Parents who think that Roblox is a safe place for their kids to hang out online and game might want to think again. According to a class action lawsuit filed in a California court, the gaming platform is accused of secretly tracking the data of children without consent, an activity that the plaintiffs say violates their privacy under federal law.
By tracking young players, Roblox can see every move they make on the platform. That means every keystroke, chat message and search is done under the prying eyes of hidden technology. The technology used picks up the unique identifiers associated with a user’s device and maps them to their game-playing habits. Of course, all that data gathered without permission is used by Roblox and a slew of third-party advertisers to hawk content and other goods and services.
The two parents who initiated the suit, Michael and Salena Garcia, were shocked to learn that Roblox was secretly scooping up their 12-year-old’s data.
“Had they known the truth that Roblox would effectively spy on their child’s activities and identity for profit, they would not have allowed their child to use the platform,” the 45-page lawsuit notes.
Perhaps parents shouldn’t be too shocked because, despite claiming to be a haven for children to create and interact, it is first and foremost a business. And data is the currency of business. That’s not to say that it’s acceptable for companies to spy on kids’ activities without parental permission, but just a reminder that it shouldn’t come as a surprise that they do so to monetize data.
While Boris Cipot, senior security engineer at Black Duck, calls Roblox a “fantastic platform for creativity and self-expression” for young users, he cautions that “as with any online game or social app, parents need to be vigilant about the interactive features in Roblox, as they can sometimes lead to scams or inappropriate behaviour.”
Privacy violations, “like the allegations of tracking children’s data,” spelled out in the latest class action suit, are big concerns, says Bugcrowd founder Casey Ellis. “Beyond that, the social interaction piece is critical. While Roblox fosters creativity and connection, it’s also a space where bad actors can operate.”
The chat function is where miscreants can prey on children. It may be “a great way for players to connect, share strategies and collaborate, but it also carries risks,” says Cipot.
To that point, this is not the first time Roblox has found itself in hot water. In an earlier suit, parents accused the platform of providing “a hunting ground for child sex predators” despite company assurances that its app is safe for children.” That suit was prompted by an online predator posing as a teenager to groom a younger teen on Roblox.
There are other potential dangers as well. “Be aware of the financial aspect. In-game purchases are made using Robux, which can make it hard for kids to grasp the real-world value of what they’re spending,” says Cipot. “Help them understand digital money, monitor their spending and consider enabling password protection for purchases until they can manage it responsibly.”
Sloppy security and playing fast and loose with privacy on a gaming platform like Roblox can ripple out to other tech and apps. “It’s equally important to consider the security of the mobile device and app itself,” says Kern Smith, vice president of global solutions at Zimperium. “Mobile apps — especially those as widely used as Roblox — can be targets for malware, phishing and exploitation through unpatched vulnerabilities. If the device is compromised, attackers can access sensitive information, hijack sessions, or manipulate app behaviors.”
While security measures can reduce, if not mitigate, the dangers, the responsibility for online safety mostly falls to parents. “Technology can help — privacy settings, parental controls and monitoring tools are all useful — but they’re no substitute for trust and communication,” says Ellis. “Kids need to feel comfortable coming to their parents when something doesn’t seem right, whether it’s a stranger reaching out, encountering inappropriate content, or even just a gut feeling that something’s off.”
He encourages parents to set up accounts using minimal personal information and employ passwords and two-factor authentication. “Beyond that, the social interaction piece is critical,” Ellis says.
“The other thing is to normalize conversations about mistakes. Kids are curious, and sometimes that curiosity can lead them into risky or even harmful situations online,” he adds. “If they feel they can talk to you without fear of punishment, you’re far more likely to catch and address issues early. Think of it as creating a “safe space” for them to share what they’re experiencing.”
Ultimately, he notes, “the goal isn’t to scare kids away from technology but to empower them to use it wisely.”
Informed kids, scared parents and an array of security tools can help make online interactions safer for kids. So can the companies that provide online gaming platforms, if they are committed to acting responsibly… or if the threat and cost of legal action pushes them in that direction.
