Roblox Is Fighting to Keep Pedophiles Away and Not Always Winning (2024)

Businessweek | The Big Take

The internet’s biggest recreation zone for kids is fighting to keep predators away, and it’s not always winning.

By Olivia Carville and Cecilia D’Anastasio
Illustrations by Elliot Gray

July 22, 2024,

Updated on July 23, 2024

DoctorRofatnik, known to fans as “Doc,” looked almost mayoral in a tall white hat, a red tie and an American flag pin. A smirk was permanently plastered on his face as he roamed his domain on Roblox, the multibillion-dollar gaming platform geared toward children. His name referred to the villain of Sega’s Sonic the Hedgehog, but to thousands of players during the first summer of Covid-19, he was a hero.

Doc was the architect of the game Sonic Eclipse Online. Anyone can make a game inside Roblox’s digital sandbox, and his bootleg version of Sega’s hit franchise was a runaway success. It offered gamers a place where they could sprint across virtual half-pipes as the eponymous blue hedgehog alongside their friends, for free.

By September 2020 some 36 million people, more than half of them under 13, were on Roblox daily, making it the world’s biggest recreation zone for kids. Sonic Eclipse was a bustling cul-de-sac where children could buy virtual Robux currency with their weekly allowance, then use it to get costumes and morph into cooler characters. Doc claimed to be one of the highest-paid developers on Roblox, boasting about it to his community on the chat app Discord. There, thousands of fans who’d filtered over from Sonic Eclipse got to know him as Jadon Shedletsky, 28, “a Game Developer, Industry Visionary, and a bit braggadocious,” as he wrote in his bio. He was the California-based younger brother of Roblox legend John Shedletsky, the platform’s longtime creative director, or so he said. No one knew what Doc really looked like, but he told anyone who asked that he was buff, with blond hair and teal blue eyes. He said he drove around in flashy cars with a “hot Spanish girlfriend.”

Doc’s dark, edgy humor only made him more compelling to many kids. When he posted a joke about rape, one fan replied, “10/10.” When he called young girls who helped him develop Sonic Eclipse “sex slaves,” it became a running gag. He quipped about being “the old man with kids in his basem*nt.” Fans sparred with one another to get on his good side—and on his payroll.

Some were also quick to defend his honor in September 2020, when a Sonic Eclipse player posted screenshots on Twitter of a private chat Doc had had with a preteen:

The person who posted the screenshots was one of a group of gamers who’d grown tired of the hom*ophobic, racist and predatory tirades Doc shared on Discord and had started digging into the person behind them. When Roblox Corp. learned of the messages, it shut down Doc’s account. But by then he’d transferred ownership of Sonic Eclipse to another gamer, a friend who kept it running in his stead. Doc claimed the controversy tripled his earnings. The bragging, and the efforts to expose him, continued until the spring of 2022. That’s when Doc disappeared from the internet.

Gamers speculated that he’d killed himself. Then, a few months later, a player sent an alert on Discord: “Doc finally got arrested.”

Posted below was an article from a New Jersey news site, with the headline: “FBI: Groomed-For-Sex Indiana Girl, 15, Rescued After Paterson Man Pays Uber To Bring Her To NJ.”

Roblox was launched in the early 2000s under the premise that games were the next frontier for education software. Kids could design multiplayer online enclaves using a set of building blocks and a simple coding language. Unlike other companies’ complex, graphics-intensive games, Roblox’s were the kind of thing kids might imagine during recess, like Experience Gravity or Work at a Pizza Place. The platform’s weird, whimsical ethos attracted thousands, then millions of kids, who moved through its worlds as Lego-like avatars with frozen smiles and beady eyes, spending Robux to spruce themselves up with virtual wigs, clothes, dragon tails or wings. Eager to access young eyeballs, big brands crafted their own games, such as Gucci Town and Nikeland. Developers received a 30% cut of any sales, and Roblox took the rest. Bookings last year, mostly from Robux, reached $3.5 billion.

