Roblox Face Scans Start May 1 — But Is Losing Privacy the Right Tradeoff #roblox #cybersecurity

If your kid plays Roblox, the rules just changed — but the technical fix carries its own data-breach exposure. After settling state child-safety lawsuits totaling over $35 million, Roblox is rolling out mandatory age verification, a new account tier system, and unencrypted-by-design chat for minors. Starting May 1, every Roblox account (new and existing) has to pass facial age estimation via a vendor called Persona, or upload a government ID. In early June, accounts get sorted into tiers: Roblox Kids (ages 5-8, no chat), Roblox Select (ages 9-15, restricted chat), and Standard (16+). Under the settlements, every chat involving a minor must stay unencrypted so law enforcement can read it on warrant. Persona's published accuracy is a mean error of ~2 years for ages 11-20; NIST testing has flagged additional bias by gender and skin tone; and researchers have shown printed photos, beards, and makeup can defeat age estimators without strong liveness checks. Persona says it deletes biometric data after processing, but identity-verification firms have leaked before — AU10TIX (TikTok, X, Uber) had admin credentials exposed for over a year. And the unencrypted-chat requirement turns every kid conversation on Roblox into a clear-text log waiting for the next breach. Sources: https://www.malwarebytes.com/blog/news/2026/04/roblox-clamps-down-on-chats-and-age-checks-as-legal-pressure-builds https://about.roblox.com/newsroom/2026/04/introducing-roblox-kids-and-select-accounts https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8525.pdf More on cybersecurity, privacy, scams, and homelab on Hake Hardware. New shorts every weekday.