Brazil's loot box ban: what the ECA Digital means for kids' games

Hey, everyone!

The past few months have been loud around Brazil's new ECA Digital (Law 15,211/2025), nicknamed the "Lei Felca" (Felca Law) after the Brazilian influencer Felipe Bressanim Pinto, whose viral August 2025 video on child protection online pushed the bill across the finish line. On Reddit, TikTok, and Discord, the dominant narrative quickly became "the government is banning games." At the same time, Rockstar Games pulled its storefront out of Brazil, Riot Games blocked League of Legends for minors, and several publishers started reviewing their Brazilian operations. It looks like chaos.

As president of ASCJogos and co-founder of Truth and Tales (a studio that builds learning games for kids), I want to tell the other half of the story. The law is not perfect. But for anyone familiar with how the games industry monetizes products aimed at children, what the ECA Digital actually regulates is what should have been regulated a long time ago.

In this post I'll walk through, without alarmism and with data on the table:

• What the ECA Digital says about games (only the games portion, the other topics belong elsewhere)

• How "free" games actually make money

• Why loot boxes are, in fact, slot machines in disguise, with scientific studies to back it up

• The Roblox case and the problem of unregulated monetization

• What Brazil borrowed from Belgium, South Korea, China, and Australia

• Where the law could have been better

If you still disagree at the end, that's fine. But at least you'll disagree with information.

➔ A quick primer on Brazil

Before we go further, a short geography lesson for readers who aren't Brazilian. Brazil has three levels of government: federal, state, and municipal. Laws passed by the National Congress in Brasília apply across all 26 states plus the Federal District. The ECA (Estatuto da Criança e do Adolescente, Child and Adolescent Statute) is Brazil's foundational 1990 law protecting the rights of people under 18. The ECA Digital is a 2025 update that extends those protections into the online world, including social media, advertising, and yes, video games.

➔ The ECA Digital in 30 seconds (games portion only)

Law 15,211, of September 17, 2025, became popularly known as "Lei Felca" after the influencer Felipe Bressanim posted a viral video on child safety online in August 2025. The video accelerated a bill that had already been moving through Congress for quite some time, which is why some parts of the text are more polished than others.

The law took effect on March 17, 2026 and covers many topics: social media, gambling platforms, adult sites, children's advertising, online content. It's not a "games law." It's a children's digital-protection law that happens to have, among its many chapters, specific requirements for the games industry.

And those requirements do not include "banning games." The Brazilian federal government publicly clarified exactly this. What the ECA Digital regulates in the games segment is very specific: paid loot boxes, effective age verification, mandatory parental controls, restrictions on profiling of minors, and design elements aimed at manipulating them. That's it. GTA 6 is launching normally. Steam still works. Your indie studio can still sell games.

To stay focused, I'll cover only what affects the games industry here. The other parts of the law belong in other conversations.

➔ Before the controversy: how a "free" game actually makes money

To understand why this law makes sense, I need to open the black box of free-to-play monetization.

When a studio publishes a free mobile game, it's essentially managing two variables:

• CAC (Customer Acquisition Cost): how much it costs, in advertising, to bring a new player into the game.

• LTV (Lifetime Value): how much money, on average, that player will spend in the game over time.

The math is simple: if LTV is greater than CAC, the model is profitable. If LTV is lower than CAC, the studio shuts down. Everything else in the game's design serves to maximize that gap.

Here's the uncomfortable part: in free-to-play, the vast majority of players pay nothing. Industry data, repeated in reports from Swrve, GameAnalytics, AppsFlyer, and Newzoo over the past decade, consistently shows that somewhere between 1% and 5% of players generate more than 50% of revenue in most free-to-play games. In extreme cases, less than 0.2% of players produces more than half the revenue.

These very-high-spending users have a name in industry slang: "whales". And everything about the game, from offer prices to the color of buttons and the frequency of pop-ups, is designed to maximize extraction from them. The term "whale hunting" is used openly at monetization conferences.

