Major Child Safety Gaps Exposed for Roblox, Fortnite, Minecraft and Steam

A major Australian investigation has revealed troubling differences in how four of the world’s biggest gaming services protect children. Some findings raise serious questions about how effectively platforms detect grooming, sexual exploitation, dangerous content and adults attempting to contact young players.

Millions of children use online gaming platforms to play, compete, create and communicate with friends. However, many parents may not realise that the safety protections operating behind these games differ significantly. A major investigation by Australia’s eSafety Commissioner has now exposed important gaps in how some of the world’s most popular gaming services protect their youngest users.

Published in October 2026, the report, Playing it safe: how online game services are (or are not) keeping kids safe online, examined the safety systems used by Roblox, Fortnite, Minecraft, Steam and Steam Chat. Researchers assessed the information companies supplied about age checks, harmful content detection, communication features, moderation, parental controls and cooperation with other services. The findings should be of concern to parents, educators, policymakers and anyone responsible for protecting children online.

What the Investigation Revealed About Gaming Safety

The Australian regulator required Roblox Corporation, Epic Games, Mojang Studios and Valve Corporation to explain how they protected users from serious online harms. The reporting period covered 1 October 2025 to 31 March 2026, although the published report also identifies developments after that period.

The regulator found that there was no consistent minimum standard of safety protection across the services examined. Some providers reviewed games before making them available, while others depended more heavily on detecting problems after content had already been published. Differences also emerged in how platforms identified children, monitored conversations, prevented repeat offenders and responded to reports of potentially harmful behaviour.

For parents, the central message is significant. A game may offer parental controls and advertise child safety measures, but that does not mean every interaction, conversation or activity is being effectively monitored. Furthermore, an account registered with an incorrect age may not receive the protections designed for children.

Roblox: A Detection Tool With Just 51% Recall

One of the report’s most striking findings concerns Roblox and its automated image moderation technology. The regulator found that Roblox’s Image Auto mod tool, which was used to detect violent material and child sexual exploitation and abuse material across images on the service, had a reported recall rate of just 51%.

Recall measures how successfully a detection system identifies relevant material that should be flagged. A recall rate of 51% means that, under the reported evaluation, the tool identified approximately 51 out of every 100 relevant cases. This does not establish that 49% of all harmful material on Roblox was missed, because other detection systems, reporting processes and human moderation may also operate.

Nevertheless, the finding raises important questions about the reliability of automated safety technologies. If a child encounters harmful content, parents should not assume that an algorithm will necessarily identify or remove it before exposure occurs.

The investigation also found differences in how newly created games were examined. Whereas Epic Games conducted a comprehensive review of Fortnite Islands before publication, Roblox used several tools to identify harmful Experiences after publication.

Roblox subsequently introduced additional age assurance and child protection measures, including changes following regulatory engagement in Australia. These improvements are important, but they do not eliminate the need for parental involvement.

Parents can review the CODA Roblox Safety Settings Guide to understand communication restrictions, age checks, blocking, reporting and account supervision.

Only 4% of Roblox Child Accounts Had Parental Controls Enabled

Another important finding concerns the use of parental controls. According to the report, Roblox stated that just 4% of Australian accounts identified as belonging to users under 18 had parental controls enabled during the reporting period.

This is particularly concerning because parental controls can provide adults with additional ways to manage communication, account permissions and certain activities. However, it is essential to distinguish parent enabled controls from safety restrictions that a platform may already apply automatically to children’s accounts.

The investigation also identified substantial differences between services. Epic Games reported that 74% of Australian Fortnite accounts declaring an age under 18 had parental controls enabled, with a further 11% operating as Cabined Accounts with restricted features. For accounts declaring an age under 16, Epic stated that all were either subject to parental controls or using a Cabined Account.

These figures suggest that providers can adopt very different approaches to protecting young players. However, they are not directly comparable measures of overall safety, because each company’s account systems, reporting methods and protection arrangements differ.

Why this matters: Parents should actively set up available supervision tools rather than assume that their child’s account is fully protected. Equally, companies should design protections that do not depend entirely on parents discovering and enabling them.

Steam – Serious Questions About Chat Monitoring

The investigation identified particularly significant weaknesses in Steam and Steam Chat during the reporting period. Unlike the other providers examined, Valve reported that it did not use hash matching technology to identify previously confirmed child sexual exploitation and abuse material or violent material on these services.

Hash matching allows providers to compare digital signatures of images and videos against databases of previously identified harmful material. This helps companies recognise known content without having to repeatedly inspect it manually. Its absence from the reported safety measures therefore represented a notable gap.

The regulator also found that Valve did not proactively detect harmful activity in Steam Chat text and voice conversations using the kinds of tools described by the other providers. The exception was a URL detection tool primarily used to block scams.

These findings raise concerns about the extent to which harmful conversations could be identified before a user reported them. In addition, Valve did not participate in the cross industry safety information sharing initiatives identified in the investigation.

