TL;DR: Since January 7, 2026, Roblox requires every user to scan their face before they can chat. The platform has over 100 million daily active users. About 40% are children. The facial scan is processed by a third-party vendor called Persona. Roblox says the images are “deleted immediately after processing.” Persona’s own privacy policy says it can retain biometric data for up to three years. Kids complete the scan without explicit parental consent. They just follow an on-screen prompt. When the AI gets someone’s age wrong, parents can get locked out of parental controls entirely. Roblox calls this “safety.” We call it the largest collection of children’s biometric data in gaming history.
How It Works
Open Roblox. Try to chat. A prompt appears: “Chat is locked. Unlock it now!” Follow the instructions. Point your phone camera at your face. Move your head left, then right. Done [1].
Roblox’s AI analyzes your facial geometry, skin texture, and bone structure to estimate your age. It slots you into one of six brackets: under 9, 9–12, 13–15, 16–17, 18–20, or 21+. You can only chat with users in your age group and the ones directly above and below it [2]. Adults 16 and older can’t message children under 13 unless they’re approved “Trusted Connections.”
The alternative is uploading a government-issued ID with a live selfie. For a platform where millions of users are in elementary school, that’s not much of an alternative.
The Three-Year Problem
Here’s where it gets ugly.
Roblox’s public messaging is clear: facial images are “deleted immediately after processing” [1]. Sounds responsible. Sounds temporary. Sounds like they don’t keep your kid’s face on file.
But Roblox doesn’t process the data itself. It sends everything to Persona, a San Francisco-based identity verification company. And Persona’s privacy policy tells a different story. It permits retention of biometric data for up to three years [4].
So which is it? Deleted immediately, or stored for three years?
Roblox hasn’t explained this discrepancy. The company points to its own policy. Persona points to its own policy. Somewhere in between, millions of children’s facial scans exist in a legal gray zone where “deleted immediately” and “retained for three years” are somehow both true at the same time.
And the data doesn’t just sit with Persona. It passes through what Persona’s policy calls “service providers,” cloud services, and fraud prevention platforms [4]. Each handoff is another point of vulnerability. Each vendor is another privacy policy you’ll never read.
Kids Scan First, Parents Find Out Later
COPPA (the Children’s Online Privacy Protection Act) requires verified parental consent before collecting personal information from kids under 13. The FTC’s updated COPPA rules now explicitly include biometric data like facial scans [5].
Roblox says children under 9 need parental verification for chat access. But parents are reporting a different reality. The sequence goes like this: kid opens Roblox, sees the “unlock chat” prompt, follows the on-screen instructions, scans their face, and they’re verified. All before a parent even knows it happened [2].
There’s no pop-up asking for parental approval. No email to confirm. No text message to verify. The notification is buried in terms-of-service updates that nobody reads. One parent on Reddit put it bluntly: “Why should I teach my child to protect their privacy online if a gaming company is going to undo all that by making them think scanning their face is no big deal?” [2]
The social pressure makes it worse. When your friends can chat and you can’t, the facial scan isn’t really optional. It’s the price of participation. Roblox technically lets you play without verification, but teamwork-dependent games become unplayable without communication. Kids describe it as “broken” or “boring” [2].
When the AI Gets It Wrong, Parents Lose Control
Roblox’s facial age estimation has a margin of error of about 1.4 years [2]. That sounds small until a baby-faced 14-year-old gets slotted into the 9–12 bracket and locked out of age-appropriate content. Or an adult gets rejected as “too young” and told to upload government ID instead.
One mother in Los Angeles lost access to parental controls on her 9-year-old son’s account after the system incorrectly identified him as a teenager [6]. The AI looked at her child and decided he was older than he was. Suddenly she couldn’t monitor his chats, set time limits, or see who he was talking to, because the system “verified” him into an older age bracket.
The appeals process is slow, manual, and requires sharing additional sensitive documents [2]. In the meantime, a parent has no visibility into what their child is doing on a platform that has faced about 80 lawsuits alleging it enabled child exploitation [2]. Over 30 people have been arrested since 2018 for grooming crimes on Roblox.
A Centralized Target Worth Millions of Faces
Roblox has over 100 million daily active users [3]. If even half complete the facial scan, that’s a centralized biometric database of 50+ million faces. A significant chunk of them belong to children.
