Riot just hard-locked under-18 League accounts in Brazil – here’s why it happened overnight

If you’re under 18 and trying to log into League of Legends in Brazil this week, you’re not being trolled – the game really has shut you out by law.

Riot has rolled out full-blown age verification across almost all of its games in Brazil and temporarily blocked access for minors, racing to comply with the country’s newly enforced ECA Digital statute. It’s one of the most aggressive tests yet of what happens when government child-safety rules collide with loot-box-heavy, esports-driven live service games.

Key takeaways

• Riot now requires Brazilian players to prove they’re 18+ with government ID and biometrics to keep playing League, TFT, Wild Rift, 2XKO and Legends of Runeterra.
• All under-18 players are currently blocked from those titles; Riot says it aims to restore access with verified parental consent by early 2027.
• Valorant is treated differently: 12-17-year-olds can keep playing with guardian email approval, reflecting more lenient age-gating for that rating tier.
• The move is driven by Brazil’s ECA Digital law, which demands “effective” age checks, tight rules on randomized monetization for minors, and threatens huge fines for non-compliance.

Brazil just turned “Are you 18?” into a real check

For years, age gates in games have been a joke: type in a fake birthday, check a box, move on. Brazil’s ECA Digital (a 2025 update to the country’s Child and Adolescent Statute) effectively outlaws that approach for platforms that can expose minors to adult content or predatory monetization. The law demands effective age verification, with real consequences for getting it wrong.

Riot’s response went live mid-March:

• March 16, 2026 – Age verification began rolling out for all Brazilian Riot accounts. Players are prompted to prove their age using a mix of local ID systems and biometrics.
• March 18, 2026 – Accounts that haven’t proven the owner is 18+ are paused or blocked from accessing several Riot titles.

According to local reporting, the verification flow can include your CPF (Brazilian tax ID), a payment card check, an ID document photo, and a facial scan to match the ID. If you clear that and are over 18, you keep playing normally. If not, or if you don’t do it in time, your access is cut off.

The uncomfortable angle here is obvious: Brazil wanted age checks that weren’t fake, and Riot delivered that by turning your Riot login into something a lot closer to a KYC-verified financial account. For Brazilian players, the tradeoff is real child-safety enforcement at the cost of handing very sensitive data to a game company.

And the penalty for Riot if it doesn’t play ball? Fines reportedly up to R$50 million or a percentage of Brazilian revenue per violation. That’s the sort of number that makes a publisher flip a big red switch overnight.

Riot went further than the bare minimum – and fast

ECA Digital doesn’t treat every age bracket the same. Under the FELCA tiering that sits alongside it:

• Kids under 14 are essentially locked out of restricted services.
• Teens 14–17 can access more content, but only with verified parental consent.
• Adults 18+ get full access once their age is confirmed against official records.

Riot could have leaned hard on that middle tier and rushed out a parental consent system from day one. Instead, it chose a simpler – and harsher – first step for most of its catalogue: treat everything like it’s 18+ only until the legal dust settles.

In practice, that means:

• Fully blocked for under-18s (for now): League of Legends, Teamfight Tactics, League of Legends: Wild Rift, 2XKO, Legends of Runeterra.
• Different treatment: Valorant, which allows 12–17-year-olds with guardian email approval, mirroring its slightly lower age rating.

Riot says this is temporary. The plan is to build out a proper parental consent pipeline, align each game’s age rating with the new legal framework, and “by early 2027” restore access for under-18s where the law permits. Until that system exists and has been stress-tested with regulators, the studio is erring on the side of over-compliance.

Behind the scenes, that’s a pretty telling choice. It suggests two things:

• Riot expects Brazilian regulators to take enforcement seriously, not just wave the law around for PR.
• The current monetization design of its non-Valorant titles is risky enough under the statute that it would rather kick every teen out than scramble to redesign systems on the fly.

On the player side, Riot stresses that accounts aren’t being wiped. Progress, skins, passes – all of it stays tied to your account. You just can’t log in and use any of it if you’re under 18 in Brazil right now.

Loot boxes are the elephant in the room

ECA Digital isn’t a random “think of the children” law; it’s explicitly aimed at predatory digital practices that target minors. That includes aggressive data collection and targeted content, but gaming-wise, the hot button is randomized monetization – loot boxes, gacha, and their modern cousins.

Brazil isn’t the first country to try and clamp down. Belgium effectively pushed traditional loot boxes out of major releases. The Netherlands flirted with similar bans. Mobile games have played whack-a-mole with regional gacha rules for years. But Brazil is going broader: tying age verification, data rules, and monetization together under one child-protection umbrella.

That’s why we’re seeing a wave of odd side effects:

• Mario Kart Tour suddenly showing as 18+ on Google Play in Brazil because of “randomized in-app purchases,” even after removing its old gacha system.
• Rockstar turning off digital sales from its own launcher in Brazil and pushing players to third-party stores like Steam and console marketplaces instead.
• Publishers quietly re-rating or region-tweaking games that lean on randomized rewards.

