Roblox was pressed by two Southeast Asian regulators on the same day, but over different issues. On September 22, Indonesia pressed CEO David Baszucki for tighter controls for minors within the product, while the Philippines' privacy authority demanded explanations about local registration and data processing obligations. Together, the episodes expose a challenge that grows as the platform internationalizes: a global safety architecture can set the standard, but no longer eliminates the need to adapt product, data, and operations to each jurisdiction.
The issue is especially relevant for Roblox because its growth depends increasingly on international markets. In the second quarter of 2026, 82% of daily active users and 43% of revenue came from outside the United States and Canada. The company itself already acknowledges in regulatory documents that different laws on child protection, privacy, content, and digital safety raise costs and operational complexity.
The problem is no longer creating controls, but making them work under different rules
Roblox does not face this regulatory pressure without safety mechanisms. The company made age verification mandatory for chat access, created Roblox Kids and Roblox Select accounts for users under 16, and began restricting communication, the games catalog, and certain functions according to age group.
In Indonesia, however, the government wants these tools translated into the specific requirements of PP TUNAS, the regulatory framework for child protection in the digital environment. Minister Meutya Hafid asked the company for greater precision in age verification, stronger restrictions on children's interaction with strangers, measures to prevent conversations from migrating off the platform, and systems capable of identifying risky behaviors in advance.
PP TUNAS goes beyond requiring a generic safety policy. The Indonesian regime works with age ranges, risk classification of services, parental consent, and access restrictions, in addition to prohibiting certain forms of commercial profiling of children. The government also provides for administrative sanctions that can extend to suspending access to the platform in case of noncompliance.
This creates an important operational difference. A company can develop age estimation technology globally, for example, but needs to decide which features each age can access in each territory, when parental consent will be required, and how certain functions should be blocked or enabled.
Roblox's own documentation already acknowledges this path: when explaining Kids and Select, the company states that ages, default settings, games, and features may vary by region. Indonesia, Australia, the Netherlands, and New Zealand even received the new accounts before the global launch.
The Philippines shows that fragmentation does not end within the product
In the Philippines, the pressure came through another door.
The National Privacy Commission issued Show Cause Orders to Roblox, Meta, Reddit, and Discord for alleged noncompliance with registration requirements under data protection legislation. The order requires explanations from the companies and is part of a broader investigation into registration, transparency, lawful data processing, user rights, and security measures. It does not, by itself, represent a conclusion that Roblox violated children's privacy.
Philippine rules require certain organizations to register their data protection officers and processing systems. Systems involving profiling or automated decisions are among those subject to mandatory registration.
The contrast with Indonesia shows the scale of the problem. In one market, the discussion reaches directly into product design, age-based access, and user interaction. In the other, it also reaches data governance, system registration, and compliance structure.
Therefore, simply applying the same chat and age verification configuration worldwide does not solve the entire regulatory equation.
A global product is still possible; a single policy, increasingly less so
This does not mean that Roblox needs to build an independent platform for each country.
The most likely model is to maintain a global infrastructure and a set of global protections, but add a regulatory configuration layer capable of modifying age limits, communication, content, consent, data processing, reporting, and other controls according to jurisdiction.
In practice, however, this layer increases complexity. Each difference needs to be translated into product rules, tested, monitored, and updated when legislation changes. The same 14-year-old user may face different permissions depending on the country, while a creator may have their content available to a certain age group in one market and restricted in another.
Roblox itself acknowledges this risk before investors. The company cites higher legal and compliance costs in international operations and specifically highlights the need to comply with multiple laws, sometimes ambiguous or evolving, involving child protection, digital safety, privacy, and content, especially when applied to minors under 18.
There is yet another tension: making the platform safer by age requires knowing more precisely the age of those who enter it. Roblox uses facial estimation and identity verification for some processes and states that images and videos used in facial estimation are deleted after processing. Still, the more central verification becomes for determining access and communication, the greater the need to make this system compatible with local rules on personal data and minors.
Local pressure may end up redefining the global product
Fragmentation does not produce only costs. National requirements can also become global features when they solve a problem that exists in multiple markets.
After the meeting with the Indonesian government, Baszucki stated that some changes requested by the country could become part of Roblox's future evolution and later be applied in other regions with similar needs.
This will be one of the most relevant signals to watch.
Indonesia has asked for regular, measurable, and transparent reports on the implementation of PP TUNAS and is also pressing Roblox to expand its local presence, including with a senior representative or office in Jakarta. In the Philippines, the next step will be to observe the company's response to the NPC orders and whether the investigation results only in administrative regularization or in new requirements.
For Roblox, therefore, the question no longer seems to be whether there is enough technology to build a global child safety layer. The challenge becomes keeping this layer flexible enough to comply with national rules that are beginning to diverge in product, data, and responsibility.
The more international the platform becomes, the less likely it is that "global safety" means exactly the same experience in all countries.
