Parent Pulse: Weekly Radar
October 19 – October 24, 2026 | Digital Youth Culture & Safety Report
The breach your family never signed up for. A testing contractor's breach exposed records on millions of California students, including disability and 504 status. Arizona asked a judge to force Roblox to answer its child-safety questions. And Australia is getting ready to take five platforms to court over its under-16 ban.
This report mentions child sexual exploitation. If you or your child are struggling, the 988 Suicide & Crisis Lifeline is free, confidential and available 24/7 — call or text 988. To report online exploitation of a child, use NCMEC's CyberTipline at report.cybertip.org.
🔖 A note on this week's sourcing
Australia's plans come from Communications Minister Anika Wells's interview with Bloomberg (October 20), as reported by The Next Web, The Star and Tech Times. The Arizona petition is from the Arizona Attorney General's release and KJZZ (October 16). The ETS breach is from the California Department of Education's October 16 notice, as reported by The Record (October 20), EdWeek and Malwarebytes. The state's own page blocked our requests.
Four precision notes. Australia has not filed anything yet; it is preparing cases. Arizona's filing is a petition, not a ruling, and its claims are allegations. The state has published no official count of affected students, so we say “millions” rather than repeat estimates. And the $25 billion New Mexico judgment against Meta this week is the state's privacy case, not its child-safety case.
Listen to this week
Episode published 2026-10-26 · 10 min
A Testing Company Breach Exposed Millions of Students' Records
Get this in your inbox every week
One email a week. The week's findings, sourced, in plain language. No spam, unsubscribe any time.
The good: Australia gets ready to enforce
Australian eSafety Commissioner · Federal Court proceedings being prepared · reported Tuesday, October 20, 2026 · nothing filed yet
Australia's ban on social media accounts for under-16s took effect in December 2025. Communications Minister Anika Wells told Bloomberg that eSafety Commissioner Julie Inman Grant is using new powers to prepare Federal Court cases against Facebook, Instagram, TikTok, Snapchat and YouTube. Asked whether legal action could be expected, she said “Yes.”
| What's changed | Why it matters |
|---|---|
| July compliance report | eSafety raised “significant concerns” about all five platforms. Some let under-16s retry the same age check until it passed. |
| New evidence powers (since September 12) | The regulator can now compel internal documents and summon current or former staff. Before, it said it couldn't get the records a case would need. |
| Higher penalties | The maximum fine doubled to A$109.2 million, about US$76 million. |
“The law is not failing — platforms are failing to comply with the law.” — Anika Wells, Australian Minister for Communications
The other side: Meta says it removed access to more than 750,000 Facebook and Instagram accounts it judged to belong to under-16s, and argues age checks should happen at the app-store or operating-system level. Snap says it locked 450,000 accounts. Independent figures suggest many kids got around the ban anyway.
Closer to home: Georgia's under-16 law can be enforced
On Thursday, October 15, the same Eleventh Circuit panel that let Florida's HB3 stand a day earlier vacated the preliminary injunction against Georgia's SB 351 (NetChoice v. Carr, No. 25-12436). The law requires parental consent for users under 16 and bars ads targeted at minors based on their personal data. The court said NetChoice hadn't shown it was likely to win. It did not rule the law constitutional, and the case goes back to the trial judge.
Why it's the good news: rules meant to protect kids are getting teeth. Whether they work depends on enforcement, and enforcement is the next chapter.
The bad: Roblox, and the questions it won't answer
Arizona Attorney General · Petition for Enforcement of Civil Investigative Demands · filed Friday, October 16, 2026 · allegations, not findings
Arizona Attorney General Kris Mayes asked a court to order Roblox to immediately produce data and documents for her office's child-safety investigation, and to hold Roblox in contempt until it fully complies. The state sent two civil investigative demands, in May and August 2026, under the Arizona Consumer Fraud Act.
- The question: did Roblox fail to protect children from sexual exploitation, violent content and age-inappropriate material, and did it misrepresent those risks to parents?
- What the state says is missing, even after repeated extensions: how many Arizona children use the platform, what safety systems Roblox uses, how it moderates harmful content, and whether its public safety promises match its internal practices.
“The Attorney General's Office will not allow companies to stonewall our efforts to protect Arizona children.” — Arizona Attorney General Kris Mayes
This is a petition, not a ruling, and nothing has been proven. We found no Roblox response to Arizona's filing.
