Brazil's loot box ban: what the ECA Digital means for CS2 cases

Since 17 March 2026, Brazilian law has banned loot boxes in games aimed at children and teenagers or likely to be played by them, and the Justice Ministry treats Counter-Strike 2 cases as loot boxes. In October it named CS2 among six games it wants the data protection authority to check first, and in June a Federal District court ordered Valve to pay R$10 million in a ruling that can still be appealed. This records what lawmakers, officials and a judge did; it isn't legal advice, and rules differ by country and change, so check the law where you live.

The law and who enforces it

The ECA Digital (Estatuto Digital da Criança e do Adolescente, the Digital Statute of the Child and Adolescent) is Law 15.211 of 17 September 2025. It covers tech products and services aimed at under-18s in Brazil or likely to be used by them, wherever they are developed or run, and names online games among them. It took effect on 17 March 2026, and the ANPD (Agência Nacional de Proteção de Dados), Brazil's data protection agency, regulates and enforces it.

What counts as a loot box

Article 2 defines a loot box (caixa de recompensa) as a feature in some games that lets the player pay for consumable virtual items or random advantages without knowing the contents in advance or having any guarantee they will be useful. Article 20 bans loot boxes in games aimed at children and adolescents or likely to be accessed by them.

The definition says nothing about whether items can be traded or sold, unlike the Dutch regulator's 2018 test, which turned on prizes that could be transferred and had economic value; loot box laws and CS2 cases tells that story.

In the ministry's technical note, the ban doesn't depend on proving harm or on classifying the feature as betting or gambling: payment, chance and unknown contents in a game aimed at or likely used by minors are enough. Paying with virtual currency that was itself bought with money still counts as paying. The note lists CS2's loot boxes as weapon-skin cases opened with a paid key.

The decree's three options

Decree 12.880 of 18 March 2026 gives games three ways to comply under article 23. They can verify users' ages and keep children and adolescents away from loot boxes, offer a version without loot boxes, or switch the feature off completely by default; the last two options need no age check.

The decree lists loot boxes among products and services prohibited to minors, next to weapons, alcohol and tobacco, with gambling and betting as a separate entry. Companies that sell loot boxes must check ages either at sign-up, with purchases blocked by default and no unlocking just by stating an age, or at the moment of purchase. The check has to be a high-reliability method that meets ANPD standards.

The ministry adds that warnings, published odds, optional controls or parental consent don't on their own replace keeping minors out, and that the check must cover the purchase and opening itself, including with virtual currency or in a step separate from the game. By that reading, drop rates like those covered in CS2 case odds aren't enough by themselves.

Counter-Strike 2 on the ministry's list

The Justice Ministry's National Secretariat for Digital Rights published Technical Note 55/2026 on 15 October, reviewing the law's first six months. Its age-rating department had reviewed 15 popular titles and franchises in Brazil, and the ministry says only six had not adapted.

Among those that did, some removed paid random rewards for Brazilian players. Others, such as EA Sports FC 26 and Riot Games' titles, were rated 18 and added age checks, in Riot's case with Brazilian ID documents or facial recognition.

CS2's entry is short: no confirmed change to minors' access to case opening, and a rating of 18. The note groups it with NBA 2K26, WWE 2K26, Call of Duty, Genshin Impact and PUBG Mobile, titles whose rating rose to 18 while their loot boxes stayed open without age verification. It recommends that the ANPD monitor those six first.

An 18 rating, the ministry says, helps in judging likely access and setting priorities but doesn't by itself show that minors can't buy or open loot boxes. It calls the survey preliminary and not exhaustive, and not by itself proof that any company complied or broke the law. It is now up to the ANPD to decide whether to make loot box games a monitoring priority.

Penalties and the timetable

Article 35 sets four penalties, with due process and the right of defence guaranteed. A foreign company's branch or office in Brazil is jointly liable for paying a fine.

The ANPD's timetable sets an adaptation and monitoring period from August to November 2026, updated sanction rules from November, and enforcement actions from January 2027, especially on age checks. It can still act at any time on complaints or high-risk violations.

The June ruling against Valve

On 9 June 2026 the 1st Childhood and Youth Court of the Federal District decided civil suits brought by ANCED, a national association of child-rights defence centres, against platforms such as Apple, Google, Microsoft and Sony and against game developers. Valve, as developer of Counter-Strike, was ordered to pay R$10 million in collective moral damages, which go to the Federal District's children's rights fund.

Judge Rejane Zenir held that such loot boxes were unlawful even before the ECA Digital, because the 1990 child statute already banned abusive advertising aimed at children and teenagers, including promotions that hand out prizes. She called the new law's explicit ban a consolidation of the rules for the digital environment.

She ordered the companies to warn about the random nature of the rewards and bar under-18s, publish the exact odds of every item, use reliable age verification, and offer a refund system for loot box spending by under-18s without parental permission.

These are first-instance rulings, which the ministry described in October as still open to appeal. Valve didn't answer UOL's emails about the decision. The Entertainment Software Association, which represents the games companies named, said games already offer protections such as age ratings and parental controls.

What it means if you play CS2

The loot box duties fall on the companies that run games and sell loot boxes. The rules don't necessarily take loot boxes away from adults: in the ministry's words, minors' access must be effectively prevented. As of the October note, no change for minors in CS2 had been confirmed.

Skin gambling sites are a separate question from Valve's cases. The decree lists gambling and betting as their own category barred to minors, and how the law treats skin gambling covers those sites.

Every casino game has a house edge, so over many bets the average player loses money. cs2.casino is for adults 18+ only, isn't affiliated with Valve, and shows the house edge and bet limits on every game. Deposit, loss and wager limits and self-exclusion are on your account, and responsible gambling limits explains each one.

Sources

• Lei nº 15.211, de 17 de setembro de 2025 (ECA Digital) — Planalto
• Decreto nº 12.880, de 18 de março de 2026 — Planalto
• MJSP pede à ANPD que monitore jogos eletrônicos com caixas de recompensa — Ministério da Justiça e Segurança Pública
• Nota Técnica nº 55/2026/DSPRAD-SEDIGI/SEDIGI/MJ — Ministério da Justiça e Segurança Pública
• ECA Digital — Agência Nacional de Proteção de Dados
• Justiça do DF aplica condenação sem precedentes de R$ 298 mi a big techs — UOL Tilt
• Governo pede fiscalização de seis jogos com mecanismo similar a bet no ECA Digital — Folha de S.Paulo
• ECA Digital, para proteção on-line de crianças e adolescentes, entra em vigor — Agência Senado