As part of GamesIndustry.biz’s year-end, we’re welcoming back Leon Y. Xiao of Beclaws to provide his annual look at the state of lootbox legislation worldwide.
Welcome to another “re-run banner” for the annual loot box state of play. This year, we saw only one country, Brazil, summon the “legendary” and almost certainly unenforceable position of banning loot boxes for under-18s. Meanwhile, most other countries continued discussing the application of consumer law to provide transparency and prohibit egregious practices – a far more “common” approach.
As in previous years, unless the regulatory position has changed or new research has shed light on policy implementation in a certain jurisdiction, it won’t be covered here. You can find details in my previous reports from 2022, 2023, and 2024 (although note that some elements in those articles may now be outdated).
United States: FTC–Genshin consumer law settlement
In January 2025, the US Federal Trade Commission (FTC) announced its regulatory settlement with Cognosphere – the international distributor of Genshin Impact, produced by the Chinese company miHoYo. The FTC alleged that Cognosphere violated children’s privacy and consumer law, which was neither admitted nor denied by Cognosphere, but it agreed to pay a US$20 million fine and importantly, make game and monetisation design changes. (For context, this amount is less than 4% of the earlier US$520 million settlement between the FTC and Epic Games in relation to children’s privacy and consumer law concerns surrounding Fortnite.)
The alleged violations included, among other things:
- Misrepresenting and exaggerating winning probabilities;
- Paying a streamer to release a doctored loot box opening video showing impossible results; and
- Using multiple virtual currency exchanges to confuse children and obfuscate the real-world monetary price of loot boxes.
There has been no determination as to whether the aforementioned acts contravened US consumer law and whether all of the agreed design changes detailed below were wholly necessary to become compliant (less may already have been sufficient). However, companies operating in the US are well-advised not to engage in any of the behaviours identified as problematic in the complaint.
Cognosphere agreed to make the following and other changes:
- Prohibit under-16s from purchasing loot boxes unless express parental consent has been obtained (requiring the implementation of age verification);
- Prohibit the exclusive sale of loot boxes through a premium virtual currency (which in turn is purchasable with fiat currency) without an option to buy the loot boxes directly with fiat currency;
- Disclose, on the loot box purchase screen without requiring any additional inputs from the player, accurate probabilities and the range of potential costs in fiat currency for obtaining featured or “chase” rare rewards; and
- Disclose, on the virtual currency purchase screen without requiring any additional inputs from the player, the varying numbers of loot boxes that can subsequently be purchased with each virtual currency bundle.
Cognosphere has started implementing the required amendments, some of which are shown in the screenshots below. However, full compliance remains to be assessed, and the additional US information disclosures and features are not available in other regions.
Notably, this settlement was announced in literally the last few days of the Biden administration. The FTC has changed significantly since then. The current Chair, Andrew Ferguson, actually dissented as to multiple loot box- and virtual currency-related points for, among other things, “[infantilizing] the American consumer” and a lack of sufficient evidence as to harm, while noting that he does not “favor the loot-box scheme.”
Notwithstanding, this is a reminder that across all jurisdictions, general consumer law applies to video games and egregious practices are prohibited, irrespective of gambling regulation.
Brazil: Loot box ban for under-18s
In September 2025, Brazil adopted a youth online protection law, one aspect of which is to prohibit loot boxes in video games aimed at, or are likely to be accessed by, children and teenagers. (The lower house of the legislature actually attempted but failed, prior to adoption, to water down the loot box prohibition to specific design restrictions and harm minimisation, an arguably more practicably achievable approach.) The ban will take effect from March 2026, but the implementation details (such as whether and how to conduct age assurance) have yet to be revealed.
This brings to mind Belgium, the only country that tried but failed to “ban” loot boxes because the gambling regulator had little-to-no resources to monitor and enforce the law. It is difficult to envision the Brazilian law being well-implemented given prior international experiences of poor compliance with and enforcement of loot box rules. However, Brazil is a vastly more important market than Belgium both in terms of player count and revenue. Companies would be less willing and likely to just abandon their lucrative Brazilian operations, which a few have done in Belgium by withdrawing their games or stopping the sale of loot boxes in that country.
Belgium: Refund for money spent on illegal loot boxes?
Speaking of Belgium, the position has not changed: the “ban” on loot boxes based on pre-existing gambling law continues to apply but also continues to be unenforced and not complied with. However, a judgment was handed down in an interesting case in which a Belgian player sued Apple as the app store operator (and with whom a contract to buy in-game purchases was agreed) and importantly, not the video game company, the Beijing-based RiverGame, to try to obtain a refund for money spent on illegal loot boxes in Top War.
The case of LS v Apple confirmed that paid loot boxes constitute illegal gambling under Belgian law. However, as to liability for hosting a third-party video game containing illegal products on the App Store, Apple tried to argue that it has immunity because it lacked specific knowledge of the illegality involved with the individual game of Top War. The court identified that Apple would have known about the general situation that all loot boxes are banned in Belgium; however, it is unclear whether this broad knowledge would remove Apple’s immunity. The Belgian court could not decide and instead referred various questions to the Court of Justice of the European Union (CJEU), which determines the final interpretation of EU law, for clarification.
