A self-exclusion scheme should be judged on what a person can accomplish on their worst evening, not on what its founding ordinance promises in the calm of the Diário Oficial. The ministry’s own pitch for the central platform is that it works de uma só vez — all at once — which says plainly enough what came before: the same request, repeated operator by operator, by the people least able to sit that out. One request now reaches the whole authorized perimeter. That is the correct shape; the reservations are about its edges.
The file
What the design gets right
One request, the whole perimeter. Per the Finance Ministry’s account of the platform, registering a CPF closes active accounts across authorized sites and makes that number unusable for new ones. The point is not convenience. Every operator-by-operator scheme leaks at the same seam: the account opened two years ago under a brand you no longer connect to the group that owns it. A CPF-level block does not run on the user’s memory, the faculty least available in the middle of this.
It follows the advertising, not just the account. Per the ministry, a registered CPF also drops out of targeted betting advertising. It is the clause most easily left out, and leaving it out produces a predictable failure: someone who has closed every account and then spends six months being retargeted by the industry they left. It gives the warning strip we assessed as disclosure design a companion: one governs what everyone sees, the other who is shown anything.
The commitment is hard to unwind by design. A fixed term cannot be lifted before it expires; the indefinite option takes twelve months to reverse. Cooling-off periods cancellable at 2am are decorative. The friction is the product.
The numbers are published. The ministry set out uptake and stated reasons in its 13 August figures — over 1.2 million requests, two-thirds of them indefinite. A tool whose usage is disclosed can be argued about; one whose usage is not can only be believed.
Where it gives way
The perimeter is the ceiling. This blocks accounts on authorized platforms and does nothing to a site outside that framework, and displaced demand does not evaporate at that boundary. Not a drafting defect: no ministry form binds a company that never sought authorization. But it caps what a user should expect.
Seventy-two hours is a long night. Per the ministry, operators are notified automatically and have 72 hours to apply the block. The person who submits that form has just done the hardest thing available to them, and the answer is a window in which existing accounts may still take a deposit. The gap sits where the risk is highest.
The identity gate excludes some who need it. A silver or gold gov.br account — the level the SPA’s guidance page sets — is reached by facial matching, accredited-bank validation or a digital certificate, per gov.br’s own description of its tiers. Sound anti-abuse design — nobody should be able to self-exclude a stranger — but the tool is therefore unavailable, tonight, to anyone holding only a basic account. The moment of resolve and the moment of identity verification are not the same moment; the scheme assumes they are.
One month is the shortest thing on offer. Between carrying on and stopping for thirty irreversible days there is nothing, and that absence pushes a hesitant user toward doing nothing. Two-thirds choosing indefinite may reflect resolve; it may equally reflect a menu with no gentler option. Nor, on the ministry’s own account of what the block reaches, does any of it touch the bank app: platforms, not transfers.
Verdict
None of the shortfalls are conceptual. A shorter cool-off tier, a same-hour block and a lighter verification route for exclusion-only requests would close most of them. Until then, treat the form as the strong end of a range rather than the whole of it: the deposit ceiling set in an unremarkable hour still does the daily work this instrument performs once. The machinery that bars people without their asking is a separate question, covered on the news desk.