Steam users in Australia hit a new wall on September 9, 2026. Anyone trying to view or buy a game rated R18+ by the Australian Classification Board now has to add a valid Australian credit card to their account before Valve will let the purchase through. Debit cards do not count. Neither does PayPal, a driver’s licence photo, a passport scan, or a facial age estimate. A credit card is the only accepted proof of adulthood, and that narrow choice has turned a routine compliance update into one of the most-discussed platform policy stories in PC gaming this month.
The change did not come out of nowhere. It is Valve’s response to a new Australian industry code aimed at app-distribution services, and it lands in the middle of a broader, uneven rollout of age-assurance rules across gaming, social media, and adult content platforms worldwide. What makes the Steam case notable is how blunt the implementation is compared with rivals, and how little room Valve has left for adults who simply do not carry a credit card.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Changed on September 9: Steam’s New Age Gate Explained
Starting September 9, 2026, Australian Steam accounts attempting to access an R18+ title now see a prompt explaining that Valve must confirm the user is at least 18 years old. The prompt directs users to add a valid Australian credit card to their Steam account and then update their Mature Content Preferences in account settings before the restricted content becomes visible or purchasable. According to reporting from Bitdefender’s HotForSecurity blog, the card must remain linked to the account for continued access, and removing it can revoke access to R18+ listings again.
The gate is not a blanket check applied to every Steam purchase. It only triggers for titles that carry Australia’s R18+ classification, a category that covers games with the most intense violence, sexual content, or drug use depictions. Games rated MA15+ or lower are unaffected, and existing downloads made before the rule took effect are reportedly not retroactively blocked.
What surprised many users is the specificity of the payment requirement. A standard Australian bank debit card, even one already used for years of Steam wallet top-ups, gets rejected. Steam Support’s stated reasoning is that debit cards can be issued to people under 18, so they cannot serve as an age signal on their own. A credit card, by contrast, typically requires a credit check and a minimum age to obtain, which Valve is treating as an effective proxy for adulthood.
The Law Behind the Lock: Australia’s Age-Restricted Material Code
The legal trigger is the Age-Restricted Material App Distribution Services Code, one of the industry codes registered under Australia’s Online Safety Act 2021. The code requires app stores and comparable distribution services, Steam included, to prevent Australian minors from accessing or downloading age-restricted material, including games rated R18+. It commenced on September 9, 2026, which is the exact date Valve’s new prompt appeared.
The eSafety Commissioner’s framing of the requirement is narrower than some early headlines suggested. Age assurance is required specifically for content classified R18+, not for every game on the platform, and the obligation is tied to app-distribution services rather than every individual publisher. That distinction matters because it puts the compliance burden squarely on storefronts like Steam, the PlayStation Store, the Microsoft Store, and the Nintendo eShop, rather than on the studios that make the games.
Crucially, the code does not mandate a specific verification method. Operators can choose from a menu of acceptable approaches, which can include payment-instrument checks, document verification, or facial age estimation. Valve picked the option that required the least new infrastructure: treating credit card ownership itself as an age signal, a method some researchers describe as age inference rather than true age verification.
Why Valve Chose a Credit Card Over an ID Check
Valve has not published a detailed public explanation of why it settled on credit-card gating instead of document upload or facial estimation, both of which are used elsewhere in the industry. The practical explanation is speed and cost. Building or licensing a document-verification pipeline, or contracting a third-party age-assurance vendor, takes engineering time, ongoing vendor fees, and data-handling obligations that come with storing sensitive identity documents. Checking whether a card on file is classified as credit rather than debit is something Valve’s existing payment infrastructure can already do with minimal new development.
The tradeoff is accuracy and fairness. Credit card ownership correlates loosely with age but excludes a meaningful slice of the adult population, including people who avoid credit for financial reasons, younger adults who have not yet built credit history, and residents who rely exclusively on debit accounts. It also does nothing to stop a minor who has access to a parent’s credit card, a gap that undercuts the stated child-safety goal of the underlying code.
Debit Cards, PayPal, and Everything Else Steam Won’t Accept
The list of rejected verification paths is longer than what Steam accepts. Reports compiled from Steam Support interactions and Australian outlets describe the following methods as currently non-functional for unlocking R18+ content:
- Standard Australian debit cards, even when linked to an active bank account
- PayPal balances or PayPal-linked payment methods
- An account’s existing purchase or wallet history
- An account’s registration age or years of prior activity on Steam
- Uploaded photos of a driver’s licence or passport
- Facial age-estimation selfies
- Third-party digital ID credentials
That leaves a valid Australian credit card as the sole documented path. Users have reported confusion over hybrid or prepaid cards that behave like credit products but get flagged as debit by Steam’s backend, and there is currently no appeals process described for a card that is wrongly classified.
