A 15-year-old opening card packs in a soccer game in November 2026 meets a different rulebook in São Paulo, Sydney and Manchester.

In Brazil, the packs sit behind an age check. In Australia, the store shows an advisory label. In the UK, the protection is an industry promise to ask a parent first.

Governments and rating bodies have chosen different tools to keep paid loot boxes away from minors. The question for each: can a 15-year-old still buy one, legally and in practice?

Three Tools for One Mechanic

Brazil’s ECA Digital, its digital statute for children and adolescents, gives a clear legal definition. A loot box is a feature that lets a player buy, for payment, consumable virtual items or random advantages “without prior knowledge of their content or guarantee of their actual usefulness” (translation).

Three instruments are now in use:

• A ban. Brazil prohibits loot boxes in games aimed at, or likely to be accessed by, under-18s. Spain drafted a narrower ban, but the bill lapsed in October 2026.
• A minimum age rating. Australia has required at least an M rating since September 22, 2024. PEGI, the pan-European rating system, has given new games with paid random items a default PEGI 16 since June 2026.
• Self-regulation. In the UK, industry principles took full effect in July 2024.

Japan curbed “kompu gacha” collection mechanics in 2012, and Belgium’s gaming commission applied its gambling law to loot boxes in 2018.

What is new is compliance data on the latest rules. For a sector used to in-game spending that needs no license, this data shows how the rules behave on real storefronts.

The table compares the rulebooks on what a 15-year-old can buy.

Table note: “In force” gives the date each rule began to apply. PEGI ratings carry legal force only where national law adopts them.

Brazil: A Ban, Then a Title-by-Title Review

Article 20 of Brazil’s Lei 15.211 bans loot boxes in games “aimed at children and adolescents or likely to be accessed by them, under the respective age rating” (translation). It reaches publishers wherever they are based, and fines can reach 10% of a group’s Brazilian revenue.

Decree 12.880 of March 18, 2026, offers three routes to compliance. Publishers can verify age and block minors, offer a version without loot boxes, or switch the feature off by default.

The audience is large: the TIC Kids Online Brasil 2025 survey found 63% of internet users aged 15 to 17 played games online. The ban sits alongside Brazil’s approach to its betting market, which licenses operators and requires them to keep minors out.

In October 2026, the Ministry of Justice published Technical Note 55/2026, the first title-by-title government review of a statutory loot box ban we could find. It covers 15 titles and franchises with large Brazilian user bases over the law’s first six months.

The changes varied: Supercell removed or replaced paid random rewards for every Brazilian player. Riot Games temporarily moved its titles to 18+, paused minors’ accounts and added document or facial checks.

EA Sports FC made age assurance mandatory for Brazilian accounts, and Overwatch 2 dropped paid boxes from its Battle Pass in Brazil.

Six titles stand apart: NBA 2K26, WWE 2K26, Counter-Strike 2, Call of Duty, Genshin Impact and PUBG Mobile. The note records each as rated “not recommended for under-18s,” with loot boxes still open and no age verification in front of them.

For NBA 2K26 and WWE 2K26, the higher rating is the only measure recorded. For Counter-Strike 2, the table records no confirmed change to minors’ access to case opening. Genshin Impact checks ages on US accounts, but the ministry could not confirm it does so in Brazil.

The ministry’s legal reading explains why.

The note calls its survey “preliminary and not exhaustive.” The six titles are listed for priority monitoring, not found in breach.

What the Ministry Asked the ANPD to Do

Enforcement rests with the ANPD, Brazil’s national data protection agency. The ministry asked it to consider making loot box games a monitoring priority, and proposed sending the note to the Health Ministry’s mental health department.

The ANPD’s own timetable sets an adaptation and monitoring period for age verification from August to November 2026, with enforcement action from January 2027.

Australia: Ratings That Do Not Reach the App Store

Australia took the rating route. Since September 22, 2024, games with “in-game purchases linked to elements of chance” need at least an M classification. Games with simulated gambling, such as social casino titles, need R 18+.

M means “not recommended for persons under 15,” which is advice only. R 18+ is “legally restricted to adults,” so for a 15-year-old only the social casino rule binds.

The government’s explanatory statement cites Australian Institute of Family Studies research. A 2022 analysis reported “a causal link” between playing free simulated gambling games at 16 to 17 and gambling with money at 18 to 19. A separate review found associations between loot boxes and problem gambling.

Compliance data comes from University of Sydney and City University of Hong Kong researchers, in research not yet peer-reviewed when released in September 2025. A year after the rules began, they checked the 100 top-grossing mobile games on each store.

On the App Store, 20% showed a rating below the legal minimum despite loot boxes or similar features; on Google Play, 48%. The non-compliant games had all been updated after September 22, 2024.

Labels also contradicted each other. Of 31 games in the top 25 on either store, 30 showed conflicting age ratings across stores and policies, and 18 (58%) showed four at once. PUBG sold loot boxes while rated 12+ on the App Store and PG on Google Play.

