Today the eSafety Commissioner published Playing it safe: how online game services are (or are not) keeping kids safe online, covering Roblox, Fortnite, Minecraft and Steam over the period 1 October 2025 to 31 March 2026. A fresh round of transparency notices went out alongside it, asking the same companies about grooming, sexual exploitation, radicalisation, cyberbullying and hate, and how their design choices line up with Australia’s Basic Online Safety Expectations.
Most coverage will treat this as a child safety story about four game companies. It is also a story about a regulatory instrument that very few product teams have modelled, and the instrument is the part that generalises.
A transparency notice is not an investigation
An investigation starts with a suspicion and ends with a finding. A transparency notice starts with a questionnaire.
eSafety asks a service, under the Online Safety Act and the Basic Online Safety Expectations, to explain what its systems do. Failing to respond carries penalties of up to AUD 825,000 a day. Breaching a subsequent compliance direction runs to AUD 49.5 million. And the answers are published, in a report, with the other companies’ answers printed next to them.
So the sequence is: you describe your own systems, in writing, under compulsion, with your competitors’ descriptions alongside. Then the regulator keeps that description.
Everything that happens afterwards is measured against the thing you wrote. If you said you use age assurance on a surface and an auditor later finds self-declaration, the gap is not a technical shortfall. It is a divergence between your statement and your system, which is a different and much worse category of problem.
This is the same move as the Texas judgment against TikTok, approached from the other end. There, the claim itself was the violation: a court found that describing protections that did not behave as described breached consumer protection law. A transparency notice collects the claim first, under penalty, and files it.
What the report found
The specifics are worth reading even if you have never shipped a game.
Most of these services relied on self-declared age. In 2026, on platforms where roughly 9 in 10 Australian children aged 8 to 17 spend time. Roblox strengthened its age assurance in December 2025. Steam introduced credit card age checks during the review period, which is a choice we have written about before and do not recommend: a credit card is a payment instrument, not proof of age, and it fails adults without cards while passing minors with access to a parent’s.
Detection tooling varied widely. Valve was the only provider of the four not using hash matching for known harmful material. That is not a close call or a philosophical difference. Hash matching has been standard practice for a decade.
Information sharing was uneven. Mojang and Roblox participate in cross-industry programmes. Valve participates in none. Epic does not share signals through the Technology Coalition’s Lantern programme.
Read those three findings together and notice what they have in common. None of them is about whether a model is accurate. All of them are about whether a control exists and is switched on. That is what a transparency notice is good at finding, and it is why the instrument is spreading.
Why most teams cannot answer from their systems
Here is the failure mode, and it has nothing to do with bad faith.
A notice arrives. It asks what age assurance you apply, on which surfaces, to how many users, and what happens when it fails. Legal forwards it to product. Product answers from the specification, because the specification is the document that describes what the system does.
Within a quarter, the running system and the specification have diverged. A flag got flipped during an incident and never flipped back. A surface shipped in a new market with the check disabled because the vendor had no coverage there. An A/B test that reduced friction for 10% of signups quietly became the default. A fallback that was meant to fail closed fails open, because somebody chose that under pressure at 3am and the choice became permanent.
Every one of those is ordinary engineering. None of them is visible in the spec. All of them are visible in the config, and nobody asked the config.
The gap between the written answer and the running configuration is the finding. Not the control you lack. The control you described and do not have.
Answer from the system, not from the slide
The fix is to make the answer a query rather than an essay. Four artefacts cover most of what a notice of this kind asks for.
A per-surface inventory, generated from configuration. Every entry point into your service, with the age assurance method applied, read from the live config rather than typed by hand. Signup. Login. Age-gated features. Chat. Direct messages. Purchases. Third-party and OAuth entry. The web build and each native client separately, because they drift. If producing this list takes an engineer a week, you have learned something important about your answer before you send it.
A coverage rate, with a denominator you can defend. Not “we use age assurance” but “87.2% of monthly active accounts carry an age decision no older than 12 months, of which 41% were document verifications and 59% were estimation, measured on 30 September”. A percentage with a date and a denominator is an answer. An adjective is not.
Outcome distributions, not accuracy claims. Pass rate, failure rate, step-up rate, abandonment at each step, appeal volume and appeal reversal rate. The reversal rate matters most and is the one almost nobody collects. A high reversal rate means your threshold is wrong and you have been telling adults they are children; we went through why that failure mode is the expensive one at length.
A decision record sample you can hand over. A small set of real records showing outcome, method, threshold, confidence, policy version and timestamp. This is the difference between asserting that your system works and demonstrating that it records what it did. Regulators who have been through one of these cycles ask for it, and Ofcom’s enforcement has already turned on exactly this.