How Australian Gamers and the Press Are Reacting
Coverage from Australian outlets has focused overwhelmingly on the exclusion problem rather than the underlying safety goal. Press Start Australia was among the first outlets to report, on September 9, that debit cards specifically do not satisfy the new requirement, a detail that caught many users off guard since debit is the default payment method for a large share of Australian consumers. Vooks covered the eSafety Commissioner’s broader explanation that the rule applies only to R18+ titles rather than the full Steam catalogue, which helped clarify some of the early confusion about scope.
Community complaints collected across forums and social media cluster around a few recurring themes: adults who have never needed or wanted a credit card being locked out of games they have legally purchased for years, the loss of access to R18+ store pages and community hubs even before any purchase attempt, and frustration that removing the qualifying card from an account revokes access again rather than granting a one-time verified status. None of this is described by Valve as a bug. It is the system working as designed, which is precisely what critics find objectionable.
The Interactive Games and Entertainment Association, Australia’s games industry body, has not published a detailed public statement specifically addressing Valve’s implementation choice, though the organization has a long history of engaging with Australian classification policy dating back to the fight over introducing the R18+ rating itself. More background on the association’s role in Australian games policy is available on the IGEA website.
Steam vs PlayStation vs Xbox vs Nintendo vs Epic: Who Verifies What
Steam is not the only storefront covered by the Age-Restricted Material App Distribution Services Code, but reporting suggests it has taken the most rigid approach. Console makers appear to offer more than one path to the same compliance outcome, which is prompting comparisons that make Valve’s single-method system look especially inflexible.
| Storefront | Reported Australian R18+ verification method | Debit card accepted? | ID or facial scan option? |
|---|---|---|---|
| Steam (Valve) | Valid Australian credit card only | No | Not currently offered |
| PlayStation Store | Multiple signals reported, including account and payment-related checks | Reported in some cases | Facial-age estimation reported for some accounts |
| Xbox / Microsoft Store | Multiple assurance routes tied to account and family settings | Reported in some cases | Varies by account configuration |
| Nintendo eShop | Not clearly documented in current reporting | Unconfirmed | Unconfirmed |
| Epic Games Store | Existing parental-control and age-based account system, no confirmed Australia-specific R18+ gate | Not applicable | Not applicable |
| GOG | No documented Australia-specific implementation identified | Unconfirmed | Unconfirmed |
The caveat worth repeating is that platform comparisons in this space are genuinely murky. Some storefronts verify age using signals baked into existing account data, a payment instrument, or a third-party identity provider without ever presenting the user with an explicit standalone workflow the way Steam now does. That makes Valve’s system look uniquely restrictive partly because it is the most visible, not necessarily because every rival platform has solved the problem more elegantly behind the scenes.
Historical Context: Australia’s Decade-Long Fight Over R18+ Games
The 2013 classification fight
Australia did not even have a legal R18+ classification for video games until 2013. Before that amendment, games that would have qualified for an adult rating elsewhere were either censored to fit the MA15+ ceiling or Refused Classification entirely, effectively banning legal sale in the country. The 2013 reform, achieved after years of advocacy from the games industry and consumer groups, created the category but did not guarantee every mature title automatic clearance. Refused Classification remains a possibility for games that exceed even the R18+ threshold. Background on that classification history is documented on the Australian Classification Board’s Wikipedia entry, sourced from official classification records.
The 2026 credit-card rule is not a rollback of that 2013 win. R18+ games remain legal to sell in Australia. What has changed is the second layer: even after a title clears classification, storefronts must now actively confirm the buyer is old enough to see it, a distinct and newer compliance obligation layered on top of a rating system that took a decade of lobbying to establish.
Following the UK’s playbook, with the same friction
Australia is not acting in isolation. The UK’s Online Safety Act, which received royal assent in 2023, forced a similar reckoning across platforms hosting adult or harmful content, with age-assurance enforcement expanding through 2025. Background on that legislation’s scope is available via its Wikipedia summary for readers comparing the UK and Australian frameworks, which share a similar structure of industry codes enforced by a national regulator. UK adults ran into the same complaint Australians are voicing now: card-based and document-based verification schemes exclude the very demographic of legally-entitled adults who happen not to carry the required credential, whether that is a credit card or a passport.
The European Union’s Digital Services Act sits in a related but distinct lane. It is a platform-governance and risk-management regime rather than a direct age-verification mandate for game storefronts, so it should not be conflated with what Australia has just implemented. Still, EU regulators have signaled ongoing interest in child-safety obligations for digital platforms, and a game-specific age-assurance code is a plausible next step if Australia’s approach becomes a reference model.
US States Are Watching the Australian Experiment
Several US states, including Louisiana, Texas, and Utah, have passed legislation touching app-store age assurance, parental consent, and age-based access to online services in the past two years. Whether those laws extend to PC digital storefronts the way Australia’s code does depends heavily on how each statute defines terms like “app store,” “covered platform,” or “digital service,” definitions that vary significantly state to state and have not been tested against a PC-native storefront like Steam the way they increasingly are against mobile app stores.
