Roblox’s New Face-Scanning Age Verification and the Hidden Risks of Age-Gating: What Parents Need to Know
- The White Hatter
- 10 minutes ago
- 6 min read
If you haven’t already heard by now, Roblox is rolling out a new age-verification system this month, that scans a user’s face and sorts them into age groups, which will be required if a user wants to use their chat feature on their platform. (1) This initiative, which will be fully implemented by January 2026, aims to enhance child safety by limiting communication between users of different age groups, separating them into six different brackets. Users who do not verify their age will be unable to use any chat functions. With nearly 40 percent of its players under 13, this is one of the most significant safety updates Roblox has ever made. If your child plays the game, this rollout deserves your attention.
At first glance, this may seem like a logical step to protect younger players. However, when you look closely at how age verification systems work, and who runs them, you begin to see a much bigger issue. These systems don’t just affect kids. They reshape privacy for everyone, build new surveillance infrastructure, and create long term risks that families need to understand.
Who Is Actually Scanning Kids’ Faces?
Roblox isn’t doing the facial analysis itself. Every frame of your child’s face is processed by Persona, a third-party age-verification company. Persona is not a small vendor. In April 2025, the company secured a US$200 million Series D round, at a valuation of about US$2 billion. That round was co-led by Founders Fund, this venture capital firm was co-founded by Peter Thiel, a somewhat controversial player in the field of privacy and technology. (2)
This wasn’t just early seed involvement, Founders Fund backed Persona during a major expansion phase, which likely brings influence at the board or strategic oversight level. That matters because when millions of children’s biometric data pass through a company, investors, especially powerful ones, have a stake in how that system grows, given how valuable such a collection of personal data can be.
Roblox says images are deleted after processing. Even if this is true, it doesn’t answer the larger questions:
What data is extracted from the face before deletion?
What metadata is kept?
Could the derived information be repurposed later?
Who inside the verification ecosystem can access the outputs?
We’ve watched this pattern play out many times. A for-profit company promises to protect our privacy and assures us that our personal information won’t be shared or used for its own gain, only for us to find out later that this wasn’t the case. We’ve always encouraged parents to look at the financial incentives first because they often reveal the real motivation.
Biometric data isn’t like a password. You can’t change your face. Once you introduce a child’s biometrics into a commercial verification pipeline, even briefly, the long-term implications are serious.
This is where Roblox’s new age gating system intersects with a larger trend worldwide, where government-driven age-gating laws that require platforms to verify ages using increasingly intrusive methods.
Why Age-Gating Is Becoming a Privacy Flashpoint
Countries around the world are proposing new age-gating laws meant to keep young people safe online. On the surface, these laws sound simple. In reality, they force the creation of systems that collect some of the most sensitive data that families can provide such as identity documents, facial scans, and biometric age-estimates.
Analyses from the Electronic Frontier Foundation warn that legislation like the U.S. GUARD Act would pressure platforms to verify everyone’s age, not just teens. (3) That often requires collecting or checking identity documents, facial biometrics, or credit-based identity records. Researchers studying these systems have called them a “treasure trove” for cyber-criminals. (4) Once created, these databases become irresistible targets.
This isn’t hypothetical. It already happened:
The huge social media platform Discord was breached, exposing passports, driver’s licences, and photos, documents the company said would not be stored. Over 70,000 users were affected. (5)
Another platform, Tea, suffered a similar leak involving verified identity documents. (6)
Age-gating relies on the creation of centralized identity systems, and centralized systems draw attackers.
Four Major Risks Families Need to Understand
1. A Growing Surveillance Infrastructure
To verify age, platforms must know something meaningful about who you are. That could be:
a passport
a driver’s licence
a facial scan
biometric age estimation
credit-based identity matching
Once collected, even briefly, this data can connect your identity to everything you do on a platform or even online. That opens the door to profiling, tracking, and de-anonymization. These risks don’t just affect kids, every adult becomes part of the same verification net.