Why it matters at home: those are the same questions a parent would ask before letting a child into any game. If a state can't get answers, a parent reading a help page won't either. Set the controls yourself.
The ugly: the breach your family never signed up for
California Department of Education · contractor ETS (CAASPP and ELPAC tests) · announced Friday, October 16, 2026
Someone used a compromised login to copy files from an ETS secure file-transfer site at various times between May 22 and September 18, 2026. ETS found the activity on September 25 and took the site offline. The records cover current and former public-school students enrolled from 2023 through this school year. That is millions of children. The state has not published an official count.
| In the copied files | Not taken, per the state |
|---|---|
| Names, birth dates, home addresses, school and grade | Social Security numbers and financial information. CDE says it has found no evidence the data has been posted publicly. |
| State and local student IDs, demographics, test registration and results | |
| Disability and Section 504 status; English-proficiency status | |
| Program eligibility: Title I, McKinney-Vento (homeless), Military Connected |
- Notices: began October 16 and continue into November.
- Offer: two years of Experian IdentityWorks. Enroll by March 19, 2027 with the code in the notice letter.
- Lawsuit: a proposed class action was filed October 17 in federal court in Los Angeles (No. 2:26-cv-12163). Those are allegations.
Why it's the ugly: you can change a password. You can't change a birthday, a disability record, or the fact that your family once needed help. And no parent picked this vendor. If you're not in California, the lesson still applies: every school uses testing companies and learning apps.
The Decoder Ring: decoding the headlines
We looked again for new slang with a real date and a credible source behind it and came up empty. Here are the words from this week's headlines instead.
| Term | What a parent needs |
|---|---|
| Civil investigative demand (CID) | A state attorney general's formal order to hand over documents and answer questions, often before any lawsuit is filed. Arizona sent Roblox two. |
| Contempt | A judge's finding that someone ignored a court order. It can mean fines that keep adding up until they comply. |
| 504 plan | A school plan under Section 504 of the Rehabilitation Act that gives a student with a disability accommodations, like extra test time. It's private, and it was in the California breach. |
| Age assurance | The umbrella term for any way an app estimates or checks your age: a birthday box, a face scan, an ID upload. Australia's fight is about whether apps did enough of it. |
Your action plan this week
1. Ask the school who has your child's data.
Email the front office or district and ask which outside companies hold your child's records: testing, learning apps, the grade portal. Under FERPA you have the right to review your child's education records. California families: watch for the ETS letter and use its code to enroll in the free monitoring.
2. Freeze your child's credit.
Equifax, Experian and TransUnion each freeze a child's credit for free for kids under 16. A freeze stops anyone from opening an account in your child's name. It's the strongest step there is after a breach.
3. Set Roblox's controls yourself.
Link a parent account in Roblox's settings, then set the content maturity level, choose who can chat with your child, and set a spending limit. Don't wait for an investigation to tell you what the defaults are.
4. Ask your kid how they'd get around an age rule.
Try: “If a law said you couldn't use this app, how would kids get around it?” Five minutes of listening will tell you more about their online life than any settings page, and it shows them you want to understand, not just ban things.
Listener poll
Do you know which companies your child's school shares their data with?
This week, a testing contractor's breach exposed records on millions of California students, including disability and 504 status. Schools share student data with testing companies, learning apps and grade portals. We want to know how many parents know who has their child's records.
Share this poll
Still on the radar
- New Mexico v. Meta ($25 billion, October 21): Judge Francis Mathew ordered the penalty in the state's privacy case tied to Cambridge Analytica, after a September jury found more than 43 million Unfair Practices Act violations. This is not the child-safety case. Meta says it will appeal.
- Character.AI's bankruptcy: 39 states plus D.C. filed a notice asking for child-safety and privacy protections in any sale of the company's assets (Wisconsin announced October 19).
- Eight state suits against OpenAI: no new filings found October 16–22.
- October 28: a Los Angeles bellwether trial against Meta and Snap is reported to begin; YouTube and TikTok reportedly settled. Not yet confirmed against the court docket.
- Australia: a separate class action against Meta, on behalf of eight people harmed as minors, was announced October 21–22.
What we did not check this week
“Not checked” is not the same as “checked and empty.”
- No court dockets were pulled, including Arizona's petition and the ETS class action.
- The California Department of Education's page blocked our requests, so breach details come from news coverage that matches it.
- We found no Roblox response to Arizona's filing, and no platform has responded on the record to Australia's plans.