Brazil's ECA Digital: what the law says on loot boxes and age checks

Since March 17, 2026, every games publisher that serves Brazilian players works under a children's law that names a game mechanic in its text. The Digital Statute of Children and Adolescents, known in Brazil as the ECA Digital, bans loot boxes in games that young people play and requires age checks that a simple date of birth can no longer satisfy.

The questions it raises are practical ones. Which games does it reach? What exactly is a loot box in the eyes of the law? What counts as a reliable age check, and who has to run it: the game, the console or the app store? What happens to a company that ignores it, and who decides?

This guide answers them from the texts themselves: Law 15,211 as published by the Presidency of Brazil, the decree that regulates it, the decree that names its enforcer, and the older laws it builds on. It then looks at how one publisher responded and what a first court has already ordered. The texts are described as they stand in late June 2026; several of their pieces are still being completed by the regulator.

Law 15,211 of September 17, 2025, Article 35, as published by the Presidency of Brazil.

A law for every game young people can reach

Law 15,211 was signed on September 17, 2025. Its first article sets its reach: any information technology product or service aimed at children and adolescents in Brazil, or likely to be accessed by them. The definitions that follow list what that covers, and electronic games are named in the list, beside internet applications, software, operating systems and app stores.

The phrase "likely to be accessed" does most of the work. The law does not wait for a publisher to say that its game is made for children. It treats a product as within reach of young people when there is a sufficient probability that they use it and find it attractive, when it is considerably easy for them to access, or when it carries a significant degree of risk to their privacy or their security, among other risks the law lists. Any one of those three situations is enough.

The law also reaches companies based abroad. When a foreign company is fined, its Brazilian branch or subsidiary is jointly liable for the payment, according to Article 35.

The law protects two groups that Brazilian law has kept apart since 1990. The original Statute of the Child and Adolescent, Law 8,069 of July 13, 1990, defines a child as a person up to twelve years of age not yet completed, and an adolescent as a person between twelve and eighteen.

The ECA Digital uses both words together, children and adolescents, almost everywhere it sets a duty. In practice that draws the line at 18. A rule written for "children and adolescents" applies to a 17-year-old as much as to a nine-year-old, and the decree that regulates the law follows the same wording in the articles on loot boxes and age checks.

That is why a game rated 12 and up in Brazil is not outside the law. Its players aged 12 to 17 are adolescents, and the duties apply to them in full.

What the law calls a loot box

Article 2 of the law gives the loot box a legal definition, under the Portuguese name caixa de recompensa, a reward box. It is a feature of certain electronic games that lets the player acquire, for payment, consumable virtual items or random advantages without knowing their content in advance and without any guarantee that they will be useful.

Three elements make the definition: a payment, a random result and content hidden until it is opened. A cosmetic item sold at a fixed price, which the buyer sees before paying, does not meet it. A pack bought with money whose content is drawn at random does.

Article 20 then sets the ban. Loot boxes are prohibited in electronic games aimed at children and adolescents, or likely to be accessed by them, in the terms of the game's age rating.

The ban sits beside an earlier text written for the games industry. Law 14,852 of May 3, 2024 created a legal framework for the electronic games industry in Brazil. It already asked the state's indicative age rating to take account of the risks of microtransactions, the small purchases made inside a game. It also excluded from its definition of a game anything that offers bets with real or virtual prizes, or that involves random or predictive results, along with lotteries. It never used the term loot box; the ECA Digital does.

The decree of March 18

A law of this kind needs detail, and the detail came the day after it took effect. Decree 12,880 of March 18, 2026, published in an extra edition of the official gazette and in force on publication, regulates Law 15,211 and sets up a national policy for the rights of children and adolescents in the digital environment.

For games, the decree does four things.

First, it ties loot boxes to the age rating. The age range shown for a game or an app in a digital store must reflect, among other risks, its interaction features, its loot boxes, its microtransactions, the risk of excessive use and any manipulative practices. That age range must be clear, standardized and easy to find, under an act of the Ministry of Justice, and the game's terms of use must state it in Portuguese.

Second, it places loot boxes on its list of products and services prohibited for children and adolescents, with weapons, alcohol, tobacco, gambling and pornography. For the items on that list from gambling to dating services, loot boxes included, the decree tells providers to prevent under-18s from creating accounts and profiles, and to identify and remove accounts that under-18s operate.

Third, it gives game publishers a choice of routes, in Article 23.

Fourth, it hands supervision to the regulator. The same article tells the ANPD, the national data protection authority, to supervise the child-safety duties that the 2024 games framework already set, in line with the principles of the ECA Digital.

What counts as a reliable age check

The core rule is in Article 9 of the law. A provider whose content, product or service is improper or prohibited for under-18s must take effective measures to keep them out, and its first paragraph requires reliable age verification at each access. Self-declaration is ruled out: ticking a box or typing a date of birth no longer meets the duty.

The decree turns that into vocabulary. It uses age assurance as the general term for the procedures that verify, estimate or infer a person's age or age range, directly or indirectly. Age verification is the stricter form: a specific procedure with a high degree of reliability that confirms the declared age or age range through technical or documentary means. Self-declaration is limited to an age, an age range or another personal detail given by the user, with no further evidence.

The decree also lists principles any method must respect, among them proportionality between the solution chosen and the risk of the service; accuracy, robustness and reliability; and data minimization. Data gathered to check an age cannot be used to build a behavioral profile, and the image or copy of an identity document must be deleted immediately and irreversibly once the age is confirmed. A user must be able to contest an age estimate or a verification.

The law itself adds one more safeguard: data collected to check an age may be used for that purpose only.

Stores, consoles and the age signal

A game is rarely reached directly. It is downloaded from an app store or launched from an operating system, and the law gives those gatekeepers duties of their own.