With 78 million daily active users today, Roblox has become social media for the youngest generation. Every second, according to Roblox, it processes more than 50,000 chat messages—Hey loser, cute outfit, let’s be friends—through its moderation protocols, a combination of artificial intelligence technology and human workers that the company says scans all user content, including audio and text. Roblox has about 3,000 moderators, significantly fewer than TikTok, which has three times the number of daily users but employs 40,000 moderators. (Roblox says the number of moderators isn’t an indicator of quality.)

Unlike other mass-market social media apps, which bar kids under 13 or shunt them into sanitized versions, Roblox was made for children. More than 40% of its users are preteens, and with that market come special hazards.

Since 2018, police in the US have arrested at least two dozen people accused of abducting or abusing victims they’d met or groomed using Roblox, according to data compiled by Bloomberg Businessweek. Some were already on sex offender registries or had been accused of abusing minors; there were also a sheriff’s deputy, a third-grade teacher and a nurse. In just the past 13 months there have been seven arrests, including those of a man in Florida accused of trying to kidnap a teen he played with on Roblox; a man charged with abducting an 11-year-old New Jersey girl he met on the platform; and a California man who allegedly abused a kid he, too, had met on Roblox. These predators weren’t just lurking outside the world’s biggest virtual playground. They were hanging from the jungle gym, using Robux to lure kids into sending photographs or developing relationships with them that moved to other online platforms and, eventually, offline.

Roblox’s chief safety officer, Matt Kaufman, calls safety and civility “foundational” to the company. He notes that the platform’s moderation systems scan all chat and other digital content, bleeping out inappropriate words and blocking players from sending images. Those systems, which can intervene in under a minute, are even more restrictive for kids under 13, Kaufman says.

He rejects the idea that Roblox has a systemic problem with child endangerment and describes the issue as industrywide. “Tens of millions of people of all ages have a safe and positive experience on Roblox every single day,” he says. He declined to comment on specific criminal cases.

Yet a number of people who’ve worked for Kaufman say Roblox is on its back foot in its battle against predators. In interviews with more than 20 current and former employees—including moderators, engineers and safety managers, all of whom requested anonymity because of confidentiality agreements or fear of retribution from the company—Businessweek repeatedly heard that while child safety might be the company’s watchword, policing the platform and its 13 million games is a Sisyphean task. One moderator says her team receives hundreds of escalated reports involving child safety every day, far too many for her team to clear.

Policing will only get harder as the company strives to reach co-founder and Chief Executive Officer David Baszucki’s goal of 1 billion daily users, more than 10 times the number today. Eight current and former trust and safety workers say user growth at Roblox takes priority over child safety. They describe calls for more resources going unanswered, resulting in a backlog of incident reports and the departure of one manager who left after promises for extra staff went unfulfilled. Others say that features they recommended to better protect kids, such as pop-up safety notices, were rejected and that safety settings, for example to ensure users aren’t talking to strangers, were switched off by default. And while the company says it’s increasingly relying on AI for moderation and those systems are improving all the time, some employees say the technology isn’t yet able to detect subtle signs of grooming.

A Roblox spokesperson disputes the claims about resources and backlogs. The spokesperson says that safety team members are constantly sharing ideas about new tools, that the company factors in “various considerations” when deciding how to build them and that it has a “robust pipeline” of safety features in development. “Implying that a lack of immediate integration of specific ideas, tools or features is a reflection of not caring or lack of prioritization is simply wrong,” the spokesperson says. “The long-term growth and longevity of Roblox depends on our ability to provide a safe and civil experience for our users.”

Most of the safety workers interviewed by Businessweek say it’s harder to pursue pedophiles at Roblox than at other online platforms, because every user is an anonymous collection of pixels. That’s the thing about catering to children: You can’t ask for real names, email addresses or phone numbers at sign-up. This protects the privacy of children—but also of predators.

Before Doc was wanted by the FBI, he was being hunted by a posse of vigilante gamers. They’d grown up playing Roblox, venting with one another about its poor moderation. They ridiculed it for having overly strict chat filters, which they said sometimes censored innocuous words yet didn’t catch acronyms such as “erp” (for “erotic role play”), and for failing to detect avatars with absurdly large genitalia or simulating sex in digital toilet stalls. By 2020 many had lost faith that Roblox could prevent predatory behavior, so they began policing it themselves.

