In March, videogames will no longer be able to sell lootboxes to users under the age of 18 in Brazil due to a ban signed earlier this month by Brazilian president Luiz Inácio Lula da Silva. Part of a broader law passed by Brazil’s congress to enact online safety measures for children, the ban continues an ongoing international effort to regulate exploitative monetization practices (via Eurogamer).
The law, Lei 15.211/2025, aims to defend “the best interests of children and adolescents,” which it defines—according to machine translation—as “the protection of their privacy, safety, mental and physical health, access to information, freedom to participate in society, meaningful access to digital technologies, and well-being.”
Chapter 7 of the law says that “loot boxes offered in electronic games aimed at children and adolescents or likely to be accessible by them are prohibited, in accordance with the respective age rating.”
Related articles
Additionally, the law mandates that games featuring “interaction between users through text, audio or video messages” must comply with guidelines established by a separate law passed in 2024, which requires companies to moderate “abuse and irregularities committed by users” and provide transparency for how their moderation systems are used, maintained, and updated.
Brazil isn’t the first country to attempt to regulate loot boxes, and likely won’t be the last. Belgium banned loot boxes—with varying degrees of success—in 2018, while US lawmakers, Dutch political coalitions, and members of Australian parliament have proposed their own bans on loot boxes as a form of digitized gambling.
For those protections to have any effect in Brazil, however, they’ll necessitate the usage of age-verification mechanisms. Previously, Brazilian law had considered it sufficient for users of digital services to self-declare their age. The new law, however, requires the providers of those services to “take proportionate, auditable and technically secure measures to assess the age or age range of users.”
While the law states “data collected to verify the age of children and adolescents may be used solely for this purpose, and its processing for any other purpose is prohibited,” similar age verification measures have been the source of privacy concerns as online safety legislation has advanced in the UK, Australia, some US states, and elsewhere.