Steam UK Age Verification: Credit Card Only, No Selfie Scan

Valve had permission to scan your face to check your age. It said no, and chose your credit card instead. That choice protects your privacy, but it also locks out roughly nineteen million adults in the U.K.

If you've ever uploaded a selfie or a driver's

If you've ever uploaded a selfie or a driver's license to prove you're old enough for something online, this touches you. And if that made you uneasy, good instinct. Handing over your face or your I.D. to a company you've never heard of is a real risk. Steam's choice is a rare attempt to avoid that risk. But it comes with a price that has nothing to do with privacy. So how does a credit card prove your age, and who gets left out?

Start with the law. In the U.K., the regulator Ofcom requires platforms to check that people are adults before showing mature content. Ofcom calls credit card checks one highly effective way to do that. The reason is simple. You have to be eighteen to get a credit card in the U.K. And banks are required to verify your age before they issue one.

So the bank has already done the hard part. Steam never looks at your passport. It never sees your face. It just confirms that a valid credit card exists on your account. The card itself stands in as proof.

Picture a nightclub with two ways in

Picture a nightclub with two ways in. At the first door, you hand a selfie to a stranger with a clipboard. He runs it through an age-guessing system, and waves you in. Now that stranger has your face. At the second door, you show a credit card. The doorman calls the bank and asks, is this real, and is it held by an adult? The bank says yes. You keep your face. Steam built the second door.

Why does that matter? Because the first door has a track record. According to reporting on a breach tied to a vendor that worked for Discord, attackers got at least seventy thousand images of government I.D.s. Passports and driver's licenses, collected to satisfy the same U.K. age law. Separately, an identity-verification company called IDMerit left about a billion records open on the public internet. Names, birth dates, national I.D. numbers. No password needed.

That's the risk when a middleman collects your most sensitive details. Most of us never chose that middleman. We just clicked through.

A common reaction is, my card's already on Steam,

Now, a common reaction is, my card's already on Steam, so what's new? It's a fair thought. Lots of us store cards for convenience, so it feels like the same thing.

But the job of that card has changed. Your account counts as age verified only while a valid credit card stays on file. Delete the card, and you lose verification. Steam also says that stored card helps discourage people from sharing one account among several users. So the card is no longer just a way to pay. It's evidence of your legal status. If those servers were ever breached, that's a different kind of exposure than a list of purchases.

Is Steam typical? Not at all. The AgeCheck Index tracked more than sixty-nine million age checks across thirty-two U.K. services in the second half of twenty twenty-five. The method most often offered was facial age estimation. Not credit cards. Steam went the other way.