The leader of this pack was Ben Simon, now 27, who broadcasts about Roblox on YouTube under the pseudonym Ruben Sim from a bungalow in suburban Tucson. “Roblox spends so much time, effort and money convincing parents that their platform is safer than it actually is,” he says, sitting in a gaming room smelling of marijuana and plastered with WikiLeaks and rock music posters.

Simon is a controversial figure. He has mocked Roblox employees for their physical appearance and sexual preferences and has hurled insults at Baszucki, who blocked him on X. Roblox permanently banned Simon when he was 17. Since then he’s started new accounts, expanding his YouTube subscriber base to 1.2 million even as Roblox has shut him down on its platform at least 100 times. His first videos were cringey satires of its games. Now they have titles such as “Uncovering Roblox’s Nastiest Community” and “Roblox’s Worst Moderation Problem,” and he makes money from the ads.

Some Roblox employees say they respect Simon’s efforts; others write him off as a “drama channel”—a bad-faith actor who cares more about clicks than kids. But he says users desperate for accountability have sent him thousands of complaints, figuring they’ll have better luck getting a creepy account shut down if he posts about it than if they file a report with Roblox.

In September 2020, Simon started receiving messages from the gamers who were seeking to bring Doc down. The screenshots they sent were of conversations Doc had had with young girls who worked for him, including ones detailing fantasies about kidnapping and raping a 12-year-old. After Simon reposted the messages on Twitter, vigilantes flooded Doc’s accounts, calling him a pedophile. Doc responded with a YouTube video defending himself. In his usual style—off-screen, with his voice electronically altered—he admitted the messages were real but said they were just jokes.

Simon packaged the allegations and admission into a seven-minute video and sent it to an employee on Roblox’s developer relations team. He asked the company to shutter the DoctorRofatnik account and Sonic Eclipse itself. A number of other users say they also alerted Roblox about Doc’s account, and so did the mother of the preteen he’d sent the messages to.

Katie Berner, who’s now 18, says her mother sought advice from Simon before sending a report “explaining how creepy and dangerous it all was.” Berner had started playing Roblox when she was 6 and was working for Doc by the time she was 13. At first, she liked that he gave her so much attention. But as she got older, Berner says, she realized “just how gross it was for an adult to be talking to me like this.”

Four days after being notified by Simon, Roblox closed Doc’s account and reported it to the National Center for Missing & Exploited Children. In the meantime, Doc had transferred ownership of the game to his friend and created a new account. One gamer recalls him quoting Eminem after his return: “Guess who’s back, back again. Shady’s back, tell a friend.” Doc shared a screenshot on Twitter that October, after his ban, showing a $15,097.35 payment from Roblox and scoffed at Simon: “Thanks for driving more money to my game, man! Jeez, you guys are really f---ing stupid by giving me all this publicity.” (Roblox says it continued to search for and ban any alternate accounts but left Sonic Eclipse running because the game itself didn’t pose any safety concerns. It also says that DoctorRofatnik cashed out a total of $41,000 in developer fees in the first eight months of 2020 but that it has no record of a payment to anyone for $15,097.35 that year.)

Simon sent a message to Roblox railing against what he viewed as its weak response. “Roblox’s bottom line depends on parents trusting the company with their kids’ safety and that’s not going to happen if this is the response to child predators,” he wrote. He says he didn’t get a reply. He tried reporting Doc to the Tucson police, but all he could offer was an online alias.

Roblox finally responded to Simon, in a manner of speaking, in late 2021—by filing a $1.6 million lawsuit against him. It alleged he was the leader of a “cult-like cybermob” harming the company’s reputation. It also said he’d operated accounts with names such as “co*ckassassin,” tried to upload pictures of Adolf Hitler and used hom*ophobic slurs inside Roblox games. (Simon says that his “co*ckassassin” account was created as a joke when he was 15, that he never tried to upload pictures of Hitler and that he probably used a few slurs while playing Roblox as a kid.)