Riot’s catalogue sits right in the blast radius. League’s cosmetic loot systems, TFT’s eggs and bundles, even Runeterra’s card acquisition – all of that looks a lot more complicated when the law says “no random paid rewards for minors” and the penalty for getting it wrong is measured in percentages of revenue.

Valorant gets easier treatment partly because it’s been built in a post-loot-box world. Its monetization leans heavily on direct purchases and battle passes, not classic RNG boxes, so it’s a better fit for the teen-plus tier once parental consent is in the loop. The rest of Riot’s lineup is going to need more surgery to land in a legally safe place for under-18s.

Esports and the awkward underage gap year

All of this is annoying if you’re a casual 16-year-old League player in São Paulo. It’s potentially career-altering if you’re a minor on a professional path.

Brazil is a core market for Riot esports – CBLOL in League, Valorant Champions Tour in FPS. With the new blocks, Brazil’s only underage pro currently active in official Riot-run League tournaments can’t play on their own account until they turn 18 next month. Riot has carved out a narrow exception: some pros can keep practicing on Riot-owned accounts under tightly controlled circumstances, but that’s a short-term bandage, not a fix.

Long term, this raises awkward questions:

• How do you scout and develop under-18 talent if they legally can’t grind ranked on their own accounts in your biggest titles?
• Will Brazilian teams pivot more toward Valorant, where 12–17-year-olds can still play with parental approval, at least for now?
• Do we end up with a weird “gap year” where a whole cohort of young players simply ages into eligibility after 2027, once parental consent systems exist?

Riot has dealt with age restrictions before – minimum ages for pro play, regional residency checks, all that bureaucracy fans never see. The difference here is scale and bluntness: Brazil’s law doesn’t care if you’re the next Faker, it just cares if you’re under 18 and exposed to loot-box-style mechanics.

The privacy question Riot would rather not answer

Any time a platform asks for your face and your government ID, alarms go off – especially in gaming, where a lot of people signed up precisely to avoid real-name, real-paperwork ecosystems.

Riot isn’t alone here. Discord has already started talking up its own automated age-verification system, blending payment methods and on-device checks to anticipate these same laws. Social platforms are experimenting with AI-based age estimation from selfies. This is the direction the whole industry is being dragged in.

But Riot now sits at the sharp end in Brazil, and there’s one question that matters more than any PR spin: What exactly happens to that biometric and ID data once you hand it over?

• How long is it stored?
• Is it kept in Brazil or moved across borders?
• Can it be shared with other entities, including other Riot products or government bodies?
• What happens if there’s a breach?

The law side focuses on “effective age checks.” The player side needs concrete guarantees those checks don’t quietly turn into a permanent, highly linkable identity profile. Until Riot talks clearly about retention, access, and deletion, a lot of adults will hold off on verifying – and a lot of teens will be permanently locked out.

Why this matters beyond Brazil

It’s easy for non-Brazilian players to shrug this off as a local headache. That would be a mistake. Lawmakers everywhere are watching these experiments very closely.

From an industry perspective, Brazil is now a live testbed for a few big questions:

• Can large-scale age verification actually work in a massive, free-to-play ecosystem without completely gutting engagement?
• How much monetization are publishers willing to give up to avoid building teen-friendly, non-random reward systems?
• Will players accept biometric verification for games, or will they simply drop off and move to titles that dodge strict regions?
• Do governments see this and decide “we want that too”, especially in the EU or other Latin American markets?

If Riot stabilizes this – restores teen access with parental tools by 2027, keeps regulators happy, and preserves its Brazilian playerbase – it effectively proves that heavy regulation and live-service games can coexist, with a lot of engineering and some painful compromises.

If it goes badly – legal fights, mass drop-off, privacy scandals – you’ll see other publishers use Brazil as the cautionary tale when they lobby against similar laws elsewhere.

What to watch next

• Parental consent rollout: Riot’s stated target is “early 2027” to restore under-18 access with guardian approval. Any concrete date, beta program, or policy doc on this is the first big milestone.
• Monetization changes: Keep an eye on whether League, TFT, and Runeterra tweak or regionalize loot-box-style systems in Brazil specifically.
• Esports rules in Brazil: CBLOL and VCT rulebook updates around age, account handling, and practice conditions will show how Riot is adapting its pro ecosystem.
• Competitor responses: Watch what Epic does with Fortnite, how Valve handles Steam’s age gates, and whether more publishers follow Rockstar in pulling direct-store sales.
• Privacy transparency: Any detailed statement from Riot on data retention, deletion rights, and biometric handling will tell you how seriously they’re treating the non-gaming side of this law.

TL;DR

Brazil’s new ECA Digital law forced Riot to switch on strict age verification and temporarily block all under-18 players from League, TFT, Wild Rift, 2XKO and Legends of Runeterra, while letting Valorant teens in via parental approval. The move is less about Riot suddenly caring about birthdays and more about dodging huge fines tied to randomized monetization and child-safety failures. The real story now is whether Riot can build a workable parental consent and monetization model by 2027 without bleeding players or turning your Riot account into a permanent, high-risk ID file.