In order to comply with the British Online Security Act (OSA) requirements for adult content age verification, Valve, from 29 August 2025, required British Steam users to pass age certification to access adult content on the platform. According to VGC, the user needs to “acquainte” before browsing the pages of adult games stores and related community centres.
In Steam blog, Valve explains that the process requires the user to log in the account and bind a valid credit card: “If verification is successful, the user can add previously invisible adult content types to the store preference setting. “As long as the credit card remains tied, the account is considered to be “validated by age”.
Valve states: “The British Communications Authority (Ofcom), as an independent cybersecurity regulator, has confirmed in its OS Guide that credit card checks are an efficient means of age certification – since the UK requires 18 years of age and over to apply for a credit card, the issuing bank is obliged to verify the applicant’s age. Storage of credit cards as a form of payment can also effectively prevent multiple-person shared accounts from circumventing authentication.”
Currently, the binding of credit cards is the only way for British users to access the adult content of Steam. This is done through the age review process of the credit card issuer, while Valve claims that the programme “protects the privacy of the user to the greatest extent possible”, which is at the heart of the controversy, following a warning by PC Gamer that such certification would become a privacy nightmare.
The player was photo-validation using Death Landslide.
Valve emphasizes that “the data processed by the certification process are no different from the millions of Steam users who pay for stored information in a convenient manner, and do not reveal user preferences to the payer or to third parties.” This requirement effectively transfers age verification responsibilities to the banking system, and Valve does not need to process the validation process directly.
It is worth noting that the restriction only targets porn games marked as “adults only”: the PEGI 18 rating (responding to violence, etc.) is still regularly searched. The results show that after the VPN log-in to the UK node, accounts that were not tied to a credit card could still be searched for sex games, but then disappeared – an analysis shows that Steam actually imposed restrictions based on the place of registration of the account rather than the IP address.
Reddit user feedback suggests that debit cards can also be used for validation (British minors can access debit cards, but they are still not able to bypass restrictions because of their special type of account). Interestingly, Canadian-registered accounts can still access adult content even through the UK VPN, indicating that Steam actually controls on the basis of the account area rather than real-time IP.
The UK Online Security Act, which came into force on 25 July 2025, requires that “a service platform operating in the UK must achieve a safe design that provides children with a higher standard of protection than adults, while maintaining transparency and accountability of services. ” Game companies are required to comply with the law, and Valve is not the only enterprise to implement the measure. In July, Microsoft introduced age certification to British Xbox users, which is currently optional, but since early 2026, adult accounts have had to be certified to use all social functions such as voice chats and news. A petition calling for the repeal of the Online Security Bill has been signed by 530,000 people, but the Government has explicitly responded to the “No Abolition Plan” and is working with the Communications Authority to implement it as soon as possible.