With Simon sidelined, others took up his campaign. “If Roblox wasn’t going to do anything, I had to find a way,” says Naru, a 22-year-old Japanese gamer who didn’t want her real name shared publicly for fear of being doxed. She settled on a different approach, writing to the vice president for product development at Sega Sammy Holdings Inc., which owns the trademarks related to Sonic the Hedgehog, and tweeting at its press relations team. Their iconic hedgehog, she said, was being misappropriated by a pedophile on Roblox.

Sega subsequently filed a copyright infringement notice with Roblox, and at the end of 2021 the game was shut down. Sega didn’t respond to requests for comment, but Roblox’s takedown notice was shared by gamers online. The irony that Sonic Eclipse had been brought down by the intellectual-property rights of a rival corporation, rather than child safety concerns, wasn’t lost on the gamers.

Simon settled his lawsuit with Roblox about a month after the game went dark. Court documents show he agreed to pay Roblox $150,000 without admitting wrongdoing, though he won’t comment on the terms or whether he paid the company anything, citing a confidentiality agreement. Roblox also declined to comment about the case beyond saying Simon isn’t a “credible source of information about our strong safety record.”

The same week Simon settled the suit, he got a tip from a fan. Five young sleuths from the US, the UK and Australia had discovered one of Doc’s old Facebook pages. It contained a link to a dormant website, and when they’d looked up whom it was registered to, they’d found a name: Arnold Castillo of Paterson, New Jersey.

Simon called Tucson police with the new information, but the report went nowhere. A spokesperson for the force says that there wasn’t enough evidence to launch a criminal investigation and that it was outside their jurisdiction. Simon says he hadn’t known who else to call.

“Who’s playing Roblox?” asks Kirra Pendergast, standing in front of 75 students sitting cross-legged on an auditorium floor at an elementary school in Lennox Head, Australia. About 60 hands shoot up.

“Who’s ever been asked to be someone’s boyfriend or girlfriend on Roblox?” This time a dozen hands go up, and there’s lots of whispering.

“Who’s been offered free Robux to do something inappropriate in the game?” Two hands rise slowly.

The session, captured in a video in May, is like many others conducted by Pendergast, founder and CEO of Safe on Social Media Pty Ltd., an organization with offices in four countries that advises schools and businesses about online safety.

“I started asking more specific things, like ‘Who’s been offered free Robux to strip their avatar down to their undies?’ and heaps of kids put their hands up, giggling,” Pendergast says in an interview. Hundreds of kids have told her since the pandemic that they’ve been asked to shift messaging from Roblox to Snapchat or Discord, or have been dared to do what she calls “wildly inappropriate things,” such as sending naked photos in exchange for Robux.

“Parents are letting children play on Roblox thinking it’s a cute little kids’ game, with no idea what is really happening,” Pendergast says. “If I could wipe one app off the face of the Earth right now, it would be that one—it would be Roblox.”

Roblox’s open chat function is a contentious subject among child safety experts. Other kid-focused online games, such as Nintendo’s Splatoon 3, offer only preprogrammed dialogue options for talking with strangers. On Roblox an 8-year-old can, by default, post whatever they want in a game chat seen by every other player unless AI censors intervene. It’s left to parents to activate child safety features such as restricting what categories of people their kids can talk to, or which games they can play. If parents don’t, children can introduce themselves to any stranger in a game, chat for hours and accept requests to converse in private messages.

“If a predator wants to target younger kids and talk with them to build trust and start the grooming process, Roblox is an easy way to do that,” says Ron Kerbs, CEO and founder of online child safety company Kidas. “Instead of going to the playground where everyone’s a kid, you go to Roblox.”

Roblox is available for free on a wide range of devices, from iPhones to PlayStations to PCs. It takes less than a minute to create an account, enter a date of birth and join an all-ages-rated game. A Businessweek reporter signed up recently, identifying herself as 4 years old, and rezzed into the popular game Brookhaven RP. Her avatar appeared in a playground in a sterile, white city. The first message in a public chat with 21 other players was a user saying, “I’m 8.” The reporter replied, “I’m 4.”