A single breach would expose permanent biological identifiers. You can change a stolen password. You can freeze a compromised credit card. You cannot change your child’s face.
And the verification itself has holes. Deepfake technology is increasingly accessible. Liveness checks (the head-turning, proximity adjustments) can be bypassed with sophisticated video manipulation [2]. A system designed to keep predators away from children could be defeated by the same AI technology it runs on.
Here’s the kicker: age-verified chat zones may actually create a false sense of security. “Everyone here was checked” could lower a child’s guard against grooming tactics. And it removes what researchers call “benevolent bystanders,” older legitimate users who might spot and report inappropriate behavior [2].
The Lawsuits Driving This
Roblox didn’t build this system out of a sudden burst of concern for kids. It built it because it was getting sued into the ground.
Texas Attorney General Ken Paxton filed suit alleging Roblox “flagrantly” ignored state and federal online safety laws [7]. Florida issued criminal subpoenas in October 2025. Louisiana’s attorney general called Roblox “the perfect place for pedophiles.” [8] About 80 lawsuits from parents and state attorneys general were piling up [2].
The facial recognition system is a legal shield. If a predator gets through now, Roblox can point to its “gold standard” age verification and shift blame to the sophistication of the criminal rather than the negligence of the platform [2]. Matt Kaufman, Roblox’s Chief Safety Officer, framed it as “proactive, age-based barriers” that “empower users to create and connect in ways that are both safe and appropriate” [1].
Translation: we’re collecting your children’s biometric data so our lawyers can say we tried.
Training a Generation to Surrender Their Faces
The bigger danger isn’t the data retention or the lawsuits or the errors. It’s the normalization.
When a 9-year-old has to scan their face to talk to their friends, facial recognition stops being something that happens to other people. It becomes routine. Expected. The way things work. By the time these kids are adults, they won’t think twice about scanning their face to enter a building, board a plane, or apply for a job. The same technology already drives facial recognition built into consumer smart glasses.
Disneyland scans your face at the gate. Detroit schools scan visitors’ faces in the lobby. Madison Square Garden uses facial recognition to ban lawyers and track trans women. Now the world’s most popular gaming platform scans 100 million users a day, and 40 million of them are children.
Each deployment teaches the next generation that surrendering biometric data is just what you do. Not because they chose it, but because they had to in order to talk to their friends.
What Parents Can Do
- Check your child’s account now: Open Roblox’s Parental Insights dashboard. Verify the age bracket the system assigned your child. If it’s wrong, contact Roblox support immediately to dispute it
- Set up parental controls before the scan: If your child hasn’t completed verification yet, configure time limits and chat restrictions through the parent dashboard first
- Understand the opt-out: Your child can play Roblox without the facial scan, but they won’t be able to chat. For many kids, that makes the platform unusable. Have an honest conversation about the tradeoff
- Read Persona’s privacy policy: Not Roblox’s, but Persona’s. That’s the company that actually handles your child’s facial data. Pay attention to the retention and third-party sharing sections
- File COPPA complaints: If your child under 13 completed the facial scan without your consent, file a complaint with the FTC. COPPA’s updated rules explicitly cover biometric data. Complaints create the paper trail regulators need to act
- Check your state’s biometric laws: Illinois’s BIPA requires written consent before biometric collection. Texas, Washington, and several other states have their own protections. You may have rights Roblox isn’t telling you about
References
- Roblox: A New Era of Safety: Facial Age Checks Now Required to Chat (January 2026)
- Glossyfied: The Roblox Facial Recognition Scandal Explained (2026)
- Biometric Update: Roblox Rolls Out Facial Age Estimation for Chat Access Globally (January 2026)
- Persona: Privacy Policy
- Davis Polk: FTC Prioritizes COPPA Enforcement: New Compliance Obligations (2026)
- NBC Los Angeles: Facial Recognition Error Locks Mom Out of Roblox Parental Controls (2026)
- Office of the Texas Attorney General: Paxton Sues Roblox for Putting Pixel Pedophiles and Profits Over the Safety of Texas Children (November 2025)
- NBC News: Louisiana Attorney General Sues Roblox, Calling the Platform ‘The Perfect Place for Pedophiles’ (2025)
Published: May 2, 2026