For parents, this reinforces the need to understand that Steam is not simply an online game store. It also includes communication features, community groups and opportunities to interact with strangers.

Families using the service should review CODA’s Steam Safety Settings and Parental Controls Guide, paying particular attention to Friends Chat, Community access, approved games and communication inside individual games.

Fortnite – Stronger Preventive Measures, But Important Gaps Remain

The investigation identified several positive practices implemented by Epic Games. For example, Fortnite subjected every Island to a comprehensive review before publication, and the service used language analysis tools incorporating internal information and externally informed training data.

Epic also reported extensive use of parental controls and restricted accounts for younger users. These arrangements provide protections against certain interactions and activities that may expose children to harm.

However, the investigation identified weaknesses in the handling of some serious reports. Epic Games had an average assessment time of 18 hours and 53 minutes for automated reports involving a specified category of unconfirmed child sexual exploitation and abuse material or activity, excluding grooming and sexual extortion. This figure must not be presented as the average response time for all child safety complaints.

The report also found that Epic Games did not participate in the Lantern cross platform child safety information sharing initiative during the reporting period. Although it received information from organisations including the Internet Watch Foundation and Tech Against Terrorism, there were limitations to its sharing of child sexual exploitation signals with other providers.

Epic reported additional developments after March 2026, including expanded specialist investigative staffing and further measures relating to harmful communications. These improvements are relevant, but parents should continue to review the CODA Gaming Safety Settings Resources before allowing children to use interactive gaming services.

Minecraft – The Risks of Third Party Servers

Minecraft offers creative and educational opportunities, allowing children to build, explore and collaborate. However, not every Minecraft environment is operated or moderated directly by Mojang Studios.

The investigation found that users declaring themselves aged 18 or older could access third party Minecraft servers that were not proactively moderated by Mojang. While the company used certain scanning processes and user reports to identify high risk servers, this did not amount to continuous oversight of everything happening inside those environments.

The findings are particularly important because children can interact with strangers in multiplayer worlds and may not appreciate the difference between official services and independently hosted servers. Furthermore, an inaccurate age declaration can affect the restrictions applied to an account.

Minecraft’s Microsoft and Xbox account systems provide child safety settings, including restrictions on multiplayer communication. Nevertheless, the report highlights why the age recorded on an account and the permissions granted by parents are critical.

Parents should review the multiplayer and server permissions covered in CODA’s Popular Games Safety Settings Resources.

The Hidden Danger of Moving Children From Games Into Private Conversations

One of the most important messages in the report goes beyond the individual gaming platforms. It concerns off-platforming, where a child is encouraged to move from a gaming environment to another communication service, often one offering more private conversations.

The Australian regulator highlights how an individual may first make contact with a child through a game before attempting to continue the relationship elsewhere. That could involve moving from Roblox, Fortnite or Minecraft to a private messaging application, group chat or another online community.

This behaviour can form part of child sexual grooming, sexual extortion or recruitment into harmful extremist communities. Once a conversation moves outside the original game, its safety systems may no longer apply, and parents may have little awareness that communication is continuing.

The report also describes how offenders may offer virtual currencies, game rewards or desirable digital items as incentives for children to engage in inappropriate interactions. What initially appears to be an innocent online friendship or generous gift can develop into manipulation, secrecy and coercion.

CODA has examined this danger in our article on Online Gaming Grooming and Private Messaging Risks. Parents should understand that the risk does not necessarily begin with an obviously dangerous website. It can begin inside a game the family already knows and trusts.

Grooming, Sextortion and Extremism Are Not Separate From Gaming

The report also recognises other serious forms of online harm that can occur through gaming environments. These include cyberbullying, hate speech, sexual extortion, exposure to violent content and attempts to involve young people in extremist communities.

In some circumstances, perpetrators exploit anonymity, social relationships and the immersive nature of games to build trust or establish influence. Children may feel that online friendships are meaningful, even when they know very little about the person controlling an avatar. Similarly, competition, team loyalty and shared interests may encourage young players to accept requests they would otherwise question.

The report also addresses sadistic online exploitation, where offenders deliberately manipulate, humiliate, threaten or control victims. This can involve blackmail, grooming and the exploitation of loneliness or emotional vulnerability. These risks require specialist interventions as well as everyday family safety conversations.

Importantly, the presence of a risk does not mean that every child who plays online games will experience it. Gaming offers genuine social, educational and recreational benefits. The objective should be to preserve those benefits while challenging platforms to reduce foreseeable harms.

Why Age Verification Matters More Than Parents May Realise

The investigation found considerable variation in how companies established the age of their users. During the reporting period, Fortnite and Minecraft relied heavily on users declaring their own age, while Valve did not collect the birth dates needed to provide a reliable breakdown between child and adult accounts.

This presents an obvious problem for child protection systems. If a child enters an older age, the platform may apply permissions intended for adults, including broader communication or access to less restricted environments.

Roblox introduced stronger age assurance measures for chat access during the reporting period, while other services used different account restrictions and parental consent processes. However, no age verification system should be assumed to provide complete protection.

