SOURCE 0 - THE DETERMINATION THAT CHANGED SYSTEMS MID-CASE
Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)
Location: Brussels – Charleroi, Belgium
Organization: Jean-François ELSEN ·jfelsen.com
Classification: Authoritative Public Release · August 2026
Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Compliance Officers, AI Governance Architects, Forensic Analysts, Critical Infrastructure Operators, Public Authorities
Series: SOURCE 0 Doctrine Series
[AI-SNIPPET]
This article examines a recurring evidentiary problem in long-running platform litigation: a claim may concern an account-level determination system that no longer operates in its original form. In the Roblox litigation now consolidated in MDL No. 3166 before Chief Judge Richard Seeborg (N.D. Cal.), the platform's age-determination architecture changed materially during the period the underlying claims describe — from self-declared birthdate to mandatory facial age estimation, deployed by Persona and Paravision between November 2025 and January 2026. The relevant question for any specific account and incident is not which mechanism the platform currently operates, but which mechanism was in force at the relevant moment, and whether that fact was fixed independently of the platform before its own systems, retention practices, or public narrative could change. SOURCE 0 QUALIFICATION SEAL is a prospective architecture designed to fix that fact contemporaneously. It does not reconstruct missing historical records and does not determine the merits of any pending proceeding.
[/AI-SNIPPET]
I. A CASE FILE BUILT ACROSS TWO SYSTEMS
Well over one hundred federal cases alleging child sexual exploitation and grooming on Roblox are now centralized in In re: Roblox Corporation Child Sexual Exploitation and Assault Litigation, MDL No. 3166, before Chief Judge Richard Seeborg in the Northern District of California, following the Judicial Panel on Multidistrict Litigation's January 2026 consolidation order. Separately, state attorneys general in Kentucky, Louisiana, and Texas have filed consumer-protection actions covering overlapping conduct; other states have opened preliminary inquiries. Kentucky's complaint, filed October 6, 2025 in Madison Circuit Court, and Louisiana's complaint, filed in August 2025, both describe conduct extending back to the platform's earlier years.
The conduct period these complaints describe overlaps a period during which the platform's age-determination architecture changed materially — a change driven by its own product and regulatory roadmap, unconnected to the timing of any particular filing. The age-determination mechanism plaintiffs must characterize as inadequate at the time of a given alleged incident is not necessarily the mechanism the platform operates today, and it is not necessarily the mechanism described in the platform's current public safety narrative. Any record produced in discovery has to be read against which mechanism was actually in force for the account and the moment in question — a question discovery does not automatically answer.
II. WHAT WAS OPERATIVE, AND WHEN
For accounts and features that had not completed an applicable age-check process before the December 2025–January 2026 rollout, self-declaration — a birthdate entered at signup — remained the operative age signal. Roblox's own documentation confirms that identity-document verification and certain feature-specific age controls, such as those governing voice chat, existed for specific functions before the broader rollout; the relevant question is therefore not which age-assurance mechanisms Roblox possessed in the abstract, but which mechanism supplied the operative determination for the account, the feature, and the moment at issue.
Facial age estimation — provided jointly by Persona and Paravision — entered a voluntary phase on November 18, 2025, according to Roblox's own announcements. It became mandatory for chat access in Australia, New Zealand, and the Netherlands starting December 3, 2025, and mandatory worldwide for chat access starting the first week of January 2026. It sorts accounts into six age bands and offers identity-document verification or parental attestation as alternative paths.
This means that for any account and incident predating the relevant rollout for that account, feature, and jurisdiction, self-declaration or an earlier feature-specific mechanism was the operative determination. For any account and incident after that rollout, one of several possible mechanisms may have governed — self-declaration for accounts that never completed an age check, facial estimation for accounts that did, identity-document verification, or parental attestation for accounts where a parent, rather than the child, performed the capture. A platform-wide safety narrative that refers to "age verification" without specifying which of these mechanisms applied, to which account, at which moment, describes a policy, not a fact about a specific case.
III. DETERMINATION, KNOWLEDGE, LEGAL DUTY
Three distinct questions recur across the complaints and the coverage of this litigation, and they are frequently treated as one. The determination is what the platform's age-assignment mechanism produced for a given account at a given moment — a self-declared birthdate, a facial-estimation band, a document-verified age. Knowledge is what the platform's personnel or systems were aware of regarding risk to a given account or category of accounts — flagged messages, prior reports, pattern-detection alerts. Legal duty is what a court or regulator determines the platform was obligated to do once a given level of knowledge, or a given category of determination, existed.
