The rise of online gambling among minors in Brazil highlights a major flaw in the public debate as not all platforms operate under the same rules. Bauab argues that teenagers access betting sites through illegal platforms, not regulated ones. Since January 2025, regulated operators have been required to implement robust identity verification mechanisms. Taxpayer number validation, document review, facial recognition and proof-of-life verification are some of them.
According to him, studies that treat the market as a single entity end up distorting the issue by failing to distinguish between legal and illegal operators. This distinction, he argues, is crucial to understanding why minors are still able to place bets. At licensed companies, the KYC process automatically rejects registrations from users who are underage. In the underground market, however, a self-declaration of age, or sometimes not even that, is often sufficient.
Black market can generate more than BRL40 billion a year
Bauab argues that the technology available today already provides effective tools for preventing fraud and unauthorised access. Facial biometrics, OCR, cross-referencing with official databases, risk analysis, device intelligence, and deep-fake detection make it much more difficult to attempt to circumvent the systems of regulated operators. Data shows that 70% of the regulated market undergoes verification by Legitimuz and that the approval rate in the KYC funnel reaches 98.6%, with the youngest demographic concentrated in the 18–24 age group.
According to Legitimuz’s co-CEO, the real critical issue lies outside the regulated environment. Estimates suggest that the illegal market may generate more than BRL40 billion ($8 billion) annually, in addition to accounting for a significant portion of the bets placed in the country. He advocates for a coordinated response involving the government, regulators, technology companies, financial institutions, schools and families. The measures include the widespread blocking of unlicensed websites, enforcement of the Digital Children and Adolescents Statute (ECA), awareness campaigns, and financial restrictions on illegal operators.
The conclusion is that the protection of minors depends not only on technological innovation, but also on collaboration between the public and private sectors to shut down the black market and strengthen the credibility of the regulated environment.
Underage gambling in Brazil – Guilherme Bauab
It’s no secret that minors in Brazil try to access online gambling platforms in creative ways. Recent industry surveys indicate that up to 11% of Brazilian youth—specifically those between the ages of 10 and 17—have managed to place bets illegally. Whether out of curiosity, the illusion of easy money, or the influence of social media content, the fact is that teenagers have been circumventing barriers that should be strong enough to stop them.
We are dealing with a vulnerable audience that should not have access to these platforms under any circumstances. And this paints a troubling picture for those of us who fight this daily in our operations. Just as important as finding the answers is asking the right question: how are these minors managing to place bets?
But before we look for the answer, we need to clarify a very important point.
Not all betting websites are the same
Studies on minors betting on gambling websites highlight a real and concerning trend. However, the problem with these studies is that they treat the gambling ecosystem as a single entity. They do not distinguish between regulated platforms—which operate under the supervision of the Secretariat of Prizes and Bets (SPA) and are required to conduct rigorous identity verification – among the thousands of unregulated platforms that simply don’t verify anyone. And making that distinction is key.
Starting in January 2025, all licensed operators in Brazil are required to perform full KYC: validation of the taxpayer number against official databases, document verification, and facial recognition with a proof-of-life check. If the data or biometrics indicate the user is a minor, the registration is automatically rejected. There is no “I am over 18” button, also known as an “age self-declaration,” that grants access. What exists is technology—and cutting-edge technology at that.
When surveys show that up to 30% of 16 and 17-year-olds use the internet to circumvent age verification mechanisms, another question arises. But circumvent what, exactly? A generic self-declaration of “I am 18” from a back-alley betting site, or a facial biometrics process with liveness detection from an operator that genuinely cares about the safety of its users?
White paper on the profile of Brazilian gamblers
It’s very important to understand the difference between those who just want to make a profit, without giving a second thought to the person on the other end of the smartphone, and those companies that truly take user security seriously.
To give a practical example (warning—spoiler alert): next week, during the second edition of Legitimuz Day—an event that will bring together the public and private sectors for discussions relevant to the betting industry in Brazil and around the world—we will release a white paper on the profile of the Brazilian bettor. It presents a unique portrait, based not on self-reported information but on data verified at the time of registration (27 million registered taxpayer numbers and over 400 million identity verifications per year), cross-referenced with official Legitimuz databases and enriched with financial indicators.
Here are some findings that provide context for the discussion, given the ban on minors at regulated betting shops. The youngest age group in the sample is between 18 and 24 years old and accounts for 24.6% of all bettors in the country. But the most significant figure is the KYC approval rate: 98.6%.
In short: when 70% of Brazil’s regulated betting market goes through Legitimuz’s verification process, we have not only the scale to say what works, but also the responsibility to point out what needs to improve. And what needs to improve isn’t in the regulated betting sector—it’s outside of it.
Technology on the front lines of this battle
The KYC requirements mandated by Brazilian regulations are currently among the strictest in the world for the betting industry. These include facial recognition with proof of life, document verification against Brazilian Internal Revenue Service databases, and cross-checking of financial data to ensure financial viability (Ministry of Finance Ordinance No. 1,143/2024), monitoring of politically exposed persons and Bolsa Família (Brazil’s primary federal social welfare and conditional cash transfer programme) beneficiaries. All of this takes place before the first deposit is made. And just as important: the rules mentioned are essential for keeping minors from attempting to create betting accounts.
And one of the most important ways to keep them at bay is to use the best technology available. Let’s take Legitimuz’s solutions as an example. Given the more than 400 million liveness checks we performed last year—each in under 30 seconds—attempting any kind of identity fraud is an awful task.