“#####,” said a user, their message bleeped out. “leVe the game and lets chat,” said another. Within seconds, a friend request arrived and a private chat began.

“U single” the stranger asked. The reporter reiterated that she was 4.

“Do u have 👻 chat,” the stranger asked, referring to Snapchat, which has a ghost logo. “Age is just a number 😉,” they added.

(A Roblox spokesperson said the scenario is “simply not realistic” because it doesn’t take parental oversight into account or the inability of 4-year-olds to communicate on their own with text chat. “A scenario like this would be extremely uncommon,” the spokesperson said.)

On darknet forums, adults looking to groom children for abuse trade tips for developing relationships in Roblox chats—tactics such as misspelling certain words (“leVe” instead of “leave”) or using emoji to refer to apps where conversations can be unfiltered and photos and videos can be sent (the ghost for Snapchat, a disc for Discord). One forum user described successfully connecting with kids there: “I simply played the game or was active in the chat section and then hit it off.” Others offer Robux in exchange for pictures. “Sometimes it worked like a charm,” wrote another poster on the same forum.

References to Robux or Roblox gift cards—$25 for 2,000 Robux, $100 for 10,000—appear in several police reports obtained by Businessweek. In one case, Clinton McElroy, a 48-year-old registered sex offender in Ellis, Kansas, met an 8-year-old girl on Roblox in 2020. He traded thousands of Robux for more than 20 explicit images and videos she’d shot of herself using her iPad. In one exchange, he wrote, “I can tell your not really into this.” She responded, “Anything for Robux.”

Roblox says the company has no tolerance for predatory behavior on the platform. But the word “grooming” didn’t appear in its 2022 moderation guide, a copy of which was seen by Businessweek. And the company didn’t have automated systems in place to proactively search for grooming behavior beyond basic text filters until that year, according to current and former employees. Several of them also say senior leaders at Roblox haven’t looked at how its virtual currency is being used by predators, even though employees have raised the issue with managers.

A Roblox spokesperson says the company had automated systems in place to help identify grooming prior to 2022, and that it is building out its capability and looking to hire a financial harms intelligence analyst. The spokesperson adds that consumer privacy laws prevent retailers from sharing information on customers who buy gift cards, making them hard to track.

Predators who do this have evaded detection. Shane Patrick Penczak, a 45-year-old from North Port, Florida, was charged with sexual crimes against children in January 2022. He told police that a 13-year-old boy he’d met on Roblox had shared his password so Penczak could “put gift cards on to his Roblox account,” according to a transcript of his taped confession. In exchange he’d received hundreds of photos and videos of the boy showering and performing sexual acts. Penczak, who was sentenced to 13 years, said he’d regularly signed in to the boy’s account to read his private messages and pay him—thousands of dollars’ worth of Robux over three years.

In May 2022, four months after Penczak was arrested, a missing-person report was filed in Indiana. A 15-year-old girl had disappeared. Her favorite electronics, plus charger cables, clothing and a blanket, were gone from her bedroom. Her phone was off, and the last thing she’d posted on Instagram was a photo taken from the back seat of a car, captioned “Goodbye, Indiana.”

Stacy Hinshaw, a detective who specializes in sex crimes, quickly realized this wasn’t a typical teen runaway. The girl didn’t have the financial means to travel, yet she’d clearly left the state. Someone had taken her.

Hinshaw got approval from a judge to access the teen’s phone records. The last tower her cell had pinged was in Pittsburgh, 350 miles away. She asked the girl’s family if she’d been talking to anyone online recently. Yes, her sister said—a man named Jacob Shedletsky, who was supposedly a popular game developer on Roblox. Suspect No. 1, Hinshaw thought.

The girl had met Shedletsky on Roblox that January, the sister said. She was an artist, and he’d bought one of the drawings she’d posted on Instagram. After calling her mother to ask for permission, Shedletsky paid $45 through Cash App. Then, Amazon packages started showing up on the family’s doorstep addressed to the teen, containing a teddy bear, a tablet drawing stand and a drawing glove. Occasionally orders from McDonald’s or a Chinese restaurant would arrive via DoorDash.