If those four exist and update themselves, a transparency notice is a week of work. If they do not, it is a quarter, and the answer you eventually send is a guess about your own product.
Games are the test case, not the category
Do not file this under gaming compliance and move on.
The Basic Online Safety Expectations are not a games regime. eSafety has used transparency notices against search, messaging and social services, and the power is written around the service, not the sector. The reason gaming drew this round is that children are there in overwhelming numbers and the controls were weakest, which is a description that fits several other categories right now.
If your service has any of the following, you are in the same shape as the four companies named today: user-to-user chat, voice, direct messages, user-generated content, a marketplace with strangers, or any communication feature that pulls you into scope you did not design for.
And this instrument is not Australian in spirit. Ofcom’s information requests do the same job under the Online Safety Act, with penalties already issued for failing to answer them properly. The DSA’s transparency and audit duties do a version of it for very large platforms. The common design is that regulators have stopped asking whether you have a policy and started asking what your systems actually do, in writing, on a deadline.
What to do before a notice arrives
- Produce the per-surface inventory from configuration this quarter, while nobody is waiting on it. Treat the time it takes as a measurement.
- Instrument the coverage rate as a dashboard metric, not a quarterly manual count. It will be wrong the first time. That is the point.
- Start recording appeal volume and reversal rate. If you cannot appeal an age decision at all, that is itself an answer you will have to give.
- Make the decision record exportable. One endpoint, filtered by date range, returning method, threshold, confidence, policy version and outcome.
- Diff the spec against the config once a quarter and keep the diff. The exercise of reconciling them is the control.
- Write the answer to “what happens when your verification provider is down” before you need it, and make sure the written answer matches what the code does.
- Decide who owns the response. A notice with a statutory deadline and a daily penalty is not a task you assign when it arrives.
The honest limits
This is Australian law, and the Basic Online Safety Expectations are a domestic instrument. If you have no Australian users, eSafety is not your regulator. The pattern is what travels, not the jurisdiction.
Transparency notices are discretionary. eSafety chooses who receives one and when, so there is no schedule to plan against and no way to know whether you are on a list.
The findings summarised above are from the published report covering 1 October 2025 to 31 March 2026. Several of the companies named have shipped changes since the review window closed, so the report describes a period rather than the present state of any of those services. Read the report itself before repeating a finding about a named company.
We should also be clear about what the report is not. It is not an accuracy study. It describes what controls exist, what tooling is used and what information is shared. It does not grade how well any of the age assurance in use actually performs, and nothing in it should be read as a vendor comparison.
None of this is legal advice.
How Xident fits
Coverage is a number we can give you. Every Xident decision carries outcome, method, threshold, confidence, policy version and timestamp, which means “what percentage of your active accounts carry a current age decision, by method” is a query against your own data rather than a research project.
Records instead of images. Document images are deleted within 24 hours of processing. What survives is the decision, which is the thing a notice actually asks about and the thing that does not turn into a breach disclosure later.
Policy versions are first class. When you change a threshold, the records written before and after say so. That is what lets you answer “what was running in March” without reconstructing it from deploy history.
A bulk check is affordable enough to close a coverage gap. Suppose the inventory finds 400,000 accounts with no current age decision. A document Verification on Growth is €0.20, which prices that remediation at €80,000 and makes it a project nobody approves. A Check, covering the browser age check and the returning-user path, is €0.02, which prices the same sweep at €8,000. Which number you are looking at decides whether the gap gets closed or gets explained. Do the remediation carefully, though: an age sweep has no undo button. Rates are on the pricing page.
The free sandbox grants 1,000 Checks and 100 document Verifications as one-time allowances rather than a monthly quota, which is enough to measure your real coverage rate on a sample before you report one.
The short version
A transparency notice takes your description of your own systems, under penalty, and publishes it next to your competitors’. Everything that happens afterwards is measured against what you wrote.
So the risk is not the control you are missing. It is the control you described accurately in the specification and have not been running since a flag got flipped in March.
Build the four artefacts now, while nobody is asking: a per-surface inventory generated from config, a coverage rate with a real denominator, outcome distributions including appeal reversals, and an exportable decision record. Then reconcile them against the spec and keep the diff.
eSafety asked four game companies what they do. The useful question is whether you could answer the same notice from your systems, or whether you would answer it from a document that stopped being true two releases ago.
Xident provides age and identity verification infrastructure with decision records kept in place of retained documents, policy versions recorded on every check, and a returning-user Check priced an order of magnitude below a document Verification so that closing a coverage gap stays affordable. The free sandbox includes a one-time allowance of 1,000 Checks and 100 document Verifications. Talk to us about being able to answer a regulator from your systems rather than your roadmap.
