From late August, an adult in Australia who wants to buy a game rated 18+ on the Microsoft Store or the Xbox Store has to prove their age to a verification company first, and an account that gets declined gets locked out of buying or downloading any 18+ title.
Microsoft sent the notice to Xbox consoles and to email accounts over the weekend. "As part of our compliance program in Australia, beginning late August 2026, adult Xbox accounts must verify their age to be able to access apps and games rated 18+ on the Microsoft and Xbox Store," it reads, and games already owned are not touched.
An account that skips verification is "treated as unverified," and the holder "won't be able to make any new purchases or downloads of games and apps rated 18+." Microsoft names two partners for the check. Verifymy, a British company, runs the email-based estimate, and Yoti handles the other routes, a selfie the software reads to guess how old you look, a credit card, or a government ID such as a driving license or passport.
The duty traces to Australia's Online Safety Act, through the eSafety Commissioner's Age-Restricted Material Codes. eSafety says app stores "must take appropriate steps to prevent users who are under 18 from purchasing or downloading apps rated R18+." A store which does not already know a customer's age "may be asked to confirm it through age assurance."
Australia has already run this experiment and by its own government's headline measure it failed badly. A study in the British Medical Journal followed 408 teenagers and found that an estimated 85 percent of Australians aged 12 to 15 were still logging on three months after the country's under-16 social media ban supposedly cut them off. Two-thirds got through by declaring themselves over 16 or posting a selfie the platform accepted.
The country is now dragging age checks into gaming while the data from its flagship scheme says the method does not stop the children it names. All adults get checked, and the children the rule was written for are, on the evidence, still playing.
What Yoti does with a face or a passport once it holds one is not spelled out on Microsoft's page, and that silence is what an adult is being asked to trust. Microsoft says any uploaded data is encrypted, kept from the company, and deleted after the check. The record for this kind of collection is not reassuring. A 2025 Discord breach exposed 70,000 government photo IDs. Security researchers claimed in February that another provider, Persona, was lax with information security and did more than verify ages.
On the evidence already in, none of it works as a barrier. What it reliably produces is a mass of adults' faces and documents, handed over before they can play.