A label still leaves the door open, a gap regulated gambling knows from how Dutch minors get around age limits.

The authors put the maximum penalty for mislabeling at around A$6,000, “a drop in the ocean” next to top-grossing revenue. Penalties are set state by state, so the ceiling varies.

The UK: A Pledge Without a Published Verdict

The UK chose self-regulation, through industry principles published in July 2023. The first asks companies to “effectively restrict anyone under the age of 18 from acquiring” paid loot boxes “without the consent or knowledge of a parent, carer or guardian.” Implementation ended on July 18, 2024.

Leon Y. Xiao, who also co-wrote the Australian study, and Mie Lange Lund ran the most complete independent test. They reviewed the 100 highest-grossing UK iPhone games before and after the deadline (peer-reviewed, May 2025).

In July 2024, 81 of the 100 games contained loot boxes, including 22 of the 34 rated 4+. The results:

• None (0.0%) sought explicit parental consent before an under-18 could buy. The authors’ most lenient reading reaches only 12.5%.
• 0 of 100 used age checks that went beyond self-declaration.
• 23.5% (19 of 81) disclosed loot boxes on the store page.
• 8.6% (7 of 81) disclosed probabilities for every loot box found in an hour of play.

Enforcement of the principles did not follow, the authors say. They reported the failures to Ukie, the UK games trade body, and to Apple, yet the games found non-compliant before the deadline remained non-compliant months later.

In February 2026, the Advertising Standards Authority issued an enforcement notice confirming that app store pages must disclose loot boxes to UK users. Parents must still find and switch on parental control tools themselves.

As of November 2026, the evaluation commissioned by the UK culture department (DCMS) has not appeared on gov.uk.

Baroness Twycross, a DCMS minister, told the Lords on January 15, 2026, that the report was “finalised and received in December.” In March, minister Ian Murray wrote: “We will publish the research shortly, alongside our next steps.”

Loot boxes stay outside gambling law: they “are not currently legally considered gambling,” Twycross said, because players cannot cash out. Instead, the government says it “supports the GRA’s strict enforcement” of PEGI’s new ratings.

The GRA is the Games Rating Authority, and its legal backing covers boxed games; digital-only sales fall outside the Video Recordings Act.

Europe: PEGI 16 Now, a Legal Gap in the EU KIDS Act

Since June 2026, new games with paid random items default to PEGI 16, and some reach PEGI 18. From October 2026, digital-only games rated PEGI 3, 7 or 12 that sell them are being moved to PEGI 16.

Germany’s age-rating body, USK, offers a guide to the likely effect. Since 2023, its new risk criteria have applied to about 30% of submissions. Around one in three of those got a higher rating, or roughly one game in ten.

On paper, PEGI 16 puts a 15-year-old below the line. In practice, PEGI is a voluntary label that only a few countries, such as the UK for boxed games and Portugal, back in law, and it does not block a purchase by itself.

The EU’s KIDS Act proposal of September 17, 2026, is narrower for games than it first appears. Article 13(2) would bar exposing minors to “variable reward systems” on social networks and video-sharing platforms. Article 15, on online games, does not apply it.

For games, the protection appears only as an expectation in recital 40, left to codes of conduct. The European Parliament’s research service writes: “this prohibition would not apply to online games. This differing approach may create confusion.”

Games could still be added through amendments. The Digital Fairness Act proposal, expected in mid-November 2026, is another route: its call for evidence flagged video game features and minors.

Spain’s draft law would have barred minors from random rewards exchangeable for money or other virtual items. It lapsed when parliament was dissolved on October 6, 2026, ahead of a November 29 election, so no national ban is in force.

Concern about minors and chance-based products also runs through regulated gambling, as in teenage gambling risk in Italy and Greece.

What the Compliance Data Tells Operators and Regulators

In our reading, each rulebook depends on someone checking store listings and gameplay. The tool mattered less than whether anyone checked.

• Brazil’s law prompted changes from most large publishers; six titles are listed for priority monitoring.
• Australia relied on age ratings. A year on, 20% and 48% of top-grossing games were under-rated.
• The UK relied on a pledge. A July 2024 sample found 0.0% sought parental consent.

For licensed gambling operators, the lesson is familiar: an age check counts only when it blocks the transaction. A rating, warning or odds table only informs the buyer.

What to Watch Next

The next round turns on pending decisions. In Brazil, the ANPD begins enforcement action in January 2027, with six titles already flagged for priority monitoring. The UK has still not published its evaluation. The EU’s Digital Fairness Act will show whether the variable-reward ban reaches games.

Anyone worried about their own gambling can start with a 2-minute self-assessment test. If gambling is causing problems for you or someone you know, free and confidential help is available.

In the UK, call the National Gambling Helpline on 0808 8020 133. In Australia, call Gambling Help Online on 1800 858 858. In Spain, the free, anonymous FEJAR helpline is 900 200 225.

In Brazil, the CVV emotional support line is free and open 24 hours on 188. Elsewhere, contact your national gambling helpline.