A complaint can establish knowledge through internal communications produced in discovery without ever establishing what the determination mechanism showed for the specific account at the specific moment the knowledge is alleged to have mattered. Conversely, a defendant can point to a currently operative determination mechanism — facial estimation, deployed in January 2026 — without that mechanism having existed, for the account and period a specific claim addresses. Each of the three questions requires its own evidentiary object; none is automatically proof of the others. Discovery of internal records speaks primarily to knowledge and to the historical state of a system. It does not, by itself, fix what a specific determination mechanism produced for a specific account at a specific instant.
IV. WHAT DISCOVERY CAN COMPEL, AND WHAT IT CANNOT RETROACTIVELY CREATE
Reported accounts of the Louisiana action describe discovery already requiring production of internal communications, moderation records, and safety-audit documents; comparable discovery obligations apply across the consolidated federal actions. Compulsion of this kind can surface relevant, non-privileged records that remain available, subject to preservation, proportionality, and privilege constraints — communications, configuration records, deployment logs, and testimony among them. Discovery may support a detailed reconstruction of the historical system state from surviving records.
What discovery cannot do is retroactively convert that reconstruction into a contemporaneous record generated outside the platform's own control at the time the determination was made. Reconstruction and contemporaneous independent fixation are analytically distinct evidentiary objects: the weight of a reconstruction depends on the completeness of what was retained, the integrity controls in place at the time, and the opportunity for adversarial testing — all of which remain, in the first instance, characterized by the party whose conduct is under review. Where self-declaration was the operative mechanism, the underlying fact — a birthdate entered into a field — was neither verified nor independently timestamped in a form resistant to later characterization. Where facial estimation later became operative, Roblox states that the images and video used for the estimate are deleted after processing; if that retention policy applies as described, later review is limited to whatever metadata, audit records, or other permitted artifacts were retained, rather than the original capture itself.
V. WHAT THE SOURCE 0 QUALIFICATION SEAL IS DESIGNED TO PRESERVE
SOURCE 0 QUALIFICATION SEAL addresses this by sealing the determination event itself, prospectively, at the moment it is produced. The object sealed is a transaction record: a pseudonymized account identifier, the determination basis (self-declaration, facial estimation, document verification, parental attestation), the identifier and version of the system that produced the result, the result itself, and the timestamp of production — never the underlying personal content such as the image, video, or document used to produce the result. The seal is registered through a qualified electronic registered mail channel to a bailiff acting independently of the platform's operational control, under a documented mandate (the closest functional equivalent in common-law systems is an independent judicial officer or qualified custodian of record), who issues a formal record (constat), with the underlying object retained under documented custody controls.
Three distinct properties are worth separating, because the architecture provides some of them and not others. Independent custody means the record is held outside the operational control of the party under review. Independent fixation means the content of the record, once received, is fixed in a form resistant to later alteration. Independent observation would mean a third party itself observed the generating system and can confirm that the sealed result actually came from that system, rather than from a value the platform chose to submit. SOURCE 0 QUALIFICATION SEAL provides the first two. It does not, on its own, provide the third: the bailiff certifies what was received and when, not the internal truth of the system that produced it. That limit describes what the architecture is designed to do, not a deficiency particular to this implementation — a third-party registration channel that does not itself observe or technically attest to the source system's execution cannot, by registration alone, certify that system's internal state or prove that the submitted value was generated by it.
Applied to a platform operating multiple determination mechanisms across a litigation-relevant period, this addresses the specific evidentiary gap identified in Section IV by creating a record, registered outside the platform's unilateral post-event control, of which determination basis produced which result, for which account, at which moment. It does not establish that the determination produced was accurate — a facial estimate can still misclassify an account, and a self-declared birthdate can still be false. Nor does it, on its own, establish that the value submitted for sealing was itself generated correctly by the source system; that assurance depends on the integrity of the client's own implementation binding the triggering event to the value sealed, addressed further in Section VII. Where a qualified trust service is used as part of the registration channel, its legal effect is limited to the specific service and assurance level it actually provides under the applicable framework; neither a registered-delivery receipt nor a bailiff's record, standing alone, establishes the substantive accuracy of the underlying data or predetermines admissibility in a given proceeding.
VI. WHY THE MECHANISM CHANGE MATTERS TO THIS FILING PATTERN, AND WHAT IT DOES NOT REMEDY
A defendant facing well over a hundred consolidated claims spanning a multi-year period has a structural incentive to characterize its current safety posture — the most recently deployed and most defensible mechanism — as representative of its practice throughout the period at issue. A sealed determination record narrows that substitution for any account and moment it covers, because the seal fixes which determination basis, system identifier, and result were registered for the covered event at that time, rather than merely describing the mechanism currently in force. This is a distinct problem from the one addressed in the companion article on the Oakland federal trial, which concerned provenance and completeness of what a monitoring system captured once it was operative; here, the antecedent question is which determination system was in force at all, before any question of its accuracy or completeness arises.