When the player is an adult, with emotional self-control, their own income, and the ability to walk away, this dynamic is already questionable but ultimately it's a choice. When the target user is an 8-year-old with their parent's credit card on file, "just don't spend" stops working. The child doesn't have the maturity to understand what they're buying, the social pressure inside the platform is enormous (friends with rare items, in-game status), and the psychological mechanisms at play are, literally, the same ones used by slot machines.

That's the backdrop for everything that follows.

➔ The Roblox case: what happens when monetization has no rules

Roblox has roughly 144 million daily active users worldwide. About 35% of verified users are under 13, and another 38% are between 13 and 17. It's one of the most popular platforms on the planet for kids.

The model is different from most: anyone can create an "experience" (a mini-game inside Roblox) and monetize it using Robux, the platform's currency. This looks democratic, and in many ways it is. But when you leave monetization almost unregulated in the hands of thousands of independent creators, in an industry that deeply understands behavioral psychology, the outcome is predictable: practices that would be forbidden on Steam, the App Store, or Google Play show up, especially when directed at children.

Absurd cosmetic prices. Aggressively pay-to-win mechanics. Loot boxes inside experiences played mostly by kids. Currency conversion layers that hide the real cost (you buy Robux with real money, which buys that specific game's internal currency, which only then buys the item). Anyone familiar with ethical monetization who spends a few hours on the platform recognizes the patterns.

Anyone who works in game design knows: when you remove the guardrails, the race to the bottom is inevitable. Not because developers are bad people, but because the platform rewards whoever extracts the most and punishes whoever doesn't.

We wrote about Loot Boxes at Truth and Tales blog a while ago, back when the topic hadn't yet become front-page news. Concern about the mental health of children exposed to these mechanisms is not new in the scientific literature, or in the community of developers who care about ethics.

➔ Loot boxes are slot machines, and the science has proven it

Now we get to the core of the ECA Digital: random reward boxes, or loot boxes.

A loot box works like this: you pay a fixed amount (in real money, or in premium currency bought with real money) to receive an item whose identity is only revealed after purchase. Some items are common, others are rare. The rare ones are the ones you actually want.

If that sounds like a slot machine, it's because the structure is literally the same: fixed payment, random outcome, variable reward with occasional "jackpot" moments. These are the same principles of variable-ratio reinforcement studied by B.F. Skinner in the 1950s. The same principles that make casino machines work.

The scientific literature is solid. The most cited study in the field, "Video game loot boxes are linked to problem gambling" by David Zendle and Paul Cairns (PLOS ONE, 2018), with more than 7,400 participants, found a statistically significant correlation between loot box spending and problem-gambling symptoms. Follow-up studies by Zendle, Drummond, Sauer, King, and other researchers have replicated the finding across different countries and populations.

When the focus narrows to adolescents, the results get more alarming. Systematic reviews published in journals like the Journal of Behavioral Addictions and Acta Psychologica have concluded that young people who buy loot boxes show higher rates of gambling-disorder symptoms than peers who don't, with effect sizes comparable to direct exposure to gambling.

In Brazil, academic articles like "Loot boxes in electronic games used by children and adolescents" (UNIPAR Journal of Legal and Social Sciences) and "The need to regulate online games and in-app purchases for the protection of children and adolescents" (Caderno de Direito da Criança e do Adolescente) were already addressing this before the law passed. The Brazilian academic debate predates the popular pressure.

In 2022, the Norwegian Consumer Council published the report "INSERT COIN: How the gaming industry exploits consumers using loot boxes", endorsed by 20 consumer-protection organizations across 18 European countries. The document details how loot box mechanisms exploit well-documented cognitive biases: loss aversion, illusion of control, near-miss effect, layered currencies designed to obscure real-world cost.