2. Larger, More Valuable Targets for Hackers
Age-verification creates databases that contain:
verified identities
sensitive documents
biometric outputs
These are “honeypot” targets. When breached, the fallout is long-lasting and severe including identity theft, financial fraud, targeted scams, and reputational harm. Parents and caregivers already face breaches in schools, hospitals, and apps. Age-gating multiplies that exposure across the entire internet.
3. Teens Lose Access for the Wrong Reasons
Many of these laws rely on ID-based verification, which creates real barriers for teens. A large portion of young people don’t have government-issued ID, don’t own a device capable of running facial-verification tools, or don’t feel comfortable uploading sensitive documents. When the system can’t verify their age, they’re often blocked by default, even when they’re not trying to do anything unsafe.
This can cut them off from:
school platforms
homework tools
creativity apps
mental-health support
crisis lines
peer communities
The result is exclusion, not safety.
4. Adults Lose Anonymity They Depend On
Not every adult can safely reveal their identity online. Survivors of abuse, workers in sensitive fields, LGBTQ+ individuals, and activists rely on anonymity for protection. Identity linked verification endangers them and reduces their ability to participate safely.
Meanwhile, small platforms cannot afford expensive verification systems. This pushes them out of the market and centralizes power among a handful of large and very powerful tech companies, is this something that we really want to have happen.
So What’s the Balance Between Safety and Privacy?
There are safer ways to protect children without forcing families to submit passports or facial scans.
One example is SafeGen, an Australian company offering a parent-led, privacy-preserving model (7):
Parents register a child’s mobile number
No identity documents are submitted
Platforms receive only one piece of information: “under 16” or “not registered”
No biometric data is stored
No personal data is shared
It delays children from accessing adult content and social media without releasing sensitive information about a youth or teen into a commercial ecosystem.
We support solutions like SafeGen that keep verification on the device rather than sending data to a central system, rely on anonymous age-assurance methods that don’t collect identity, allow parents to guide consent for younger users, and confirm adulthood without requiring document uploads. Approaches like these give children the protection they need while preserving the privacy families deserve.
What Parents Should Do Right Now
If your child plays Roblox, take a few steps before age verification becomes a default requirement which is apparently happening the first week of December:
Review the verification settings in Roblox’s parent controls.
Talk with your child about why they should never upload ID or facial scans without you and your permission
Consider delaying verification if alternatives exist.
Stay updated on Roblox’s privacy commitments and Persona’s policies.
Discuss privacy trades-offs openly given that once you send biometric data, you cannot get it back.
We support youth safety, however, we also support youth privacy. Children need supported access to the online world, not blanket exclusion or mass data collection. Education, conversation, and evidence-based digital literacy remain the most effective tools for long-term safety.
A safer internet is possible. It doesn’t require families to hand over passports, driver’s licences, or children’s faces. It requires thoughtful policy that protects both safety and privacy at the same time.
As a parent, ask yourself one practical question:
“What personal information am I willing to trade for my child to access a game or app?”
Once you send that data, you lose control of how it might be used in the future. The choice is now up to you as the parent or caregiver.
NOTE - We are already reading how youth are using “Discord” voice chat which allows them to interact with friends who are playing with them in Roblox. It lets a player create a private voice channel for their session. However, Discord is also implementing facial recognition age-gating as well. Other option we have heard teens utilizing include:
FaceTime / Phone Call / Group Call - Simple, works on any device, and doesn’t require extra apps.
Zoom, Google Meet, or Messenger Rooms - Some friend groups open a quick video or voice call on another screen while they play.
Xbox or PlayStation Party Chat - If you’re all playing on consoles, built-in party chat works well and is often safer than open third-party tools.
Digital Food For Thought
The White Hatter
Facts Not Fear, Facts Not Emotions, Enlighten Not Frighten, Know Tech Not No Tech
References:
2/ https://siliconangle.com/2025/04/30/identity-verification-startup-persona-raises-200m-2b-valuation
