MEDIA & PUBLICATIONS

On June 9, 2026, the 1st Court for Children and Youth of the Federal District in Brazil issued a landmark decision condemning major game developers and app store operators to pay multimillion-dollar damages for offering—or allowing the offering of—loot boxes to minors on their platforms.

The combined amount of collective damages awarded reaches BRL 333 million (approximately USD 65 million). To the best of current knowledge, this is the first court ruling in Brazil imposing liability for making loot boxes available to minors, a practice the court found to violate their rights.

As an unprecedented case, the decision provides important lessons for digital companies operating in Brazil—not only for those directly offering loot boxes, but for any business providing digital services to minors in the country.

Background of the Case

The ruling stems from 13 civil class actions filed in 2021 by the National Association of Centers for the Defense of Children and Adolescents (ANCED), a non-profit civil organization dedicated to protecting children’s rights.

ANCED argued, in summary, that loot boxes constitute a form of exploitative and abusive commercial practice directed at minors. According to the association, these mechanisms resemble gambling, rely on randomized rewards, and take advantage of children’s cognitive immaturity, lack of judgment, and susceptibility to persuasive design. ANCED also claimed that companies failed to provide adequate information about probabilities, failed to implement effective age restrictions, and monetized behavioral vulnerabilities through opaque systems.

Judge Rejane Zenir Jungbluth Teixeira Suxberger, of the 1st Court for Children and Youth of the Federal District, ruled in favor of ANCED in all 13 lawsuits and ordered the companies to pay collective moral damages in the following amounts:

• Microsoft: BRL 50 million

• Apple: BRL 50 million

• Tencent (PUBG Mobile): BRL 50 million

• Sony: BRL 40 million

• Google: BRL 40 million

• Electronic Arts (multiple titles): BRL 20 million

• Activision-Blizzard (multiple titles): BRL 18 million

• Garena (Free Fire): BRL 15 million

• Riot Games (League of Legends): BRL 15 million

• Konami (multiple titles): BRL 12 million

• Valve (Counter-Strike): BRL 10 million

• Ubisoft (multiple titles): BRL 8 million

• Nintendo (Mario Kart Tour): BRL 5 million

In total, the damages awarded amount to BRL 333 million (approximately USD 65 million).

In addition, the court ordered the companies to:

• Compensate individual moral damages suffered by minors who purchased, opened, or used loot boxes through direct or indirect payment, subject to individual proceedings to determine the applicable amount of damages;

• Implement four minimum technical measures:

(i) Express warning: clearly disclose, on all loot box offer screens, the random nature of rewards and the legal prohibition of offering such features to minors.

(ii) Probability disclosure: prominently and accessibly display the exact probabilities of obtaining each item.

(iii) Robust age verification: implement high-reliability age verification mechanisms (beyond simple self-declaration), in addition to existing parental controls, and ensure strict data minimization with no storage of identification documents or images beyond immediate verification.

(iv) Refund mechanism: provide a free and accessible refund system for purchases made by underage users without parental consent.

The decision was grounded on several factors, including the vulnerability of minors, the similarity between loot boxes and gambling-like mechanics, the lack of transparency in probability systems, and the failure to adopt effective safeguards against underage access and monetization.

Without addressing the merits of the decision, it offers valuable lessons for technology companies operating in Brazil.

Corporate structures may not be used to shield local subsidiaries from Brazilian courts

One of the key arguments raised by Apple was lack of standing to be sued. ANCED named Apple Computer Brasil Ltda. as a defendant, while Apple argued that its Brazilian entity was limited to hardware-related activities (sales, import, and export), and that the App Store in Latin America is operated by Apple Services LATAM LLC, a US-based entity.

The defense relied on a formal distinction between entities within the corporate group. However, the court rejected this argument.

The judge found that, from the consumer’s perspective, a Brazilian user downloading an app through the App Store is contracting with the Apple brand as a unified entity. Consumers are not expected to investigate the internal corporate structure of multinational groups.

The court emphasized that Apple Computer Brasil Ltda., although legally distinct, operates under the Apple brand in Brazil, promotes products and services associated with the group, and benefits—at least indirectly—from App Store operations in the country. As such, it cannot be dissociated from the supply chain, particularly in cases involving hyper-vulnerable consumers such as minors.