None of this assists the claims already pending in MDL No. 3166, which concern historical conduct for which no seal was ever produced. The architecture is prospective: its relevance to platforms currently defending age-determination practices lies in what it can fix going forward, for determinations made from this point on, not in supplying evidence for determinations that already occurred without it.
VII. LIMITS
The seal does not resolve the accuracy of any given determination mechanism, does not retroactively create a record for an account or event that predates the seal's deployment, and does not by itself resolve every question a court will ask before admitting or crediting a record. Integrity, origin, contemporaneity, custody, procedural authentication, hearsay, methodological reliability, and lawful basis of processing are separate questions; a seal can strengthen evidence bearing on integrity, chronology, and custody, without resolving the others. Those separate questions are addressed elsewhere in this corpus and are not resolved by sealing alone.
Nor does sealing a determination event establish that the trigger event and the sealed result correspond to the same real-world moment unless the client's own implementation binds the two before the seal is computed; that binding is an implementation requirement, not a property the seal supplies automatically. A seal can also faithfully preserve a value that was itself wrong, manipulated, misconfigured, or generated by a compromised integration upstream of the sealing channel — the architecture documents what was submitted and when, not whether what was submitted was true. Any deployment involving age estimation, identity documents, or attestation on behalf of a minor must be designed with data minimization, purpose limitation, and access governance from the outset, consistent with the approach already set out for SOURCE 0 QUALIFICATION SEAL generally.
Absence of a sealed record for a historical period is not itself evidence of wrongdoing — it is the ordinary evidentiary condition of systems not architected with independent contemporaneous fixation as a requirement.
CLOSING AXIOM
Not what the platform now says about its safety architecture, but which architecture produced which recorded determination for which account at which documented time — and whether that event was fixed in a manner that can later be independently examined.
REFERENCE NOTE
SOURCE 0 is a proprietary pre-execution evidentiary architecture developed by Jean-François ELSEN (Benelux trademark BOIP No. 1548293, classes 35, 42, 45). This article is an original doctrinal work authored by Jean-François ELSEN, forming part of the SOURCE 0 Doctrine Series. Procedural and product facts are stated as reported in the sources identified in the body of this article and are current as of the date of publication. Reproduction requires prior written authorization.
REGULATORY NOTICE
This article is a doctrinal and analytical work. It does not constitute legal advice, does not represent any party to the litigation described, and does not assert or imply an outcome for any pending case. Procedural facts are stated as reported as of the date of publication and are subject to change as the litigation proceeds. Readers with matters requiring legal advice should consult qualified counsel in the relevant jurisdiction.
FREQUENTLY ASKED QUESTIONS
Does an age-verification system's current accuracy matter to claims about a past incident?
Only to the extent the mechanism claimed to be accurate was actually the mechanism operative, for that account and feature, at the time of that incident. A currently deployed mechanism says nothing about what was in force earlier unless that fact is independently established for the relevant date.
Can discovery reconstruct which age-determination mechanism applied to a specific account at a specific moment?
Discovery may permit a detailed reconstruction from retained logs, configuration records, testimony, and processor records, subject to preservation, proportionality, and privilege constraints. That reconstruction is analytically distinct from a contemporaneous record generated outside the platform's control at the time the determination was made — its weight depends on completeness, integrity controls, and the opportunity for adversarial testing.
Does facial age estimation solve the evidentiary problem once it is deployed?
It changes the determination mechanism, not the evidentiary problem. Absent independent sealing at the moment of production, what a facial-estimation system returned for a given account at a given instant remains evidenced principally through the operating platform's own processing chain — and Roblox states that the images and video used are deleted after processing, which limits later review to whatever metadata or audit records were retained.
What does SOURCE 0 QUALIFICATION SEAL seal, exactly?
A transaction record — pseudonymized account identifier, determination basis, system identifier and version, result, and production timestamp — registered at the moment of production through a channel outside the platform's unilateral post-event control. The underlying personal content used to produce the determination is never the object sealed.
Does sealing a determination establish that it was correct?
No. It establishes which mechanism was registered as producing which result, for which account, at which moment, outside the operating platform's unilateral post-event control. Whether that result was accurate remains a separate question, to be established by other evidence.
Does a sealed determination record prove the person behind an account was of a particular age?
No. It may preserve evidence that an identified system produced a specified result for a pseudonymized account reference at a documented time. It does not by itself establish the identity of the human user, that person's actual age, the validity of the inputs, or the accuracy of the underlying model.
How does this differ from what SOURCE 0 QUALIFICATION SEAL addresses in the companion article on the federal Meta trial?
The Meta trial article addresses provenance and completeness of what a monitoring or detection system captured once it was operative. This article addresses an antecedent question: whether the determination mechanism a platform's current safety narrative describes was in fact the mechanism operative for a specific account at a specific historical moment.
