Brazil’s Ministry of Justice and Public Security has asked the country’s data protection authority, the ANPD, to prioritise checks on six games that sell loot boxes. Call of Duty and NBA 2K26 are on the list, and the ministry’s concern is that children in Brazil can still buy paid random rewards in them.
The six games are:
- Counter-Strike 2
- Call of Duty: Warzone
- NBA 2K26
- WWE 2K26
- Genshin Impact
- PUBG Mobile
Why these six games
The request comes from a ministry technical note, number 55/2026, that reviewed 15 popular games and franchises available in Brazil. The six above were flagged because their loot boxes are still available without age checks the ministry considers good enough. All six already carry an 18+ age classification in Brazil, which is the core of the problem: the rating says adults only, but nothing stops a younger player buying the boxes.
The ministry was careful to call its review preliminary. On its own, it doesn’t establish that any of the publishers have broken the law. That’s now the ANPD’s job to determine.
The law behind it
Brazil’s ECA Digital, the digital extension of its Statute of Children and Adolescents, came into force about six months ago. Article 20 restricts paid loot boxes in games aimed at children and teenagers, or likely to be played by them. A follow-up decree, 12.880/2026, gives publishers three ways to comply:
- verify players’ ages and block loot boxes for anyone under 18
- release a version of the game without loot boxes
- switch loot boxes off by default for players in Brazil
None of the three requires loot boxes to disappear for adults. Brazilian outlets report that penalties under the law can reach R$50 million per infraction.
The ministry’s note also summarises the research it relied on. It says studies link loot box spending by young people with problem gambling, psychological distress and financial harm, while acknowledging that those links don’t prove one causes the other.
What it means for players
For now, nothing changes in Warzone, NBA 2K26 or the other four games. The ANPD will monitor how each one handles age checks, and publishers can choose which of the three routes to take if the regulator decides they fall short.
Two things are worth watching. First, the list names last year’s NBA 2K26 and WWE 2K26, not the 2K27 games, so how 2K handles its current titles in Brazil will be telling. Second, the age-verification route would mean ID checks before buying packs or cases, something publishers have resisted everywhere else.
Brazil’s move is the latest in a busy month for loot box rules. In Europe, PEGI has just re-rated EA FC 27, Marvel Rivals and Overwatch to PEGI 16 for selling paid random items. Valve has been here before too: back in 2017 it was cracking down on third-party gambling sites built on its item economy.