Roblox is as safe as its settings, and the default settings are not the safe ones for a young child.
Out of the box, a child's account can join experiences built by strangers, chat with other players, receive friend requests from anyone, and see items for sale in almost every game. Each of those can be limited. Almost none of them are limited unless a parent does it.
So the honest answer to "is Roblox safe" is a second question: has anyone configured it? If the answer is no, treat it as an open platform with a large adult population, because that is what it is.
What Roblox actually is
Roblox is not one game. It is a platform hosting millions of experiences made by outside developers, some of them children, some of them studios. That is why the age label on the app store tells you very little. The platform is rated for a broad audience; the individual experience your child opened may not be.
Roblox labels each experience with an age rating, All Ages, 9+, 13+ or 17+, and a parent can cap which ratings an account may open. The 17+ tier requires age verification. The definitions are in Roblox's help center, and they are worth ten minutes of reading because they decide what "allowed" means for your child.
Common Sense Media's guide to Roblox makes two points worth carrying into every section below: the ratings are a starting point rather than a guarantee, because user-generated content slips through, and the chat filters can be worked around, sometimes in ways that push a conversation onto another app where nobody is watching.
Who can talk to your child?
Communication is the setting to fix first, before content and before spending.
By default a child's account can send and receive text chat inside experiences and, depending on age settings, in direct messages. Roblox filters chat for younger accounts, and the filter is real, but filters catch words, not intentions. A conversation that starts with "what school do you go to" passes any word filter.
Three things a parent can set:
- Turn in-experience chat off entirely, or restrict it to friends.
- Turn direct messages off, or restrict them to friends.
- Set who can send friend requests. "Everyone" is the default. "No one" is the setting that matters for a child under ten.
Voice chat is a separate feature that requires age verification, so a correctly registered child account should not have it. If your child has voice chat, the account's age is wrong, and that is worth fixing before anything else because the age drives every other default.
The UNICEF working paper on child safety in online gaming describes how grooming attempts in games routinely try to move the conversation to a second app. Closing chat on Roblox does not close every door, but it closes the first one, and it removes the mechanism by which a stranger can suggest the second app in the first place.
What is your child actually opening?
Once chat is handled, limit which experiences the account can join.
Set the rating cap at the level you would accept for a film. For a seven or eight year old that is All Ages; for the older end of this range, 9+. Then open a few of the experiences your child actually plays and look at them yourself, because the labels are set by developers and reviewed by Roblox, not written by you.
Two things to look for:
- Experiences that are mostly social spaces. A "hangout" with no goal is a chat room with avatars, whatever its rating.
- Experiences that push the child toward a paid item within the first minute. These exist at every rating.
You can also make the account's list of allowed experiences explicit rather than trusting the cap alone. It is more work, and it is the right choice for a seven year old.
How does a child spend money without you noticing?
Robux, the platform currency, is where most family disputes start.
A child with a payment method attached to the account, or with a gift card balance, can spend inside almost any experience. Prices are shown in Robux, so a child does not see a dollar figure at the moment of purchase. That is not unique to Roblox, but the volume of paid items on the platform makes it matter more here.
Set a monthly spend limit in the parent controls, and set it to zero if you want a purchase to require a conversation. Remove any stored payment method from the child's account. If the child gets Robux as a gift, treat the card the way you would treat cash.
The FTC's guidance on children's privacy explains what platforms must do about data for children under 13. Spending is not covered by that law, which is why the spending settings are yours to make.
How long, and when?
Roblox lets a parent set a daily time limit and see how the time was spent, and the limit is enforced by the account rather than by the device, so it holds across a tablet and a laptop.
The limit works better as a stopping rule than as a budget. A child who knows the session ends at forty minutes plays differently from one who has to be told to stop. If your child struggles to leave a game, the independent play article covers how to make endings predictable instead of negotiated.
What the settings cannot do
Be clear with yourself about the limits of configuration.
Settings cannot tell you whether a game is worth playing. They cannot stop another child from being cruel in an experience with chat turned on. They cannot verify that the "friend" from school who sent a request is that child, because friend requests carry a username, not an identity. And they reset to the platform's defaults the moment a child creates a second account on a browser, which many children do the first time a setting gets in the way.
The American Academy of Pediatrics frames media guidance around what the child is doing and what it displaces rather than around one setting or one time limit. That framing fits Roblox well. The platform is a place, and the settings are the locks on the doors. Whether the place is good for your child is still a judgment.
A configured account, in one list
Before a child under 12 plays without you in the room:
- The account's birthdate is correct, and a parent account is linked to it.
- In-experience chat and direct messages are off, or restricted to friends.
- Friend requests are set to no one, or to friends of friends at most.
- The rating cap is at All Ages or 9+, and you have opened the top three experiences yourself.
- No payment method is stored, and the monthly Robux limit is set.
- A daily time limit exists and the child knows what it is.
- You know the password, and the child knows you can see the account's activity.
This is the kind of default we are building toward at Motions: the child gets the games and the friends, and the parent approves the people, the sharing and the spending before any of it is on by default. If that is the shape you want, you can request access for your family.
For how the same six controls look on other platforms, see how to set up parental controls on the devices kids actually use. For what a good control system should do in principle, see what good parental controls should actually do.