Steam's Australian age check is credit card or nothing, and that's a bad template

I've had a card on my Steam account for about as long as I've been old enough to own one, so Valve's new Australian age gate wouldn't even register for me. That's exactly what's wrong with it: it's built around people like me and quietly locks out a lot of other adults.

The setup: Australia's age-restricted material codes for app distribution services - and Steam counts - required age checks on R18+ content to be in place by 9 September 2026. The eSafety Commissioner can hit platforms that ignore a formal direction with civil penalties of up to A$49.5 million. Valve made the deadline, and its answer is blunt. If you want to open or buy an R18+ game on an Australian account, you need a valid Australian credit card attached to it. Not a debit card. Not PayPal. A credit card, full stop.

Without one, R18+ store pages are simply blocked. Games you already own still launch and community discussions stay readable, so nobody's library is getting wiped. But if you don't have a credit card and want the next mature-rated release, you're stuck. Several reports also say the adult flag only lasts as long as the card stays on the account - remove it and you're back behind the gate.

The logic isn't hard to follow. Banks hand debit cards to under-18s, credit cards generally not, so a credit card is a cheap stand-in for "this person is an adult." Valve already went through a version of this in the UK, where mature game pages ended up behind an age check too.

Now look at Xbox. Microsoft rolled out its Australian verification in late August with four routes: an email-based check using existing account information, a government ID, a Yoti facial age estimate, or a credit card. You can argue about handing your face to a third party - I'd rather not - but at least there's a menu. Steam gives you one item and a shrug.

That one item misses a lot of people. Coverage of the rollout cites estimates that roughly half of Australian consumers don't hold a credit card at all, and plenty of them skip it on purpose - the surest way to never carry credit card debt is to never own one. Telling a 30-year-old who pays for everything by debit that they can't open the store page of a mature-rated shooter isn't child safety. It's a banking requirement wearing a child-safety badge.

To be fair, there's a privacy argument on Valve's side. A card check doesn't need a passport scan or a selfie sitting on someone else's server, and after the Discord vendor breach that exposed users' ID photos, I get why a company would want to stay out of that pipeline. But "we skipped the invasive option" doesn't justify offering no alternative whatsoever. Email-based age signals like the ones Microsoft uses would cover a massive share of accounts that have been around for a decade without touching a single document.

Why should anyone in Europe care? Because this is how these systems spread. The UK got its gate, Australia has one now, and the EU has been building its own age-verification tooling. Every time Valve ships a single-method solution in one market, it becomes the default draft for the next one. If the European version ends up as "credit card or nothing," a lot of adult players here hit the same wall - and many of them are exactly the debit-only crowd.

Valve is usually the platform that gets consumer-friendly defaults right. This time it built the check that was easiest to ship, not the one that works for the people paying for the games.

Image: Lotus Head from Johannesburg, Gauteng, South Africa / CC BY-SA 2.5, source: https://commons.wikimedia.org/wiki/File:Credit-cards.jpg