This implementation of age verification by Valve is at-best so poorly considered that I expect them to re-evaluate soon. The first issue is that they want the card on-file. I purchased a game for my child on Monday, using a Credit Card. So, I obviously have a credit card. I didn't keep the card on-file, I used it for a single purchase. My Steam account is still age-locked.
I will concede that 'age of account' alone isn't too good of a test - I created a Steam accounts for my kids when they were little (2 and 5). The oldest has started using his account, the youngest will probably start next year. XBox used account activity - and that's a better test. Having 15 years of gaming history is a better test than a 10-year-old account that only started seeing regular use 2 years ago.
Because I know far too much about these age verification laws (for obvious reasons), I can also attest that Valve is not complying with the Age Verification as outlined in Regulatory guidance. If you are willing to go through the document, the relevant section is:
2.3.3 Accessible, inclusive and fair
Providers should ensure age assurance methods and surrounding systems and processes are accessible, inclusive and fair.
That same section also goes on to give advice on verification means, saying it should not discriminate end-users based on pretty-much any metric you can think of. They especially call-out discrimination against Aboriginal or Torres Strait Islanders. A demographic where the majority of citizens do not have credit cards. They also fail to follow the guidance "Providers should offer a choice between a range of age assurance methods".
Valve wrote to the eSafety commissioner a year ago, requesting to be exempt from the law. They were denied. Assorted sites are claiming that eSafety Commissioner's office is engaging with Valve (example), though I haven't found anything on their website to acknowledge that. In short, Valve are not presently complying with the law and something will need to give.
I called their age verification implementation "poorly considered", because I actually think they're being intentionally belligerent. I suspect they are hoping the government is going to back down. I don't know how that's going to play out, or how the eSafety commissioner is going to respond. I don't know what 'big guns' the government has here. This case is fascinating to observe from the side-lines.
all 51 comments