Australia Calls Out Valve: Steam's Kid-Safety Tech Is the Worst of the Big Four

Here's a sentence I did not expect to write this week: the biggest shop in PC gaming runs the shoddiest child-safety operation of the lot. Not alleged. Not whispered by rivals. Published — in a regulator's report that reads less like a filing and more like a charge sheet. On Friday, Australia's eSafety Commissioner Julie Inman Grant named names: Valve, the company behind Steam, was the only major gaming platform examined that does not use the industry's standard technology for detecting known child-abuse material. Roblox, Fortnite and Minecraft each took their lumps. But Valve? Left standing alone in the corner.

The title is Playing it safe: how online game services are (or are not) keeping kids safe online. Read that parenthetical twice — it is the whole story in nine words. It rests on compulsory notices eSafety issued on 1 April 2026 under section 56(2) of the Online Safety Act 2021, covering how the four services behaved between October 2025 and March 2026. Now, the number that turns this from an industry footnote into something bigger: roughly nine in ten Australian children aged 8 to 17 play online games, the regulator says. "Australian children have a right to play online without being exposed to predators, sexual extortionists, violent extremist content or other harmful material," Inman Grant said in a statement. And then the kicker: "We expect these services to lift their game to identify and combat serious harms such as child sexual exploitation, sexual extortion and material and activity which promotes, incites or instructs violence." "Lift their game." Characteristically Australian politeness. The report itself is not polite at all.

Photo: A child playing with a video game console at home. Credit: Nenad Stojković, via Wikimedia Commons (CC BY 2.0).

Valve's shame file: no hash-matching, no chat scanning

The most damning finding isn't about something Valve did. It's about something it never bothered to do. Hash-matching — comparing the digital fingerprint of an uploaded file against databases of known child sexual exploitation material — is, by the report's account, standard practice across the industry. Every assessed provider used it. Except Valve. One holdout. Guess which one.

Steam Chat, meanwhile, had no proactive detection of child sexual exploitation or violent content in text or voice chats, including community group chats. The one automated guardian watching those conversations, the report found, was a URL-detection tool whose main job was blocking scams. Picture that for a moment: on one of the world's largest gaming chat networks, the machine watching the room is trained to catch phishing links, not predators.

Valve's language-detection models, like Roblox's, were trained only on internal datasets and were not retrained regularly, the report says. And where other companies shared expertise with the industry on combating child exploitation and violent extremism, Valve shared nothing. The privacy argument will inevitably be raised in Valve's defence — nobody wants their chats read — but it is the same tightrope the industry keeps walking elsewhere. Meta is currently litigating it in public over whether its AI assistant reads private messages. The uncomfortable question for Valve is why its competitors manage to run both scam filters and safety tooling, while Steam apparently cannot manage the second.

Age checks a child could fool

If Valve's detection gap was the headline, the age-assurance findings were the slow-burn scandal. Minecraft and Fortnite, the report found, generally relied on self-declared age — meaning anyone who claimed to be 18 could unlock what the regulator calls "higher-risk communication features". It is the digital equivalent of a bouncer who accepts "trust me, I'm 21".

Steam? Same story — self-declaration through the assessment period, though the report does credit the platform for adding credit-card age checks since. Roblox tightened its age checks in December 2025, a claim that lines up with eSafety's own February statement that Roblox had delivered on the safety commitments it made at the end of that year. Fine. Nobody got a gold star. The regulator's tone throughout was, shall we say, unimpressed — and who could blame it. When your verification system is a dropdown menu, that is not a safety control. That is a marketing feature.

Epic, to be fair, did the serious thing on Fortnite: every "Island" got reviewed before it went live. Pre-publication review — the gold standard for user-generated content, and the one approach nobody in this report had a bad word for.

Roblox went the other way — it scans user-created "Experiences" after they go live, with automated tools. And the report, as carried by two outlets, says those tools aren't exactly catching everything: image auto-moderation had a recall rate of just 51% for violence and child sexual exploitation material. A coin flip. Roughly half of what it was supposed to catch slipped through. Minecraft had its own loophole: anyone who'd declared themselves an adult could wander onto third-party servers that Mojang didn't proactively moderate. At all.

The moderation numbers that should worry parents

Now, the numbers that should genuinely worry parents. Two of the report's most granular findings come with a caveat — only a single outlet's account of the report carries them, so treat them as provisional, not settled. Flag raised. Here they are. Epic Games reportedly took an average of up to 18 hours and 53 minutes to assess certain automated reports involving unconfirmed child sexual exploitation and abuse material, and its global specialist investigative team comprised just five full-time and three contracted investigators. Valve, meanwhile, reportedly had no dedicated trust-and-safety staff at all beyond content moderators and engineers.

