Starting next March in Brazil, users under the age of 18 will not be able to purchase loot boxes in video games, a ban stemming from a decree signed by Brazilian President Luis Inasio Lula da Silva earlier this month.As part of a broader bill passed by Brazil’s parliament, the bill aims to create cybersecurity measures for children, the ban is part of the ongoing international efforts to regulate exploitative monetization.
The bill, numbered 15.211/2025, aims to safeguard the “best interests of children and young people”. The bill defines the “best interests” as “protecting their privacy, security, physical and mental health, the right to access information, freedom to participate in society, the opportunity to effectively use digital technology, and the well-being”.
Chapter VII of the Act provides that “the provision of loot boxes in video games targeting children and teenagers or may be exposed to by corresponding age ratings.”
In addition, the bill mandates that games that include the “user interacts through text, audio or video information” feature must comply with the guidelines set out in another bill passed in 2024.The guidelines require companies to regulate “user-implemented abuses and violations” and remain transparent about the use, maintenance and updates of their regulatory systems.
Brazil is not the first country to try to regulate trophy boxes, and it is likely not the last.Belgium issued a ban on trophy boxes in 2018, and its implementation effects vary; at the same time, U.S. lawmakers, Dutch political parties and Australian lawmakers have all proposed their respective trophy boxes bans, defining it as a form of digital gambling.
However, for these protections to really work in Brazil, an age verification mechanism must be used.Previously, Brazilian law believed that it was enough for digital service users to declare their own age.But the new bill requires that providers of these services must “take moderate, auditable and technically secure measures to verify the age or age of the user.”
Although the bill stipulates that “data collected to verify the age of children and adolescents can only be used for this purpose and it is prohibited for data processing for any other purpose”, similar age verification measures have raised privacy concerns in the process of advancing cybersecurity legislation in the UK, Australia, some states and other regions of the United States.