“By the end of that interview, I thought she was with that man,” Hinshaw recalls. “We just had to find him.”

She traced the gifts to the Amazon account of a second man, Nelson Betancur, with a Paterson address, giving her another potential suspect. Then she called the phone number the teen’s mom had for Shedletsky. The man who answered confirmed the name and said he lived in California. He said that he knew the girl and had sent her gifts but that he didn’t know anything about her whereabouts. Hinshaw recalls that he took a suspiciously long time to provide basic information such as his address and date of birth. When she asked the man why he’d sent the Amazon gifts from a different account, he said Betancur was a business associate.

A few days later, Meta Platforms Inc. returned the results of a court-ordered search warrant for the girl’s Instagram messaging history, and a third name popped up: DoctorRofatnik. She’d sent him hundreds of messages. He said he was in love with her and told her “sex is a beautiful thing.” When she said she thought she might be too young for intimacy, he replied, “You’re not.” On April 25 he wrote: “I want to see you really badly, the only way this is going to work is if you listen to me.”

With enough evidence in hand, Hinshaw called the Federal Bureau of Investigation and was put in touch with Len Rothermich, a special agent on the child abduction rapid response team in Indiana. Rothermich soon discovered that the girl had logged in to her Instagram account from a new IP address. He called the service provider’s emergency office, saying a teen’s life was at risk and he needed the account holder’s location. When he got it, he saw that the girl had logged in from the same address used to send the Amazon packages.

In the early evening of May 11, eight days after the girl had left Indiana, six unmarked cars carrying uniformed officers and FBI agents pulled onto a quiet residential street in Paterson. Within minutes they saw her rounding a corner, walking with a man. Officers descended on the pair, separating them. The girl was taken to a hospital; the man was put in handcuffs and searched. He was carrying three unused condoms. They asked him for his name. “Arnold Castillo,” he replied.

Castillo—22, pale and dumpy, with a thinning brown tangle of hair—was taken to an FBI office, where he agreed to an interview without a lawyer. He admitted he’d adopted the aliases Jacob Shedletsky, Jadon Shedletsky and DoctorRofatnik to hide his identity. Castillo said that he’d used the Amazon account of an uncle in Florida to send gifts to the girl and that he’d cut a side deal with an Uber driver, paying $1,000 to bring her from Indiana to New Jersey.

He was a successful game developer on Roblox, Castillo told the FBI. He had two dozen kids working for him, helping design characters and manage Robux payments for a game he’d created. He described the girl as a promising artist, unhappy living at home, and said he’d wanted to help her. Castillo admitted they’d had sex multiple times over the eight days she’d been missing.

Rothermich listened to the interview from Indiana. “I was trying to figure out how all this happened,” he recalls. “How this girl was willing to leave her home and go with this guy she doesn’t know, what was enticing about him.” He started searching Castillo’s alter egos online and was surprised to find not only that he was as popular as he’d said, but also that a year and a half earlier some teen gamers had sounded an alarm about him. “Seeing what those children did, as far as compiling all this and their ability to identify Mr. Castillo,” he says, “well, they might want to submit some applications to the FBI one day.”

A few weeks after the arrest, Rothermich found screenshots from Roblox games on Castillo’s phone, showing Castillo flirting with the teen. He’d been using the handle LastOutlawz, and their avatars were holding hands or embracing in matching T-shirts that read “Boyfriend” and “Girlfriend.” Rothermich got a search warrant compelling Roblox to turn over chat logs, IP addresses and login details for LastOutlawz. In the four months leading up to the arrest, Rothermich learned, Castillo and the girl had exchanged messages on Roblox about her intention to run away from home.

When executives at Roblox’s headquarters in San Mateo, California, heard what had happened, they formed a team to analyze what had gone wrong. The company says that it didn’t know who Castillo was before he was arrested, that it didn’t make payments to anyone with that name and that it has no records of accounts linked to him.