A concrete example from the report: to get Mbappé's Team of the Year card in FIFA 22 (one of the rarest items in Ultimate Team), a player would need to buy, on average, 847 "jumbo rare player packs". In real money, that lands somewhere between US$ 200 and US$ 400. And FIFA is a game played by children around the world.

On the strength of this evidence, several countries acted before Brazil did:

• Belgium (2018): the Belgian Gaming Commission declared paid loot boxes illegal, classifying them as gambling. FIFA, Overwatch, CS:GO, and others had to remove or alter the mechanic in the country.

• Netherlands (2018): the Kansspelautoriteit (Gaming Authority) fined Electronic Arts €10 million over FIFA loot boxes (later overturned on appeal).

• China (2017): required public disclosure of probabilities on all loot boxes, though studies like Xiao et al. in Behavioural Public Policy have pointed out inconsistent compliance.

• South Korea (March 2024): mandated probability disclosure with heavy fines. In the first few months, the Korean authority flagged 266 games in violation. Nexon was fined 11.6 billion won (about US$ 8.9 million) for manipulating drop rates in MapleStory.

• Japan (2012): the "kompu gacha" system was banned for meeting the legal definition of gambling.

• Australia (March 2026): mandatory age verification for games rated 18+, focused on protecting children from gambling and loot box content.

Brazil, with the ECA Digital, has now joined that group. With one important difference: the Brazilian framing is child protection, not gambling regulation. That makes the reach broader, because you don't need to prove a loot box is gambling, only that it is harmful to the development of children and adolescents, something the scientific literature already supports.

➔ The bigger problem: loot boxes in premium games

Here is the point that, in my view, is the most insidious thing the industry does.

A free-to-play game with loot boxes is questionable. A premium game (paid upfront) with loot boxes is worse.

The user has already paid. They bought the game thinking they were getting the full package. Then they find out that to compete meaningfully, to own the best characters or cards, to access core content, they need to keep spending on random boxes.

EA Sports FC (formerly FIFA) is the classic example. A game sold for US$ 60 or more, played by millions of children, with its main mode (Ultimate Team) built entirely around loot boxes. Electronic Arts has reported, in recent earnings, annual revenue on the order of US$ 1.5 billion from Ultimate Team alone. Not from the game. From the boxes.

Other premium games have historically used similar mechanisms. Star Wars Battlefront II (2017) triggered such a backlash for including loot boxes that affected competitive balance that it became one of the biggest public-relations disasters in industry history, forcing EA to remove the system days after launch. Overwatch kept loot boxes until migrating to Overwatch 2 in 2022. Counter-Strike has the famous cases with keys, the subject of academic research on gambling similarity and of a recent Valve legal settlement.

When these mechanisms appear in games that children play in massive numbers, the "it's an adult consumer's choice" argument loses much of its weight. That is precisely what the ECA Digital is addressing.

➔ What actually changed on March 17, 2026

The law defines a reward box as any paid acquisition mechanic, in exchange for value or purchasable virtual currency, of random items or advantages whose content is unknown before purchase. And it prohibits that mechanic in games directed at children and adolescents, or likely to be accessed by that audience.

The phrase "likely to be accessed" is the big innovation. It covers games that aren't specifically marketed to kids but that kids play en masse, which is most popular games.

Beyond that, the ECA Digital requires:

• Effective age verification (self-declared birthdates are explicitly prohibited)

• Robust parental controls covering both playtime and spending

• Restrictions on algorithmic profiling and on advertising targeted at minors

• Limits on "engagement-maximizing" features when the audience is children

• Privacy-by-default configurations

Penalties are serious: up to R$ 50 million (about US$ 10 million) per violation, or 10% of the company's Brazilian revenue, whichever is larger, with possible service suspension. The ANPD (National Data Protection Authority) is the enforcement body, per supporting Decree 12,880/2026.

