the new system is meaningfully safer in two ways.

The mandatory age check is the load-bearing wall of the new system, and its largest structural weakness. Roblox offers two methods: government ID upload, or Facial Age Estimation through Persona. According to Roblox's privacy disclosures, information uploaded to Persona is retained for 30 days before deletion, but Roblox keeps a derived record for the life of the account.

Neither method survives a basic adversary model. Internet Matters³ surveyed 1,270 children aged 9 to 16 in April 2026 and found that 46 percent considered online age checks easy to bypass. Common workarounds: fake birth dates, a drawn-on mustache to fool liveness checks. Australia's eSafety Commissioner⁴ has acknowledged VPNs are used to bypass location-based age restrictions.

Earlier in 2026, Discord⁵ dropped Persona as its age-verification vendor, citing user backlash and concerns about data-handling and alleged federal-government ties. Roblox kept the same vendor. The general risk is not specific to Roblox or Persona, but it's real: any large store of personal data is a target, and breaches of identity databases happen regularly. The 2017 Equifax breach⁶ exposed 147 million records, a reminder that companies whose core business is data still lose it. A list tying children's faces, ages, and account details together would be a sensitive target, which is worth weighing before handing any platform that data.

There is also a question of authority. A platform that verifies a child's identity in order to decide what they can see ends up holding two things at once: detailed data about the child, and a gatekeeping role that can sit awkwardly alongside a parent's own judgment. AAP's 2025 digital media policy⁷ recommends the opposite.

The second gap is one Roblox can't close from inside its own app, and it's the gap that matters most.

The platform can moderate chat, filter content, and lock down friend requests. The platform can't stop a child from taking a screenshot and sending it to a stranger on Discord, or from accepting a Roblox friend request and walking the conversation to Snapchat. The U.S. Department of Homeland Security's Know2Protect campaign⁸, launched in 2024, names this cross-platform movement, sometimes called platform hopping, as the dominant pattern in recent predator cases.

Roblox's parental panel covers four features: chat restrictions, screen-time caps, Trusted Contacts allow-lists, and content filtering. Two things it can't do anything about both happen to live off the platform, on a separate device. These aren't official controls or a recognized framework; they're two practical additions worth considering.

A communication device that never asks for an ID.

A parent-approved contact list enforced at the device level, with unknown numbers blocked by default, gives a child a way to call family without ever needing a Roblox account. The platform-hopping predator has nothing to land on with a kids smartwatch.

A location signal that lives with the parent, not a social platform.

A kids watch with GPS turns "where is my child right now" into a question the parent can answer quickly. It's worth being honest about the trade-off raised earlier: this still means choosing who holds location data, and a watch maker is a company too. The difference is scope and control.

The data is the child's location for a parent who set it up, not a face-and-ID record tied to a social account a child uses to talk to strangers. A parent should still read the device maker's privacy terms before trusting it. This maps to the AAP's 5Cs framework⁹ (Child, Content, Calm, Crowding Out, Communication) under Calm and Communication.

Both run on inexpensive hardware that any parent can configure, and neither requires handing a child's face to Roblox, Discord, or Persona.

The Stacking Pattern: Use the Platform, Add the Hardware

The mistake parents make in 2026 is to pick one side. Either they trust the platform's new controls and ignore the gaps, or they quit Roblox and start a fight they will lose in four days. The pediatric approach is to stack.

Use Roblox Kids for a 7-year-old, chat off, contact list set to family only. Pair it with a smartwatch for kids with its own GPS, its own contact allow-list, and its own zero-ID posture. Use Roblox Select for a 12-year-old with the chat settings the parent chooses, the screen-time caps Roblox provides, and a hardware layer that handles the cases Roblox can't see. The AAP and other authorities all point the same way: parent-side tools, parent-side decisions, parent-side data.

The June 2026 3-tier system is the most serious attempt any major user-generated-content platform has made at child safety by default. The two gaps that remain (privacy-invasive age verification, platform-hopping predators) are gaps parents can close on their side of the wire.