But executives knew they had to do something to better protect users. They rolled out a policy permitting Roblox to boot users who harass people on other platforms or offline. They also gave moderators better tools to identify new accounts started by banned users. Within a year the company had created some new roles, too, appointing two child safety investigators, a child exploitation moderation team and a chief safety officer reporting directly to the CEO.

With a stronger net in place and the pandemic pulling in millions of new users, Roblox began to catch more incidents. In 2023 it reported 13,316 instances of child exploitation to the National Center for Missing & Exploited Children, less than 0.04% of all reports to the center, compared with 2,973 the previous year. The company says it responded last year to more than 1,300 requests for information from law enforcement, including subpoenas and search warrants, a jump of almost one-third from 2022. It didn’t say how many of those involved alleged predators.

Current and former Roblox employees say the company wants to get safety right. Beyond the moral reasons, there are business repercussions when it doesn’t: After a short seller published a blog post last year that aggregated arrests linked to Roblox, the company’s share price fell 8%. (Roblox says other factors may have caused the drop.) But there’s only so much moderators can do. Because Roblox users are mostly children, the company can’t ask them for any personal information beyond their age, and it can’t ask those under 13 for proof of that. The username tab of its sign-up form even advises: “Don’t use your real name.”

This anonymity shield makes it impossible to know if a child is pretending to be an adult to sidestep safety guardrails, or if an adult is pretending to be a child for more sinister reasons. And when no one is who they say they are, it’s harder to detect suspicious behavior. One safety moderator says it’s common for predators to operate dozens of Roblox accounts at the same time, pretending to be children of different ages.

Many safety advocates say Roblox has been able to avoid the spotlight on child safety issues because predators tend to shift sexual conversations with victims to other, less moderated spaces. These critics consider it an oversight, given that Roblox can act as a gateway to those other platforms and its users are particularly young and vulnerable, that the company wasn’t called to a congressional hearing in January where the CEOs of social media platforms were questioned about online child exploitation. (Spokespersons for Discord, Snap Inc., TikTok and Meta say their platforms have features intended to keep children safe. Discord closed the Sonic Eclipse server after Businessweek reached out for comment.)

Roblox has also argued that federal laws protect it from accountability. In two lawsuits brought in the past year by California parents alleging the company deceived them about the safety of its platform, it cites Section 230 of the Communications Decency Act of 1996, which prevents internet platforms from being held liable for what third parties say or do on their sites. In one of these cases, filed in state court in San Diego, the lead plaintiff alleged that anonymous users were sending her 7-year-old son lewd messages via Roblox asking him to show his genitals or perform virtual sex. In the other, filed in federal court in San Francisco in February, plaintiffs say they would never have given their children thousands of dollars in Robux “had they known that the Roblox platform was founded on the exploitation of their children.” Roblox disputes the allegations and has moved to have both cases dismissed.

A growing chorus of safety advocates, parents, teachers, attorneys and lawmakers is trying to hold tech companies accountable for the harms their products have inflicted on children. In June, US Surgeon General Vivek Murthy called for warning labels on social media sites, like those that appear on alcohol and tobacco products. And some state and federal legislators have introduced laws seeking to dilute Section 230 or force tech companies to be more transparent about child safety.

With its liability shield under attack and with growth in mind, Roblox is making an effort to age up its user base. Gamers over 13 view it as a place for “little kids,” according to a 2022 internal research presentation seen by Businessweek. “We know Roblox becomes less cool as they grow up,” it said. One way to address that, the presentation read, would be to provide more “mature experiences.” Adults, in particular, carry less regulatory risk and control their own bank accounts. In the past year, Roblox has announced a suite of features for users 17 and up, including avatar video calling and games involving romantic themes and “heavy bloodshed.”

Safety workers say those who are pushing for growth want as few barriers to entry as possible. And every time the platform makes it easier for people to connect, they maintain, it becomes harder to police. “The minute those things were rolled out,” one former child safety team leader says of the new features for adults, “our whole team was like, ‘Dear God, no, please Roblox, don’t do this.’ ”

After all the bravado and masquerading, Castillo cut a pathetic figure at the federal courthouse in Indianapolis last August, when he pleaded guilty to transporting a minor across state lines to engage in sex. With that, the web of lies he’d created finally came unwoven.