The age signal is the key mechanism. Under Article 12 of the law, stores and operating systems provide an interface that passes an age or an age range to the apps, while protecting privacy. The decree adds that the signal is free, carries only the minimum age information needed, and never includes an exact date of birth, an identity or profiling data.

The signal does not discharge the game. Article 14 of the law asks providers to build their own barriers against improper content regardless of what stores and operating systems do, and the decree states that receiving a signal does not relieve a provider of its responsibility for effective protection. When a provider's own check and the store's signal disagree, the provider applies the more protective of the two. A game reached through a web browser must verify age too, though it may rely on a signal from the operating system, the store or another provider.

Parents, purchases and chat

The law's second pillar is parental supervision. Articles 17 and 18 require tools that are easy to find and use, explained clearly, with visible warnings when they are active, and default settings at the highest level of protection. Parents must be able to manage privacy settings, restrict purchases and financial transactions, see consolidated figures for time spent, and identify the adult profiles a child communicates with. Interfaces designed to compromise a user's autonomy, decisions or choices are prohibited.

Games with chat are treated separately. Article 21 applies to games where users exchange messages or content, and it refers back to the 2024 games framework, whose Article 16 already listed safeguards such as a channel for complaints, a way to contest decisions, terms of use that ban harmful practices and an option to switch interaction off. Under the ECA Digital, interaction between users in such games is limited by default, so that it depends on a parent's consent.

Purchases had a default of their own before the new law. Article 17 of the 2024 framework requires in-game purchase tools to restrict transactions by children by default, so that a parent's consent is needed.

Advertising closes the circle. Article 22 of the ECA Digital prohibits profiling techniques used to target commercial advertising at children, and Article 26 forbids building behavioral profiles of young users for advertising, including from age-check data.

Penalties and the regulator

Article 35 of the law sets four sanctions, without prejudice to civil, criminal or other administrative liability. The first is a warning, with up to 30 days to correct the problem. The second is a fine of up to 10 percent of the economic group's revenue in Brazil in its last fiscal year; where no revenue figure exists, it is counted at R$10 to R$1,000 per registered user, capped at R$50 million per violation. The third is a temporary suspension of activities, and the fourth a prohibition of them. Whoever sets a sanction weighs the seriousness of the breach, whether it is a repeat, the company's economic capacity and the social impact.

The two kinds of sanction have two different authors. Warnings and fines are applied by the autonomous administrative authority for the protection of children and adolescents in the digital environment; suspension and prohibition are ordered by the courts.

The law does not name that authority. Decree 12,622, dated the same day as the law, gives the role to the ANPD. The law provides that a court's suspension or prohibition, when the company does not carry it out itself, is enforced by blocking orders, and the same decree organizes them: Anatel, the telecommunications regulator, receives the orders and passes them to the providers that connect users to the internet.

How the law reached March 17

The date on which the law took effect was itself changed along the way. Its final article, as first inserted by Provisional Measure 1,319 of September 17, 2025, set the start at six months after publication. Law 15,352 of February 25, 2026 replaced that with a fixed day: March 17, 2026.

The regulator's own texts are still arriving. On May 22, the ANPD opened a call for input on a guidance document on age assurance mechanisms, open until July 9 on the federal government's participation platform. The guide is meant to update the preliminary guidance the authority published in March 2026, and it covers the core concepts of age assurance, the chain of responsibility in the digital ecosystem and specific requirements for technical solutions such as facial estimation and document checks. The decree, for its part, leaves the ANPD to set the stages in which age assurance is rolled out, with priorities based on the level of risk for children and adolescents.

How one publisher responded

Riot Games set out its answer in public a week before the law took effect. In a notice dated March 10, 2026 on its Brazilian news pages, it said it was temporarily raising the age rating of five of its games to 18 in Brazil, League of Legends among them. Adults were asked to verify their age, players under 18 had their accounts paused from March 18, and Valorant stayed open to players aged 12 to 17 with a parent's consent. Riot said it aimed to return its games to their original ratings by early 2027.

The notice does not mention loot boxes and gives no reason for choosing those five games. It predates the decree by eight days, and it goes further than any of the decree's three routes require: rather than block one feature for under-18s, it closes the five games to them for now.

What the courts are already doing

The statute is not the only route to a sanction. On June 16, 2026, the Court of Justice of the Federal District and Territories announced a first-instance judgment of its 1st Children and Youth Court against Riot Games Serviços, the publisher's Brazilian subsidiary, in a civil public action brought by the child-rights association ANCED. The court ordered R$15 million in collective moral damages over the loot boxes sold in League of Legends, and four measures on the boxes within 90 days of the judgment becoming final, under a daily fine of R$100,000. The decision can be appealed.

Its reasoning did not rest on the new law: the judge held that the prohibition already followed from older texts, the 1990 statute and the Consumer Protection Code among them.

That is the point for every publisher. Loot boxes in Brazil now face two separate tracks: the administrative sanctions of the ECA Digital, applied by the ANPD and the courts, and civil actions under older child and consumer law, which can reach conduct from before March 17.

What remains open

Several pieces are not yet in place at the end of June 2026. The ANPD's guide on age assurance is in consultation until July 9, and the standards it sets for a reliable verification will decide which methods meet the law. The Ministry of Justice is to set by its own act how age ranges are displayed in stores, and a civil society committee to follow age ratings is to be created the same way. The Riot judgment can still be appealed. Riot's own target for restoring its original ratings is early 2027.

What is settled is the frame. A paid, random, hidden-content feature is a loot box under Brazilian law; it is banned in any game aimed at or likely to be accessed by under-18s; and a publisher that keeps it must keep young players away from it with a check that a typed birthday cannot pass.

The .esports registry publishes Esports Observer, so the whole scene can read its news for free.