Australian Steam users who want to browse or buy R18+ games now need a valid Australian credit card on their account, a change that took effect on Sept. 9, 2026. The requirement lines up with the same date Australia set as its deadline for age assurance in app distribution, meaning the storefront is treating itself as an app distribution service under the country's new code. Anyone who cannot produce a credit card is locked out of that part of the store, including players whose adult accounts have been open for years.
The block is broader than a purchase gate. Bitdefender says players who skip the check may lose the ability to see R18+ product pages, to reach those titles in search results and store recommendations, or to complete new purchases. Games people already own still launch, according to independent tests, so the restriction lands on store access and new buys rather than existing libraries. Steam's own prompt tells users to add a valid Australian credit card and then update their Mature Content Preferences.
Valve picked credit cards over the alternatives. It did not adopt a selfie, a passport scan, or a driver's license check, even though Australia's rules permit photo-ID matching, facial age estimation, and digital ID, along with parental attestation and trusted-service age signals. No specific technology is mandated, and the regulator does not require government identification. The eSafety Commissioner oversees the Age-Restricted Material Codes, which cover R18+ and X18+ material such as adult games and apps, and also reach social media, search engines, AI services, and gaming services. Obligations under those codes are being phased in, with app-distribution age assurance starting Sept. 9, 2026, and Australian guidance directing those services to stop children downloading or buying adult apps wherever the risk of such material being available is judged medium or high.
The practical problem is who holds a card. Only about 35% of Australian adults have a credit card, and initial reports say Steam is rejecting debit cards and PayPal. Debit-linked payment methods may not qualify either. A birthday prompt alone no longer satisfies the Australian standard, and the change makes casual bypasses harder while creating a new one: a child could still use an adult's payment details, just as a false birth date once worked. Some users will stay excluded unless they obtain a credit card or the rules change.
Valve has been here before. It already used credit-card verification for mature content in the UK. The Australian framework is separate from the country's social-media rules for under-16s, which do not govern this check. The verification information is handled by the service rather than the Australian government, and eSafety guidance requires that handling to comply with privacy law.
Bitdefender warns that the change gives scammers an opening, since phishing mail and bogus Steam verification pages can look credible while a real check is being introduced. Parents are being advised to review Steam Family settings and talk through game ratings with their children. Bitdefender, which published the findings, points to its Ultimate Security product for protecting gamer accounts.
Separately, Bitdefender published a checklist ranking payment routes by risk, which came out in favor of credit cards for deals with strangers. That advice now sits awkwardly beside a store requirement that, on the 35% figure, most Australian adults could not currently satisfy.