No, he wasn’t the brother of Roblox legend John Shedletsky. No, he didn’t live in California or drive around in flashy cars with a hot Spanish girlfriend. No, he wasn’t buff with blond hair and blue-green eyes. Reality wasn’t as kind.

Born in New Jersey, the son of Spanish-speaking immigrants, Castillo had been pulled out of school in seventh grade by a controlling mother, his attorney said. Despite his lack of education, he’d found he had a knack with computers and could “make good money” designing video games. But Castillo had mental health issues and “zero social confidence,” and he barely left the apartment he shared above a garage with his mother, the two of them sleeping in the same bed. He may have been king of an online fiefdom, but he had no real friends.

Federal prosecutor Tiffany Preston then laid out what investigators believed had happened during the eight-day ordeal. Shortly after the driver dropped off the girl in New Jersey, Castillo took her to a “teeny, tiny” room he’d rented in the house adjacent to his garage apartment and sexually assaulted her, Preston said.

There were no blankets or furniture, only a dirty twin mattress on the floor. The girl was dependent on him for food and money. When she complained about being lonely, Castillo bought her a plushie doll. He also bought her hair dye to change her appearance. Preston called it “every parent’s worst nightmare.”

The victim wasn’t present in court, but her sister was. In a statement she read to the judge, she said the girl had been suffering from depression and anxiety since being rescued—“she almost doesn’t want to come out of her room.” She’d lost trust in everyone and refused to go to school. “These scars will remain with her forever.” The family declined requests for an interview.

Castillo’s sentence should be severe, Preston argued, to send a message about a bigger social problem. “It’s gained some attention because it is the poster child for how badly things can go wrong when criminals can use supposed kid-safe applications to talk to children,” she said. Like millions of kids, Preston explained, this teenager loved to play games on Roblox, and that’s how Castillo had found and groomed her. “Predators like the defendant know that children are on these social media applications. They know they’re on Roblox. And they are exploiting them every day,” Preston said.

The judge sentenced Castillo to 15 years. “We protect kids,” he said, “because they can’t protect themselves.”

On a Friday morning in June, Castillo was escorted into a clammy visiting room at the Otisville Federal Correctional Institution in upstate New York. He offered a coy smile and a limp handshake. “Hello,” he said in a buttery voice that was nothing like the robotic tone he’d disguised it with online. Now 24, he was wearing a dark brown jumpsuit over a stocky frame, nowhere near the 6-foot-1 he’d once regularly claimed. His dark eyes peered out from behind rectangular glasses. Thin brown hair curled into wisps at the nape of his neck.

“Not what you were expecting?” he asked. His looks were still a mystery to most people. His mug shot had been sealed by the FBI, and all the selfies he’d shared with fans were AI-generated renditions of Jadon Shedletsky, the alter ego behind DoctorRofatnik.

Across three hours, Castillo spoke mostly about his personal history, continually drawing the conversation back to his unconventional childhood. He said he’d built his Shedletsky identity on a “mountain of lies,” starting when he was 12. “Everything I couldn’t be was superimposed onto him,” Castillo said. “I very much played a character—and that character is long dead now.”

He’d had two years in prison to think about his crimes, and he said he was sorry for the pain he’d caused the victim and her family. He said he didn’t view himself to have preyed on her, even though he knew his actions were now considered “a textbook case of online predatory behavior.”

Castillo did have a few things to say about Roblox and why it might appeal to predators. Accessibility, for one. “It’s very easy to make an account,” he said. “It’s very easy to play a game” and “very easy for an adult to talk to a young person.” It was also easy to meet kids on the platform and shift them to less moderated spaces, he said. Roblox needed to tighten its chat restrictions. He recalled simply using the word “cord” instead of “Discord” to evade the censors.

But it had been a long time since he’d used Roblox, and he figured he probably never would again. “I think that chapter in my life is done,” he said. If he serves his full sentence, he’ll be close to 40 by the time he’s released from prison, and he’s had no work experience beyond developing games on Roblox. That morning he’d started his first real job: cleaning the showers in his cell block.