That legal ambiguity is exactly why the Australian rollout matters beyond its borders. It is the first large-scale, real-world test of how a major PC storefront responds when a government mandates age assurance for mature content, and both regulators and platform operators elsewhere are almost certainly using it as a case study, for better or worse, of what happens when the compliance bar is set without prescribing the method.
Global Age-Verification Rules Hitting Game Platforms in 2026
| Jurisdiction | Framework | Status as of September 2026 | Applies directly to PC game storefronts? |
|---|---|---|---|
| Australia | Age-Restricted Material App Distribution Services Code (Online Safety Act 2021) | In effect since September 9, 2026 | Yes, confirmed on Steam |
| United Kingdom | Online Safety Act industry codes | Enforcement expanding through 2025 into 2026 | Primarily targets adult and harmful content platforms, gaming impact indirect so far |
| European Union | Digital Services Act | Ongoing platform-governance enforcement | No dedicated game-specific age-assurance code yet |
| United States (state level) | Louisiana, Texas, Utah app-store and minor-safety laws | Passed and being implemented at varying paces | Legally untested against PC storefronts specifically |
The picture that emerges from this table is one of regulatory divergence rather than a single global standard. Every jurisdiction is solving a similar political problem, protecting minors from mature content, with a different legal tool and a different definition of which platforms count. That divergence is precisely why Valve, Sony, Microsoft, Epic, and GOG cannot build one universal age-gate and ship it everywhere. Each region effectively forces its own implementation.
Market Impact: What This Means for Steam’s Australian Business
No official figure exists for how many Australian Steam accounts lack a qualifying credit card, and Valve does not publish country-level active-user breakdowns, so any number describing the affected population as being in the “millions” should be read as a media characterization rather than a confirmed statistic. What can be assessed with more confidence is the shape of the business risk.
R18+ titles are a commercially significant slice of the catalogue, covering many of the biggest annual releases in shooters, horror, and open-world action games. If a meaningful share of Australian adults cannot clear the credit-card gate, Valve risks pushing some of that spending toward console storefronts with more flexible verification, toward physical retail where R18+ purchases have never required a card-based age check, or toward grey-market key resale that sits outside Steam’s own economics entirely. None of that helps Valve’s Australian revenue, and it creates an opening for PlayStation and Xbox to look comparatively more accessible to adult buyers of mature titles in that specific market.
There is also a knock-on effect for smaller storefronts. GOG and itch.io do not have Valve’s engineering resources, and a credit-card gate is the cheapest compliance option precisely because it reuses existing payment infrastructure. Smaller platforms facing the same Australian code may have even less flexibility to offer alternative verification paths, which could concentrate R18+ PC game sales in Australia even more heavily around whichever storefront implements the least-friction, most-restrictive option first.
Privacy Experts Flag the Card-as-Age-Proof Tradeoff
Beyond access complaints, there is a distinct privacy critique running through coverage of the change. Requiring a financial credential to unlock content access ties a sensitive payment instrument to a specific behavioral category, R18+ game ownership, in a way that a simple birth-date confirmation never did. Security researchers tracking the rollout have described Valve’s approach as age inference rather than true age verification, a technical distinction that matters because inference-based systems tend to produce more false negatives among legitimate adults while still offering no cryptographic guarantee about the actual age of the cardholder.
Valve has not detailed publicly how long card data used for this purpose is retained, whether it is processed differently from ordinary payment data, or whether a future update might decouple the credit card check from active card retention once age is confirmed once. Those unanswered questions are the main reason this story has stayed in the news cycle for weeks rather than fading after the initial rollout, since every user complaint effectively surfaces a new edge case Valve has not addressed in public documentation.
Inside Steam’s New Account Flow
For Australian users trying to navigate the change today, the practical path looks like this in Steam’s client and web interface:
Steam > Account Details > Payment Methods > Add a Payment Method > Credit Card
Steam > Store > Preferences > Mature Content > Confirm Age Assurance
(Debit cards, PayPal balance, and stored gift-card credit will not satisfy the check)Reported workarounds are limited and carry real risk. Buying an R18+ title through a legitimate alternative retailer and activating the key on Steam may restore in-game access but does not necessarily unlock the store page or community hub for that title. Falsifying a Steam account’s region through a VPN, or using a card that does not belong to the account holder, can violate Steam’s terms of service, Australian consumer protection rules, or both. There is currently no confirmed, sanctioned bypass for an adult who simply does not have or want a credit card.
