Since January 2026, Roblox has required all users globally to submit to facial age verification before accessing any chat features. The process requires children to open the Roblox app, grant camera access, and follow on-screen instructions while a third-party vendor called Persona scans their face.

How It Works

The system uses facial age estimation technology to place users into one of six age brackets: Under 9, 9-12, 13-15, 16-17, 18-20, and 21+. The company claims the technology can estimate age "within 1.4 years" of a child's actual age. Users aged 13+ can opt for government ID verification instead — but younger children have no alternative to the face scan.

Privacy Red Flags

While Roblox states that images are deleted after processing, critics point out that forcing millions of children to submit biometric data creates an enormous attack surface. "We are normalizing facial surveillance for children as young as 9 as a condition of social participation," said Dr. Elena Marchetti, a digital rights researcher at the University of Amsterdam. "This is extraordinarily concerning."

The system also raises questions about data retention, third-party access, and what happens if Persona — the verification vendor — suffers a breach. Parents have reported confusion about how to opt out, with many unaware that declining the scan means their child loses all communication features, including text chat with friends.

Global Regulatory Response

The European Union's EDPS has opened a preliminary inquiry into whether Roblox's biometric requirements comply with GDPR's strict rules on processing children's data. In the Philippines, regulators have threatened platform restrictions over child exploitation concerns, while Spain's new criminal executive liability framework could hold executives personally accountable for safety failures.