A new lawsuit filed by the Texas Attorney General against Roblox has brought privacy, safety, and data handling into the spotlight for online platforms, especially those used by kids and teens. The allegations followed concerns raised by advocacy groups in 2024 and suggest that Texas will continue to be active in the privacy space.
According to the Texas complaint, the Roblox website does not have a functioning age gate for account creation. Currently, the site allows an account registration for children under 13 collecting only a username and password. The prompt on creation of the account is to “not use your real name.” Instead, while birth date is asked, the company does not obtain verifiable parental consent for those who enter an age under 13. This, the AG argued, was a violation of the federal Children’s Online Privacy Protection Act.
Other concerns from the AG included the fact that self-reported children could interact with adults. They could also make purchases on its platform. The complaint also alleged deceptive practices insofar as Roblox made statements about how it was taking “every precaution possible” to protect children and had “industry-leading” safety. According to the Texas AG, Roblox is not living up to these promises. Roblox has stated that it takes steps to prevent the sharing of personal information by children and otherwise protect them on its platform.
Putting it into Practice: This case is a reminder that states can bring action under many federal privacy laws, like COPPA. While there may be less activity at a federal level, we expect to see ongoing enforcement by state regulators, which may result in different interpretations of these laws. And when these cases are brought, there is a potential that the state-level regulator may look very closely at security claims, relying on theories of unfair and deceptive trade practices.
