Customer identity verification: Roblox will check every user

Starting in early January, every Roblox user who wants to chat will have to prove their age with a face scan or a government I.D. That includes kids. And the software that checks them will, by design, treat a twenty-four-year-old as a possible child.

If your kid plays Roblox, this one lands in your

If your kid plays Roblox, this one lands in your living room. Even if nobody in your house does, it's about a bigger change. Websites are starting to ask for your face and your papers before they let you talk to anyone. That can feel invasive. It can also feel overdue. Both reactions make sense.

Here's where things stand. Roblox says that starting in January, users will verify their age through a selfie, a short video, or an I.D. An outside vendor handles the check. Then each user gets sorted into one of six age brackets. Meanwhile, Malaysia's government says it's studying whether to go further. Officials are weighing electronic identity checks for online games. Communications Minister Fahmi has framed it around child safety, and around the risk of extremist groups using gaming platforms. It's a feasibility study. There's no deadline, no fine, and no rule yet. So the real question is this. When a game asks for your face, what exactly is it doing with it?

Start with how the face scan works. It isn't looking up who you are. It's guessing how old you look. That's age estimation, and it's different from facial recognition, which matches a face to a named person in a database. One says, "this person looks about fifteen." The other says, "this is Jordan Smith."

The guessing has gotten better. According to benchmark data reported by PPC Land, the average error was about four years in twenty fourteen. By twenty twenty-four, it had shrunk to about three. Three years is still a lot. Imagine a system that can't tell a fifteen-year-old from an eighteen-year-old. Your kid's face could pass for an adult's. Or your own face could get flagged as a kid's.

Companies build in a cushion

So companies build in a cushion. They set what's called a challenge age, well above the legal line. If the cutoff is eighteen, the standard challenge age is twenty-five. Look younger than twenty-five, and the system asks for more proof. For a twenty-three-year-old, that's an annoying extra step. For someone without a government I.D., it can mean being locked out entirely.

That lockout is exactly why regulators like the stronger option. It's called eKYC, short for electronic Know Your Customer. You photograph a government document, then take a selfie. The system checks that the face matches the document. Now it's not a guess. It's a documented fact about who you are. And that fact can get stored. A persistent record connects a real identity to a face. For a parent, that might be reassuring. For anyone else, it's a record that now exists somewhere.

Investigators see something else in this. Say an account claims to belong to a sixteen-year-old, but the verified document says twenty-four. That mismatch is a documented lie, and it's something a fraud or child-safety investigator can flag and follow. It's a clean, comparable piece of evidence. Compare the selfie to the document, and you've got a lead. For the rest of us, it means the line between "just playing a game" and "having an identity on file" is getting thin.

But the system has weak spots. Critics point out that face estimates are probabilities, not certainties. Kids pass as adults. Adults get stopped. And fakes are a problem. Deepfakes and edited images can fool a scan. The strength of any of this depends on two extra checks. One is liveness detection, which confirms a real person is in front of the camera. The other is document authentication, which confirms the I.D. isn't forged. Those checks aren't the same from one platform to the next, or one country to the next. So a child with a borrowed I.D. and a good fake could still get through. Meanwhile an honest kid gets blocked.