Valve implements credit card age verification for Steam users in the UK

Steam has introduced a new age verification system for its users in the United Kingdom, mandating that users confirm their age to gain access to the Steam Store and its features, due to mature content found on the platform.

This new policy was first noticed by users on social media, who spotted Steam’s FAQ, which noted that the platform is now in compliance with regulations from Ofcom, the UK’s independent regulator for online safety. According to the Steam support page:

“In the UK, Ofcom is the independent regulator for online safety. Ofcom’s guidance on the OSA states that one highly effective age assurance measure is credit card checks. This is because in the UK, an individual must be at least 18 years of age to obtain a credit card; therefore, credit card issuers are obliged to verify the age of an applicant before providing them with a credit card.”

This change took effect on August 29, 2025, and is part of the sovereign state’s UK Online Safety Act, which aims to protect children from harmful and age-inappropriate content. Users who have already linked a valid credit card to their accounts will automatically bypass the verification.

This method also prevents users from accessing account sharing and bypassing age restrictions, as a credit card linked prevents multiple users from accessing said inappropriate content.

Valve noted that the company had focused on maintaining privacy and security when implementing the system. Valve vetted multiple age assurance systems and finally opted for credit card verification. The company stated:

“Among all age assurance mechanisms reviewed by Valve, this process preserves the maximum degree of user privacy. The data processed in the verification process is identical to that of millions of other Steam users who make purchases or store their payment details for convenience.”

To ensure further privacy, Valve handles the verification process internally using its PCI-DSS certified payment system, making sure that no external parties can access a user’s sensitive information.

For now, this requirement only applies to UK-based accounts, but industry watchers are of the view that this could influence similar policies in other regions in the near future.