Verification in milliseconds
With LegitFace (a facial biometrics module featuring intelligent liveness detection across three security levels), age verification isn’t just a checkbox. It’s a technological barrier that includes detection of deepfakes, injection attacks, and spoofing. It is validated by widely recognised international certifications such as iBeta. A minor under the age of 16 simply cannot pass through this process using a selfie that does not match the presented document.
LegitDoc, our document verification module, performs high-precision OCR, featuring intelligent document analysis and cross-validation with the Internal Revenue Service. If the document submitted belongs to a minor, it is automatically rejected. LegitCheck, our background check platform, in turn, queries dozens of databases simultaneously in milliseconds: taxpayer number, AML/CFT sanctions, PEPs, death records, financial data, credit risk, and corporate affiliations. When we cross-reference estimated income, credit scores, and deposit patterns, we can detect not only discrepancies but also any inconsistencies that indicate identity theft or signs of money laundering by third parties.
And finally, LegitDevice: our device intelligence operates as a silent layer prior to any biometric verification—checking geolocation, detecting VPNs, proxies, and Tor, analysing device fingerprints, and identifying suspicious browsers.
In short, cutting-edge technology makes life very difficult for minors who try to circumvent regulated operators.
Tools are important allies, but we all need to work together
While the technologies to address this challenge already exist and work (very well) for operators who follow the rules, the other side of this battle depends on the authorities. It is estimated that the illegal betting market generates revenues that could exceed BRL40 billion per year—potentially more than the regulated market itself. There are thousands of websites operating without a licence, without KYC, without taxation, and without any access controls. And these are the main gateways for minors to place bets. Furthermore, it is estimated that up to 51% of all bets placed in Brazil were made on illegal sites; or that 78% of bettors cannot distinguish a legal site from an illegal one. Or that 46% of the public has already placed bets on illegal sites.
But perhaps the government’s biggest incentive to expand its efforts lies in the public coffers. Illegal betting results in annual losses of up to BRL10.8 billion to the public coffers in the form of uncollected taxes.
Coordinated front
The fact is that combatting illegal betting requires a coordinated effort among regulators, the market, and the tech sector. The first step is obvious, but it needs to be stated. The SPA needs to step up its efforts to block illegal operators—something it is already doing, but at a pace that remains insufficient given the volume of sites that pop up every week. Meanwhile, ANPD (Brazil’s National Data Protection Agency) needs to closely monitor compliance with the recent Digital ECA (Children and Adolescents Statute), which, since March of this year, prohibits self-declaration as the sole mechanism for age verification. Finally, large-scale educational campaigns, particularly on social media, highlighting the risks and harm to which these young people are exposed can also have a significant impact.
On the technology side, regulated operators are already leading the way. Biometric verification, automated document validation, and proof-of-life checks make it virtually impossible for a minor to create an account and place bets.
But we need to go beyond onboarding: continuous behavior monitoring, periodic re-verifications, and alerts for unusual activity help identify accounts that may have been opened using someone else’s information.
Awareness campaigns also play an important role—bettors need to understand that an unlicensed betting site does not guarantee payouts, does not protect their data, and has no commitment to responsible gaming. Additionally, initiatives targeting parents and schools must make it clear that curiosity (the main motivator for accessing betting sites, according to research) is not harmless when it leads a teenager into an unregulated betting environment.
Technology providers need to take a stand
Another key area is collaboration with payment providers. Banks, fintech companies, and Pix operators can (and should) make it more difficult to conduct transactions and restrict financial flows with platforms not authorised by the SPA, as well as block transactions by minors with betting platforms.
And finally, the technology provider ecosystem itself needs to take a stand. KYC, anti-fraud, and age verification solutions that currently serve the regulated market should feed into intelligence databases that help identify patterns of illegal activity and assist authorities in mapping these platforms.
Commitment to credibility
In the coming days, to further this discussion, we will also launch a podcast dedicated to the Digital ECA, featuring experts in digital law, data protection, and regulation, including those who helped draft the legislation. This discussion goes beyond compliance. It addresses how age verification serves as a protective infrastructure for the entire Brazilian digital economy.
The iGaming ecosystem as a whole—operators, technology providers, regulators, and civil society—must continue to treat the protection of minors not as a bureaucratic obligation, but as a non-negotiable commitment that underpins the credibility and future of the regulated market in Brazil.
Anyone who wants to understand what’s coming next—and who’s leading this conversation— knows where to find us.
Guilherme Bauab is co-CEO of Legitimuz, a Brazilian identity verification and fraud prevention platform.
Legitimuz is a Brazilian IDtech company specialising in identity verification and fraud prevention. Using proprietary technology, the company combines contextual data, Intelligent Liveness Detection, and device intelligence to identify behavior that indicates fraud before it escalates—without affecting legitimate customers.
It has over 150 clients, processes more than 400 million verifications per year, and operates at a capacity of 25 liveness checks per second. Committed to governance, LGPD (Brazil’s General Data Protection Act), and data protection, it holds ISO/IEC 27001, iBeta, and GLI certifications, and has already prevented over R$ 100 million (USD 20 million) in fraud.
Original article: https://igamingbusiness.com/sustainable-gambling/responsible-gambling/when-minors-gamble-underage-gambling-brazil-legitimuz-guillerme-bauab/
