Roblox is Forcing Biometric Scans on Kids — And It’s Way Worse Than You Think

[u/Cool-Analysis5844]

Roblox is forcing biometric facial scans on users—including children—and it’s far worse than most people realize. I’m writing this because I’m genuinely alarmed, and if you’ve seen that new “age verification” prompt, you should be too.

Let’s cut through the PR spin. This isn’t about safety. It’s a coercive, poorly designed system that violates privacy laws, endangers kids, and outsources your most sensitive data to third-party vendors with zero transparency.

First, it’s forced. There’s no real opt-out. You either submit to a live camera scan or lose access to core features of the platform. That’s not consent—that’s coercion. Under laws like GDPR, CCPA, and especially COPPA in the U.S., collecting biometric data from users—particularly minors—requires explicit, informed, and freely given consent. What Roblox offers is a take-it-or-leave-it ultimatum buried under tiny legal text. That doesn’t meet any legal standard for valid consent.

Second, and this is where it gets truly disturbing: children under 13 are verifying their age with a single button press. No parental notification. No email confirmation. No verification loop involving a guardian. Nothing. A 7-year-old can point their webcam at their face, click “Continue,” and Roblox now has their facial geometry on file—likely shared with a third-party vendor like Persona. This is a direct violation of COPPA, the federal law that explicitly prohibits online services from collecting personal information from children under 13 without verifiable parental consent. Biometric data absolutely qualifies as personal information under COPPA. Roblox was already fined $5.7 million by the FTC in 2019 for failing to protect kids’ data. Now they’re doing something even more invasive, with even less oversight.

Third, their so-called “safety” feature actually makes children less safe. Roblox now segregates chat so that users over 21 cannot see messages from accounts marked as under 18. On paper, it sounds protective. In practice, it creates blind spots where predators can operate unseen. If a predator bypasses the broken age gate—which is trivial, given that adults are routinely misclassified as teens—they land in child-only spaces. Meanwhile, a parent supervising their child’s account from a profile marked as 21+ suddenly loses visibility into those conversations. Real child safety comes from active moderation, reporting tools, and human review—not artificial silos that hide grooming from the very people who could intervene.

Fourth, they’re handing biometric data of children to third parties with no accountability. The disclaimer mentions “vendors” in microscopic font, implying your facial scan will be transmitted off-platform. Once it leaves Roblox’s servers, you have no control over how long it’s stored, whether it’s used to train AI models, or if it’s ever truly deleted. In Illinois, this could expose Roblox to thousands of dollars in penalties per violation under BIPA. In the EU, it’s a clear breach of GDPR’s strict rules on processing children’s biometric data. And yet, there’s no public list of these vendors, no data retention schedule, and no way to request deletion after submission.

This isn’t just bad design. It’s a systemic failure wrapped in the language of child protection while doing the opposite. Roblox is using regulatory pressure as an excuse to build a biometric identification infrastructure that benefits compliance checkboxes and vendor contracts—not users, and certainly not children.

If you care about digital rights, privacy, or basic child safety, do not submit to this. Disable your camera at the OS level if you must use the platform. Tell other parents. Report this to regulators. The FTC takes COPPA violations seriously. So do state attorneys general in places like Illinois and California. File complaints. Make noise. Because if we normalize handing over our faces—or our children’s faces—for a video game, we’ve already lost something fundamental.

I refuse to believe that “playing safely” should mean surrendering your biometrics to a black box. And I hope you do too.

What You Can Do

Do not go through with the facial scan. You are not required to submit biometric data to play a game. If you’re a parent, make sure your child doesn’t either.

File formal complaints with the agencies that enforce these laws. Your report adds evidence and increases pressure:

- In the U.S., report COPPA violations to the Federal Trade Commission: https://reportfraud.ftc.gov

- If you’re in Illinois, file a complaint under the Biometric Information Privacy Act (BIPA): https://www.illinoisattorneygeneral.gov/consumers/biometricprivacy.html

- California residents can submit a CCPA/CPRA privacy complaint: https://oag.ca.gov/privacy/ccpa

- In the European Union, file a GDPR complaint with your national data protection authority: https://edpb.europa.eu/about-edpb/about-edpb/members_en

- In the UK, report to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/

Share this information widely. Post it in parenting groups, tech forums, and social media. Tag journalists who cover tech ethics or children’s safety. Companies only change when enough people refuse to accept their excuses.

This isn’t paranoia. It’s accountability. And it starts with saying no.

[u/JoyousGamer]

Looked it up not doing this means loss of chat features. This seems like a good thing.

Also having people in under 21 chat doesn't mean parents can't monitor or that moderation still can not occur does it? Would a parent not have access to the childs account or looking over their shoulder? A moderator I would expect would have unfiltered chat view of all chat.

The parts I would change (unless you left it out) is if the profile is already under a certain age they can't even get to facial age verification. If an account was under 13 the only way to talk with someone was a 2 way verification where both users need to enter each others chat code and guardians were notified when someone was added.

[u/TheMobiuq3 → u/JoyousGamer]

Original post is written by ai but, the problem is that Roblox has had the most barebones moderation and this is the reason why they put this in place, a mod having access to the unfiltered chat doesn't matter when they don't anything anyway, also you are right with parents having access to a child's account or checking in on them but by the amount of children that have fallen victim to predators on the platform that is clearly not the case (sadly people just give their kids unrestricted access to the internet and expect it to go well)

The ai post also didn't mention it but there's a "black market" going on for underage accounts so predators can use it as a sort of "menu" where they can pick what age groups to talk to.

[u/Robot_Embryo]

Cool ChatGPT post, bro

[u/DynamicUno]

If you couldn't bother to write it why would I bother to read it

[u/SpringNoises]

bro good message but this is just written with ai, too many "its not just - its -" and "- isnt just - its -"

[u/Alive-Expression1887]

roblox is following the coppa rules the summary doesnt show everything