What Valve Could Do Next
The Age-Restricted Material App Distribution Services Code does not require Valve to offer every possible verification method, only some effective one, which means Valve is technically compliant even with a single, narrow option. That said, the volume of complaints creates commercial and reputational pressure that regulatory minimums do not fully capture. The most likely next step, based on how the UK’s rollout evolved after similar backlash, is Valve quietly adding a second verification path, most plausibly a document-upload or third-party identity-provider option, without necessarily framing it as a reversal.
A less likely but not impossible outcome is the eSafety Commissioner issuing clarifying guidance that pushes storefronts toward a minimum set of accepted methods, effectively standardizing what counts as adequate age assurance across Steam, PlayStation, Xbox, and the rest. That kind of regulatory follow-up would reduce the current patchwork where each storefront appears to be interpreting “effective” age assurance differently.
Predictions: Where Age Verification in Gaming Goes From Here
- Valve adds a second verification path within two to three quarters. Sustained user complaints and the precedent of UK platforms softening card-only rules make a document or third-party ID option likely by mid-2027.
- Other regulators reference Australia’s rollout as a case study. Expect UK and EU officials to cite the credit-card exclusion problem as an argument for prescribing minimum verification standards rather than leaving the method entirely up to platforms.
- Console makers publish clearer Australian compliance documentation. The current ambiguity around exactly how PlayStation and Xbox verify age in Australia is unsustainable once Steam’s approach draws this much scrutiny. Expect Sony and Microsoft to formalize public-facing explanations.
- US state age-assurance laws get tested against PC storefronts. As Louisiana, Texas, and Utah refine enforcement of their app-store and minor-safety statutes, expect the first legal challenges or clarifications specifically addressing whether Steam, Epic, and GOG count as covered platforms.
- Smaller storefronts face a compliance squeeze. GOG, itch.io, and other independent PC storefronts will likely adopt whatever minimum-viable verification method the market leaders settle on, rather than building bespoke systems, concentrating age-assurance practices around a small number of shared approaches industry-wide.
Why This Story Matters Beyond Australia
It is tempting to read the Steam Australia story as a narrow regional footnote, but it functions as a live experiment the rest of the industry is watching closely. Every major storefront operating globally will eventually face a version of this same question: how do you prove a user is old enough for mature content without either building an expensive identity-verification pipeline or excluding legitimate adults who lack the chosen credential? Valve’s answer, credit-card ownership as a proxy for age, is the cheapest option on the table, and cheapest options tend to get copied when regulators do not specify otherwise. That makes the current backlash more than an Australian customer-service problem. It is a preview of the tradeoffs every gamer, in every region with an age-assurance law on the books, may eventually have to navigate.
Frequently Asked Questions
Why does Steam now require a credit card in Australia?
Valve introduced the requirement to comply with Australia’s Age-Restricted Material App Distribution Services Code, which took effect September 9, 2026, and requires app-distribution services to verify that users accessing R18+-classified games are at least 18 years old.
Does the credit card rule apply to every game on Steam?
No. It applies only to titles classified R18+ by the Australian Classification Board. Games rated MA15+ or lower are not subject to the credit-card gate.
Why doesn’t my debit card work?
Steam Support has indicated that debit cards can be issued to people under 18, so Valve does not treat debit card ownership as a reliable age signal. Only cards identified as credit cards currently satisfy the check.
Is there a way to verify age without a credit card?
As of this reporting, no. Valve has not made document upload, facial age estimation, or a third-party digital ID option available for Australian users, leaving a qualifying credit card as the only documented path to unlocking R18+ content.
Do PlayStation, Xbox, and Nintendo have the same requirement?
They are covered by the same Australian code, but public reporting suggests PlayStation and Xbox offer more than one age-assurance path rather than relying solely on a credit card. Nintendo’s and Epic’s specific Australian implementations are less clearly documented at this time.
What happens if I remove my credit card from Steam after verifying?
Reports indicate that access to R18+ content can be revoked again if the qualifying card is removed from the account, since the verification appears to be tied to the card’s continued presence rather than a one-time confirmed status.
Will this rule spread to other countries?
Not automatically. The UK, the EU, and several US states have separate age-assurance frameworks with different scopes and definitions, and none currently mirrors Australia’s code exactly. However, regulators in those regions are widely expected to study Australia’s rollout as they refine their own rules for digital storefronts.
Is using a VPN to bypass the Australian region a safe workaround?
No. Misrepresenting your account region or using a payment method that does not belong to you can violate Steam’s terms of service and, depending on the circumstances, Australian consumer protection law. There is no confirmed, sanctioned bypass currently available.
Related Coverage
- Discord's New Age Check Skips ID for 90% of Users [2026]
- Steam Frame vs Meta VR Glasses: 440g vs 100g [2026]
- GeForce NOW Free Tier: Stream Steam Games in 12 Steps [2026]
- Chromebook Cloud Gaming Setup: 13 Steps, 60 Min [2026]
- Control Resonant Hits 90% Score as Pirates Back It [2026]