The industry reaction was immediate. Rockstar Games suspended direct sales through the Rockstar Games Store and Rockstar Launcher in Brazil starting March 17. Libraries already owned keep working, and Shark Cards and Gold Bars remain on sale (microtransactions still running, game sales paused). Rockstar titles remain available on Steam, the Epic Games Store, PlayStation Store, and Xbox Store, because those platforms handle age verification themselves.

Riot Games reclassified League of Legends, Teamfight Tactics, Wild Rift, 2XKO, and Legends of Runeterra to 18+ in Brazil, blocking minors. Valorant kept a lower rating and allows access for 12-17 year olds with parental consent through a guardian portal. Riot publicly committed to returning the games to their original ratings "in early 2027", after building the compliance infrastructure.

Other publishers have started similar reviews. In many cases, the most rational response will simply be to remove loot boxes from Brazilian versions of games rather than restricting access entirely.

➔ Is the law perfect? No. But it's a starting point.

I'll be the first to acknowledge: the text is imperfect. Parts were written in a hurry. There are ambiguities that are making companies paralyzed by excessive caution (Rockstar stopping direct sales in Brazil is the most visible case). Abragames and several specialized lawyers have already voiced concerns about legal uncertainty.

Points that, to my reading, could have been better:

• Clarity on responsibility: who answers for a violation, the developer, the publisher, or the storefront? The law leaves it ambiguous, and specialized lawyers have flagged this as one of the main risks.

• Objective definition of "likely to be accessed": what are the criteria? Average age of players? Content rating? Targeted marketing? The regulation needs to spell this out.

• Adaptation period: six months between enactment (September 2025) and effective date (March 2026) was short for international companies to adapt.

• Alignment with content rating: the law leans on Brazil's federal rating system, which itself needs modernization.

But from a child-protection standpoint, the ECA Digital is a concrete step forward. It puts Brazil in a small group of countries that treat the combination "paid loot box + child" as incompatible with healthy development. From here on, the hope is that ANPD regulation will refine the ambiguous points and that administrative decisions will build precedent for the next iterations.

The regulatory history of the internet shows that first steps are always imperfect. Brazil's Marco Civil da Internet (2014) went through multiple rounds of regulation before it matured. The Marco Legal dos Games (Law 14,852/2024), the federal framework for the games industry, is still consolidating. The ECA Digital will follow the same path.

➔ What developers and families need to know now

For Brazilian developers and studios, the message is clear: rethink design from the start. Non-random monetization (fixed-price cosmetic stores, battle passes with disclosed rewards, premium content with a clear price) is fully viable and, in many cases, more profitable long-term than the whale-hunting model. The international market is heading in the same direction.

For the industry as a whole, the trend is unmistakable: the era of "enter your birthdate" as age verification is ending. Companies will soon need serious age-verification systems, parental controls, and transparency about game mechanics. Whoever starts now has a head start. ASCJogos member studios that work with children's games are already mapping these adjustments.

For parents and educators: the ECA Digital doesn't solve everything, but it shrinks the risk surface. Keep watching what your kids play, talking about spending, and using the parental controls that are now mandatory for platforms operating in Brazil. And if you're looking for a good first step into social-emotional development through games, consider initiatives focused on learning games for kids that are designed with this concern from the ground up.

➔ Frequently asked questions

Did the ECA Digital ban games in Brazil? No. The Brazilian federal government clarified that the law does not ban games. It bans paid loot boxes in games directed at children and adolescents or likely to be accessed by that audience, and it requires age verification and parental controls.

Why did Rockstar suspend sales in Brazil? Because of age-verification and compliance obligations. Rockstar's games remain available on Steam, the Epic Games Store, PlayStation Store, and Xbox Store, because those platforms handle verification. Rockstar simply decided to stop selling directly until it can comply.

Can my kid still play League of Legends? If they're 18 or older, yes. Riot reclassified LoL, TFT, Wild Rift, 2XKO, and Legends of Runeterra to 18+ in Brazil until early 2027. Valorant keeps a lower rating and allows 12-17 year olds to play with parental consent.

