Roblox Age Verification Face Scan: Hijackers Keep Kid Access

Here is the strangest part of the roblox age verification face scan: the thing most parents fear Roblox is keeping is the one thing it says it throws away. What it keeps instead is a little label, like "13 to 15," and that label turns out to matter more than the photo ever did.

Roblox Age Verification Face Scan: What the Camera Actually Measures

Picture your kid at the kitchen table, phone propped against a cereal box, trying to chat with a friend in a game. Roblox says, essentially, "Prove how old you are first." So your kid points the front camera at their face and follows some instructions.

What happens next is not what most people imagine. The system is not trying to figure out who your child is. It is trying to guess how old they look.

Per the research behind this piece, Roblox looks at a face image and video, then sorts the user into one of six age groups: 5 to 8, 9 to 12, 13 to 15, 16 to 17, 18 to 20, and 21 and up. That is the whole output. A bucket, not a name.

Facial age estimation versus facial recognition: two different jobs

These two things sound alike and are not. Facial recognition (software that turns your face into a set of numbers so it can match you against other photos) answers "Who is this?" Facial age estimation (software that studies signs of aging, like skin texture and bone shape, to guess a number) answers "About how old is this?"

The first one can follow you around. The second one, at least in design, shrugs and says, "No idea who that is, but they look about fifteen."

How accurate is the Roblox age check?

Roblox claims its estimate lands within about two years. Sounds tight until you do the math on a real kid. For a 14-year-old, an estimate from 12 to 16 could place them in the 9-to-12, 13-to-15, or 16-to-17 group.

Accuracy also gets worse right where it matters most. Regulators and researchers have noted that age estimation struggles most with teens and young adults. That is the exact group these checks are built to sort. (Nobody said the hard part would be easy.)

That number comes from TechCrunch. Read it both ways. A huge number of people completed an age check in a month. And more than half of daily users still had not. For a comprehensive overview, explore our comprehensive face comparison technology resource.

What Does the Roblox Age Verification Face Scan Keep, and Where Does It Go?

Roblox says the scan is used only to estimate age. According to Roblox and its verification partner, Persona, the images and video are deleted once the age estimate is done, and Roblox itself does not receive or store biometric data (your face, voice, fingerprints: the body stuff that is uniquely you). What Roblox holds on to is the age group.

The path looks like this:

• Step 1, capture: Your child's phone records a short face video while following on-screen prompts.
• Step 2, hand-off: The video goes to Persona, an outside identity company, which runs the age guess.
• Step 3, verdict: An age group comes back to Roblox.
• Step 4, delete: The face video and images are supposed to be wiped.

One more detail, because it is easy to miss. The scan has a "liveness" check (a test that the camera is seeing a real person, not a photo held up to it). Your child is asked to move their face in certain directions. The system also watches for oddities, such as the same face being used over and over.

Roblox's technology looks for "other anomalies, like people trying to repeat use the same face over and over."

As quoted in reporting by CNN

Pause on that quote. To spot a repeated face, a system has to compare faces in some way. That is a reason to read the retention promises carefully rather than just nodding at them.

The retention detail that does not quite line up

Here is a gap worth knowing about. The main message from Roblox and Persona is "deleted immediately." But one write-up of current documentation, from Dor.gg, describes a 30-day biometric retention window at Persona. I can't settle that for you, and I would not pretend to. Roblox's own page, Understanding Age Checks on Roblox, is the place to read the current policy information in its own words.

That last row is the one to circle. We will come back to it.

The Common Mistakes Parents Make With a Roblox Age Check

Let's go through the mistakes honestly. Every one of them is reasonable. I would make most of them myself at 11pm after a long day.

Mistake 1: Believing the scan builds a face database

This is the big one. "Face scan" sounds like an airport camera or a police database, so people assume Roblox is quietly collecting a library of children's faces. That is a fair guess, because the phrase blurs two different technologies together.

What Roblox says it does is narrower: estimate, assign a bucket, delete the footage. A child's age group can be stored. A child's face template (the number-sheet version of a face, used for matching) is not supposed to exist on Roblox's side at all. Fear of a face template sitting in a games company's files is the right instinct. It just may point at the wrong target.

A fair caution: "may" is carrying real weight in that sentence. Companies describe their own systems, and outsiders usually can't audit them. So the sensible stance is not panic or blind trust. It is "read the policy, then act as if it might not be perfect."

Mistake 2: Treating a passed age check as a safety guarantee

Now the aha. Think about the sticky-note idea. A guard looks at you, decides you are an adult, shreds the photo, and writes "18+" on a note. Great for privacy. But the guard now has no photo to compare you against tomorrow. If someone else walks in holding your note, the age check itself does not flag it.

That is the real wrinkle in a roblox age check. As Anapol Weiss lays out, if someone gains access to a child's account that has already been verified as a minor, they inherit that status and can blend in with other kids. TechCrunch also points to a marketplace where accounts get sold. The check guards the gate. It does not guard the account.

Why does this matter beyond tech trivia? Lawsuits have been filed against Roblox alleging that children were groomed and exploited on the platform, and criminal cases have been brought against adults who met children there. Age groups exist to keep adults and kids apart in chat. A hijacked "kid" account quietly defeats that. Continue reading: Roblox Age Verification Face Scan Hijackers Keep Kid Status.

Mistake 3: Assuming a spoof is impossible

Liveness checks help, but they are not magic. The technical analysis from Regula Forensics discusses spoofing tricks like fake mustaches, masks, and photos. And remember that two-year margin. An estimate that is off by a couple of years can put someone in a different age group. So the bucket is a clue, not a fact.

Mistake 4: Skipping the parts of the account that actually protect it

Parents often focus on the scan because it feels dramatic, and then never look at the login itself. A face scan happens once. A password lives on every day. If the account's email, password, or recovery details are weak or shared with friends, the age bucket is only as safe as that login.

Is the Roblox Age Verification Face Scan Safe for Kids?

On the face-data side, it is designed to be lower risk than a recognition system. Roblox says the video is deleted and no biometric data is stored on its servers, so, by its account, there is no big pile of children's face templates there for hackers to steal. The leftover risk sits elsewhere: unverified retention details at the vendor, accuracy that wobbles for teens, and accounts that can change hands after the check.

What to check in the account tonight

I can't hand you menu-by-menu steps I have not verified, so here is the order I would go in, and where to look.

• Read the official page first. Open the Roblox Help article on age checks and confirm what it currently says about deleting face video.
• Check the account email. Make sure it is an address you control, because that is how recovery works.
• Use a unique password. One that is not reused anywhere else, and not shared with friends.
• Turn on any extra login protection the account offers. It is the lock that the age check does not provide.
• Look at who is in chat with your child. A sudden change in tone or new "friends" matters more than any bucket.

One more thing worth saying plainly. Facial recognition is a field where the details of how a face becomes numbers decide everything about privacy. That is the kind of thing we at CaraComp spend our time explaining, and the lesson carries over here: what a system stores tells you far more than what it scans.

The Punchline: The Safest Part Is Also the Gap

Go back to the opening. By design, the age check does not keep a face for comparison at the next login. That reduces face-data retention, but the check itself cannot ask, "Is this the same person as yesterday?"

So here is the question I'd leave you with, and it is the one to ask at 11pm: if someone else had access to your child's account tonight, what in the system would tell you? The age check would not. A unique password, extra login protection, and attention to the account can help protect what the scan does not.

Roblox Age Verification Face Scan: Frequently Asked Questions