Loading story…
Valve has begun requiring Australian Steam users to verify they are at least 18 before purchasing online games and applications, complying with an Australian requirement that took effect on September 9. Steam relies on bank-card verification rather than government identification or biometrics; Mastercard's age-assurance service can return an adult-status result without providing the merchant with the customer's date of birth.
In practice, credit cards are the most consistently accepted method, while debit-card eligibility varies by card network and whether an issuer labels the product as adults-only. Users report failed debit-card checks, and Steam does not accept PayPal, account age, or purchase history as alternatives. The approach may prevent many legitimate adults—particularly younger customers with low credit-card adoption—from accessing R18+ titles, unlike PlayStation and Xbox, which offer multiple verification options.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Valve implemented age verification for Australian Steam users seeking to purchase or access age-restricted games, using bank-card verification rather than government identification or biometric data. Credit cards generally pass the check, while debit-card eligibility depends on the card network and whether the issuer designates the product as adults-only.
Australian law began requiring an over-18 age-verification step for online application and game purchases.
Mastercard introduced a global age-assurance capability that can tell a merchant whether a cardholder is an adult without disclosing the cardholder's date of birth.
Australian requirements for online gaming services to verify that users are at least 18 before allowing access to R18+ games came into force.
Users reported that some Mastercard debit cards from Commonwealth, Westpac, and Macquarie worked for Steam age verification, while cards from Bendigo, St. George, Revolut, ANZ, and most Visa cards appeared to fail. Users requested alternative verification methods, and Valve had not confirmed plans to add them.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourceghacks.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple introduced expanded *age assurance* capabilities for the App Store to support compliance with new or emerging regulations in multiple jurisdictions, including Brazil, Australia, Singapore, Utah, and Louisiana. As of **Feb. 24, 2026**, Apple began blocking downloads of **18+ rated apps** in Brazil, Australia, and Singapore unless the user is confirmed to be an adult, using what Apple describes as “reasonable methods” for age confirmation. Apple also expanded the **Declared Age Range API** (iOS/iPadOS/macOS) and related platform components (including PermissionKit’s *Significant Change API*, a new StoreKit age-rating property type, and App Store Server Notifications) to provide developers with an age category plus signals about the assurance method and whether regulatory requirements apply; in Brazil, certain disclosures (e.g., loot boxes) can drive an app’s rating to **18+**. Broader policy debate continues around online age assurance in the U.S. and internationally, with jurisdictions adopting or considering stricter mandates and platforms preparing new verification requirements. Public skepticism remains elevated due to backlash against age-gating (including reported VPN usage spikes in response to the UK’s requirements) and concerns about data security following breaches at age-verification providers (e.g., **Sumsub** disclosing a previously undetected 2024 compromise). The policy environment is also being shaped by U.S. state laws and litigation, including the Supreme Court’s decision in *Free Speech Coalition v. Paxton* upholding Texas’s age verification law, while proponents argue that privacy-preserving age assurance approaches are becoming more technically mature and scalable.
Jun 29, 2026
Discord has begun a global rollout of age assurance that classifies users as adults, teens, or unconfirmed and automatically applies age-appropriate access restrictions. The company says more than 90% of users should not need to actively verify their age; adults who are misclassified can use an eligibility-confirmation process to regain access to age-restricted content. The deployment builds on Discord’s earlier global **teen-by-default** safety settings. The rollout replaces Discord’s February proposal to require facial age estimation or government-ID scans before users could enter age-restricted spaces. Discord revised the approach after substantial privacy backlash, sharpened by a 2025 compromise at a third-party verification provider that exposed government IDs for 70,000 Discord users in the UK and Australia. Organizations should note the reduced reliance on explicit identity checks but continue to assess how Discord’s age classification and appeal processes affect employee, community, and youth-safety use cases.
Sep 25, 2026
**Discord** announced a phased global rollout requiring users to verify their age using **video selfies or government IDs**, citing growing regulatory pressure for age checks on social platforms and a goal of providing a “teen-appropriate experience by default.” Discord said the verification data will be **deleted immediately after age is confirmed** and claimed it **will not leave the user’s device**; the company also described new defaults that restrict access to age-gated features (e.g., blurring sensitive content and limiting age-restricted channels/commands to verified adults). The rollout is expected to begin in early March, following earlier “teen-by-default” measures introduced in the U.K. and Australia. The policy change triggered backlash in gaming communities due to privacy and breach concerns, amplified by a prior incident in which **roughly 70,000 images of government IDs** were exposed after users had uploaded them for customer service purposes; reporting attributes the exposure to a **third-party service** Discord used to manage data. Discord is attempting to reassure users by pointing to tightened controls and a partnership with *k-ID* for age checks, but critics highlighted perceived ambiguity in how ID scans may be handled (including potential uploads to vendor servers and involvement of additional third parties), and warned that expanding collection of sensitive identity data increases the platform’s attractiveness as a target.
Jun 29, 2026