Are loot boxes really comparable to gambling? The scientific literature points to a robust correlation. The study by Zendle and Cairns (2018) in PLOS ONE, replicated by several other researchers, shows a statistically significant association between loot box spending and problem-gambling symptoms. Belgium and the Netherlands have classified loot boxes as gambling since 2018.

What are "whales" in the games industry? It's the term for the small group of players (typically 1% to 5%, sometimes less than 0.2%) who generate most of the revenue in free-to-play games (games that are free to download but sell in-game items with real money). These games' monetization is designed to extract the maximum from that group, which is especially concerning when the audience includes children.

My studio makes kids' games in Brazil. Should I worry? It depends on your business model. If you don't use paid loot boxes, have parental controls, and don't profile minors for advertising, your path to compliance is simpler. It's worth talking to specialized digital-law attorneys and following guidance from ASCJogos and Abragames. I'd also recommend our guide to breaking into the game industry.

Where can I read the text of the law? Law 15,211/2025 is available on the Portal do Planalto (Brazil's official legislative portal) and on legal databases like JurisHand. Decree 12,880/2026 provides the supporting regulation.

➔ Bibliography and references

Legislation and official sources

• Law 15,211/2025 (ECA Digital), enacted on September 17, 2025

• Decree 12,880/2026 (supporting regulation)

• ECA Digital — Brazilian Chamber of Deputies

• TJPE — New rules for games and social media

• TJRJ — ECA Digital takes effect

• MPES — ECA Digital and the online games environment

Peer-reviewed research and academic articles

• Zendle, D., & Cairns, P. (2018). Video game loot boxes are linked to problem gambling: Results of a large-scale survey. PLOS ONE, 13(11).

• Xiao, L. Y., et al. (2021). Gaming the system: suboptimal compliance with loot box probability disclosure regulations in China. Behavioural Public Policy.

• Loot boxes in electronic games used by children and adolescents: challenges and implications under the ECA and the LGPD — UNIPAR Journal of Legal and Social Sciences

• The need to regulate online games and in-app purchases for the protection of children and adolescents against predatory practices — Caderno de Direito da Criança e do Adolescente

Institutional reports

• Norwegian Consumer Council (2022). INSERT COIN: How the gaming industry exploits consumers using loot boxes (endorsed by 20 organizations across 18 countries)

Legal analysis

• Conjur: Law 15,211 bans reward boxes in games

• Conjur: The impact of the ECA Digital on the electronic games segment

• Daniel Law: From the end of loot boxes to design regulation

• Assis e Mendes: Loot boxes, ECA Digital, and game monetization

Journalism

• CNN Brasil: Lei Felca bans LoL and other games for minors in Brazil

• Gizmodo: ECA Digital: social media, adult sites, gambling, everything the law targets

• Olhar Digital: Riot Games blocks LoL for minors in Brazil

• Terra: Rockstar suspends game sales in Brazil

• TechTudo: How the Felca Law may affect games in Brazil

International comparison

• Engadget: Belgium moves to ban Battlefront 2-style loot boxes

• Game World Observer: South Korea found 266 games violating loot box rules

• Video Games Chronicle: Dutch court overrules EA loot box fine

Related Truth and Tales content

• Loot Boxes: are we getting our kids addicted to gambling without noticing?

About the author:

Leonardo Guedes Bilck is passionate about games and president of ASCJogos, the game developers' association of Santa Catarina, Brazil. He is also co-founder of Plot Kids, a Brazilian studio specialized in game development and animation, and of Truth and Tales, focused on learning games for kids with social-emotional learning at their core. With more than a decade working in the industry, Leonardo is actively involved in the development community and believes that ethical monetization and child protection are pillars of the sustainable growth of Brazil's game industry.

Tags: ECA Digital, kids games, learning games, loot boxes, Lei Felca, Felca Law, Roblox, game monetization, brazilian games, game industry, Brazil