This reasoning is consistent with established Brazilian case law. For example, Brazilian courts have repeatedly rejected attempts by companies such as Meta to avoid compliance with court orders mandating the disclosure of user data based on the argument that data processing and storage are carried out by their headquarters abroad (e.g., in Ireland), and that local entities have limited responsibilities. Brazilian courts have consistently held that complex corporate structures cannot be used to evade obligations in the country.

Against this backdrop, the message for companies is clear: corporate structuring—no matter how complex or internationally fragmented—is unlikely to shield local subsidiaries from Brazilian courts when they are part of the economic chain serving Brazilian users.

Broad legal principles can create concrete obligations

Another important takeaway is the willingness of Brazilian courts and authorities to derive concrete obligations from broad and abstract legal principles.

In Brazil, an explicit prohibition on offering loot boxes to minors emerged only with the enactment of the country’s first comprehensive law for protecting minors online (Law 15,211/2025 - “ECA Digital”), which entered into force in March 2026—after the lawsuits were filed.

Some defendants argued that the practice only became illegal after this legal development. However, the court disagreed.

The judge concluded that the pre-existing legal framework already prohibited such practices, even in the absence of a specific rule on loot boxes. This conclusion was based on a combination of constitutional, statutory, and consumer protection principles and broad rules, including:

• Brazilian Constitution: absolute priority to the protection of children and adolescents.

• Statute of the Child and Adolescent: duty to ensure the full realization of minors’ fundamental rights; prohibition of exploitation, violence, cruelty, and oppression; protection of physical, psychological, and moral integrity; preventive duties against threats or violations of rights; rights to age-appropriate content; obligation to provide clear age ratings; restrictions on minors’ access to gambling-like environments; and prohibition of selling lottery-like products to minors.
• Consumer Protection Code: principle of consumer vulnerability; right to clear and adequate information, including risks; duty of transparent product presentation; prohibition of abusive advertising, especially targeting children; prohibition of exploiting the consumer’s weakness or age; prohibition of imposing manifestly excessive advantages.

Based on these broad and open-ended provisions, the court constructed a framework that effectively treats loot boxes as unlawful when offered to minors, even before the express prohibition was established in the ECA Digital.

In practice, this signals that companies cannot rely solely on the absence of explicit rules to mitigate risk in Brazil. General legal standards—particularly those related to consumer protection and children’s rights—may be sufficient for courts and authorities to impose specific duties and restrictions, even where legislation is silent on the exact practice at issue.

Enforcement of the ECA Digital has already begun

As mentioned, the court ordered companies to implement four technical measures aligned with the ECA Digital and its implementing decree: (i) provide express warning about the random nature of rewards and the legal prohibition of offering such features to minors, (ii) disclose the probabilities of obtaining each item, (iii) implement robust age verification to block minors’ access to loot boxes, and (iv) provide a mechanism to refund purchases made by underage users without parental consent. Failure to comply with these measures may result in a daily fine of BRL 500,000, initially capped at 30 days but extendable.

This decision makes clear that enforcement of the ECA Digital is already underway. While the Brazilian Data Protection Agency (ANPD), the authority empowered to oversee compliance with the ECA Digital, has so far taken a more educational and dialogue-oriented approach with the market, enforcement is actively being carried out by other institutional actors—in this case, the judiciary.

Companies should not assume that a lack of immediate regulatory enforcement by the ANPD means low risk. In Brazil, enforcement can—and often does—come from multiple sources, including courts, users, and authorities and organizations representing them.

Conclusion

Beyond the specific issue of loot boxes, this decision highlights how closely following cases like this can provide valuable insight into how Brazilian law is applied in practice. In the context of digital markets, where regulation is still relatively recent and rapidly evolving, judicial decisions often play a key role in giving practical meaning to broad legal standards.

This dynamic is particularly relevant in Brazil, where open-ended principles are frequently translated into concrete obligations and prohibitions through case law. As a result, court rulings become an important source of guidance on how existing frameworks—especially in areas such as consumer protection and children’s rights—are likely to be enforced in real-world scenarios. Waiting for detailed regulation or for regulators to take the lead may prove insufficient.

In this sense, the main value of this decision lies not only in its outcome, but in the practical insights it offers. Companies that actively track and learn from cases like this will be better prepared to anticipate how broad legal standards may be operationalized and to adjust their practices before risks materialize.

• 

  Douglas Leite

• 

  Flavio Buzanovsky