Why this matters: Parents should ensure their children use accounts with accurate ages and should not encourage children to bypass age restrictions. Equally, companies must provide appropriate safeguards and consider what happens when a user has been incorrectly classified.

Can Gaming Companies Stop Banned Offenders From Returning?

An additional issue concerns users who have been banned or suspended following serious harmful activity. The regulator examined how gaming services detected attempts to create replacement accounts and return to the platforms.

Roblox, Mojang Studios and Epic Games reported using multiple indicators to identify certain returning offenders. Valve, by comparison, reported using a smaller number of indicators for this purpose.

This is a critical area of online safety because banning an account does not necessarily prevent the individual behind it from returning. Someone intent on harming children may create new identities, use alternative accounts or attempt to continue contact through other services.

The report also found differences in cross industry cooperation. Mojang participated in initiatives including Lantern, while Roblox shared relevant safety signals and cooperated directly with Discord on trends in child safety and violent extremism. Other providers had more limited arrangements.

These findings reinforce the importance of effective cooperation between services when serious risks move across different platforms.

What Parents Should Do Following These Findings

The report should encourage families to become more involved in the online games their children enjoy. Parents do not need to become expert gamers, but they should understand who their children communicate with, which features they use and where online friendships continue.

Practical steps include

• Check the correct age on every account. Ensure the child’s actual age is recorded so relevant protections can apply.
• Enable parental controls and supervision. Review chat, friend requests, multiplayer access, privacy and spending permissions.
• Understand who your child plays with. Ask whether their gaming friends are people they know offline or individuals they have only met online.
• Discuss movement to other apps. Explain why a request to continue a conversation privately, especially while keeping it secret, deserves caution.
• Be aware of gifts and rewards. Discuss requests involving virtual currencies, game items, photographs, money or personal information.
• Review public servers and user created games. Do not assume that all environments within a familiar gaming service have identical safety protections.
• Explain blocking and reporting. Children should know how to leave an uncomfortable interaction and ask for help without fearing punishment.
• Keep conversations open. Ask children about what they enjoy online, the people they meet and anything that has made them uncomfortable.

Parents can begin with the CODA Resources for Parents and explore our dedicated Gaming Platform Safety Settings resources.

Why the Findings Matter for Ireland, the UK and Europe

Although the investigation examined services accessible in Australia, its findings have wider relevance. Roblox, Fortnite, Minecraft and Steam operate internationally, and children in Ireland, the United Kingdom and elsewhere use many of the same gaming features.

However, the report should not be interpreted as proving that every Australian safety setting, moderation arrangement or regulatory requirement is identical in Ireland. Regional differences in platform settings, regulatory requirements and product updates must be considered.

For European policymakers, the report raises important questions about platform accountability, age assurance, child safety by design and the effectiveness of moderation systems. The European Commission’s Digital Services Act framework provides a relevant regulatory context, while Ireland’s Coimisiún na Meán has responsibilities relating to online safety regulation.

The wider lesson is that regulators, researchers and the public need meaningful information about the effectiveness of safety systems. Publishing safety policies is not the same as demonstrating that those policies successfully protect children.

Parents Cannot Carry the Responsibility Alone

The findings reinforce an issue CODA regularly raises in schools and parent education sessions. Parental controls are essential, but they are only one part of protecting children online.

Parents can restrict communication, review permissions and support safer gaming habits. Yet they cannot independently detect every grooming attempt, remove unlawful material from an online service or prevent offenders from returning under new identities.

Those responsibilities must also be addressed by the companies operating the environments. Safety measures should be properly designed, tested, resourced and continually improved, rather than relying on families to discover weaknesses after something has gone wrong.

At the same time, parents have an important responsibility to remain involved in their children’s online lives. A child may appear to be safely playing a familiar game while forming relationships and participating in conversations that adults know nothing about.

The most important question is not simply what game your child is playing. It is who they are interacting with, what they are experiencing and where those interactions may lead.

Online gaming should remain a positive part of childhood. Achieving that requires both effective platform accountability and informed, engaged parents.

References

1. Australian eSafety Commissioner, Playing it safe: how online game services are (or are not) keeping kids safe online, October 2026
2. eSafety Commissioner, Responses to Transparency Notices: Online Game and Gaming Adjacent Services
3. European Commission, Digital Services Act
4. Coimisiún na Meán, Ireland’s Media and Online Safety Regulator

Further Reading

• Online Gaming Grooming and Private Messaging Risks
• Roblox Safety Settings and Parental Controls
• Steam Safety Settings and Parental Controls
• Gaming Platform Safety Settings
• Popular Games Safety Settings
• Resources for Parents

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for schools, parents and organisations. Our guides support practical conversations about online behaviour and the choices people make. However, education and app settings do not replace safeguarding or professional support.

Send a message

Contact Children of the Digital Age to enquire about online safety education, parent sessions or training for your school or organisation.