We cross-checked every other claim in this article against at least two independent outlets before printing it, and flagged the two findings above precisely because only one source carried them. That is how thin the public record still is: the regulator published its conclusions, but the companies' own responses have barely surfaced. Valve, Epic Games and Microsoft did not respond to requests for comment carried in the coverage we reviewed; Roblox, in a statement carried by one outlet, said it prioritised the safety of its Australian community, particularly its youngest users. The silence from the rest is its own kind of answer.

What Australia can actually do about it

Naming and shaming only works if the shame has teeth — and right now, the framework is softer than it sounds. eSafety assesses gaming services against the Basic Online Safety Expectations. Expectations, note. Not hard rules. It can issue compulsory reporting notices, which is what happened here, and where it finds actual non-compliance with the Online Safety Act it can chase civil penalties: in a February statement on its Roblox investigation, eSafety flagged penalties of up to $49.5 million as being on the table. Real money. But the rulebook is being rewritten as we speak.

Parliament passed the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026 in September, pushing maximum civil penalties to $99 million and giving the Commissioner broader powers to compel documents instead of just accepting whatever self-reporting the companies feel like handing over. Then there's the bigger one: exposure-draft legislation for a digital duty of care, which would junk the co-regulatory model for a direct statutory obligation on platforms — games, apps and AI chatbots included — to keep users safe "so far as is reasonably practicable". Breach that and you're looking at up to A$109.2 million. Communications Minister Anika Wells, in a statement, reached for the simplest analogy she could find: "Just as we have basic safety standards for cars, toys or food, the duty of care applies basic standards for the online products we use every day." Cars. Toys. Food. And now, your kid's game lobby.

Photo: Parliament House, Canberra, at dusk. Credit: Ted Hennicke, via Wikimedia Commons (CC BY-SA 4.0).

Why this matters beyond Australia

This report did not arrive in a vacuum. Last December, Australia launched its world-first social media ban for under-16s — a law that pointedly excluded gaming platforms, on the theory that games were a different beast. Friday's report is the regulator's answer to that theory: the different beast has the same predators. Canberra has also been pushing to force tech giants to let users opt out of algorithmic feeds, and its proposed duty of care would sweep in AI chatbots and recommender systems — the class of software whose real-world failures keep making headlines, from OpenAI's rogue agent onward.

The contrast with the United States is stark. While Canberra arms its regulator with nine-figure penalties, California just watched Governor Gavin Newsom kill America's first landmark AI safety bill — and Washington has nothing resembling an eSafety Commissioner at all. American parents get terms of service; Australian parents get a regulator with compulsory notices and a public charge sheet. For US readers, the awkward question is which approach their children deserve.

None of this is new, and that is the point that lands hardest. eSafety did this dance before — in 2022 and 2023, on the child sexual abuse file. Same drill, same list of names: Apple, Google, Meta, Microsoft, Discord, Snap, Skype, WhatsApp. Every one of them answered. Every answer got published. It worked. Not perfectly, not instantly — but the answers came out, and the companies moved. Why would this round be any different?

Our take: Valve knew better

Say it straight: the company that runs PC gaming's biggest storefront — the one that takes a cut of nearly every game sold — ships the worst abuse detection in the business. No excuse survives contact with that sentence. This is not a scrappy startup pleading limited resources. Valve is one of the most profitable private companies in tech, and its child-safety tooling, as described by Australia's regulator, is shoddy: no hash-matching, no proactive chat scanning, no shared intelligence, models trained in-house and left to rot. The hash-matching gap is the smoking gun. It is a solved problem — databases, APIs, and off-the-shelf tooling exist precisely so that no platform has to reinvent this wheel — and Valve simply did not bother.

Roblox and Epic do not escape either. A 51% recall rate on image moderation is a coin flip with children's safety, and an 18-hour response time on exploitation reports is an eternity in which harm compounds. But Valve's singularity is what should end the industry's favourite excuse — that safety at scale is just too hard. Three of the four biggest gaming services manage it. The fourth chose not to. Read that sentence again. Inman Grant's demand that they "lift their game" was characteristically Australian in its politeness. The report itself is not polite at all. Neither should the response be.

Sources: this article drew on reporting by BBC News, the Britain Herald, NewsATW, the Geneva Times, NeoTeo and Bars Across on the eSafety report of 2 October 2026; eSafety's February 2026 media statement on its Roblox investigation; and analysis by Biometric Update, Pinsent Masons and Herbert Smith Freehills Kramer of Australia's Online Safety Amendment Bill 2026 and the proposed digital duty of care.

By Daniel Rao, TechPulse USA

Daniel Rao covers AI, labor economics and US technology policy for TechPulse USA.