Unfortunately for the public, the parties settled before the CJEU heard the case, so the referral has been withdrawn. The settlement terms are not known. We might well see more cases filed against Apple, Google, and other gaming storefronts to recover money spent on illegal loot boxes in Belgium. Other claims based on the illegality of certain loot boxes under consumer law (which applies to and could therefore work in other EU countries beyond Belgium), rather than gambling law, might also be attempted.
Australia: Games with loot boxes must be age rated at least 15+
From 22 September 2024, Australia has required games with “in-game purchases linked to elements of chance” (so, paid loot boxes) to be rated at least M (meaning not recommended for under-15s). This rule applies both to games released on or after that date and importantly, also to games released previously that subsequently changed their loot box offerings (such as by adding new loot boxes and adding new prizes to existing loot boxes).
The Australian Government failed to accurately and promptly inform the industry of this policy change (particularly the second part about quasi-retroactivity) even though it was adopted a year earlier. Guidance was only published a mere four days before the policy was implemented – giving companies no realistic prospect of complying in an informed manner, unless they otherwise took costly legal advice. Other countries should give companies a fairer chance to comply.
Indeed, a team led by University of Sydney researchers) found that many popular mobile games published before 22 September 2024 – which represent the vast majority of the highest-grossing mobile games today – had substantively updated their loot boxes since then. This automatically invalidated their previous age rating, but they did not duly increase their age ratings (or more precisely, they continued to display their older and now invalid age rating). Companies selling loot boxes in Australia should be mindful to avoid this, because marketing a game with an invalidated age rating constitutes both federal and state/territory crimes.
EU: Virtual currency, protecting minors, and the forthcoming Digital Fairness Act
In the EU, technically no law has changed, but there were three important developments.
Firstly, in March 2025, with European Commission support, the Consumer Protection Cooperation Network consisting of EU consumer regulators published the Key principles on in-game virtual currencies. This represents the regulators’ strict interpretation, which might have gone above and beyond actual legal requirements, but we won’t find out until the court is asked to interpret relevant EU law in the video game context.
Notably, an equivalent price in euros (instead of or in addition to a price in premium virtual currency) must be shown for all in-game purchases. Requiring players to exchange between multiple currencies before making an in-game purchase is also prohibited. Nearly all companies are likely non-compliant, as the requirements are more extreme than industry expectations. Companies should consider complying to be safe.
Secondly, in July 2025, the European Commission published guidelines on the protection of minors under Article 28 of the Digital Services Act, which requires that “online platforms accessible to minors shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service.” The Commission considers loot boxes to be a consumer risk and requires that specific measures should be adopted to address them.
In particular, minors should not be exposed to loot boxes to avoid “excessive or unwanted spending.” This appears to be a sneaky way to basically demand an under-18 loot box ban by forcing app stores and games with user-generated content (such as Roblox) to implement it on the basis of the Digital Services Act, which was not specifically debated in that context and therefore is questionable under the rule of law for lacking due process.
Thirdly, in Summer and Autumn of 2025, the European Commission consulted on the forthcoming Digital Fairness Act, which is expected to contain provisions relating to video game regulation and in particular, virtual currencies and loot boxes. The exact terms are not yet known, but stakeholders should keep a careful eye out for the draft, which is expected in late 2026, and provide their perspectives to ensure evidence-based and appropriate regulation.
Netherlands: My.Games advertising ruling
The Dutch advertising self-regulator published a comprehensive loot box-, in-game purchase-, and in-game advertising-related ruling against MY.GAMES confirming, among other things, that:
- Loot box presence must be disclosed on the app store product page;
- Loot box probabilities of obtaining different individual rewards must be disclosed (even when multiple rewards have an equal chance of being obtained, which also needs to be clarified); and
- All in-game purchases must show a euro-equivalent price (aligned with the aforementioned EU position pronounced by consumer regulators, which was adopted for the first time in an enforcement context).
It was unfortunate that My.Games sought twice to fruitlessly appeal even the obvious points, wasting all parties’ resources and delaying the publication of the ruling. Companies are well-advised to consult external counsel and resolve regulatory complaints efficiently.
UK: Poorly implemented UKIE industry self-regulation and more advertising rulings
Broadly, the implementation of the UKIE industry self-regulatory principles has been poor, with low compliance and little enforcement. UKIE purported to dispute my claims and disappointingly, failed to recognise and address the obvious problems that are plain for all to see.
I await the UK Government’s publication of the research it has commissioned on the issue, which UKIE has recognised as ‘quality impartial research.’ That report was scheduled for completion in March 2025. The government said in July 2025 that the findings were being finalised and promised to publish a report in due course without stating exactly when. This report has not yet been published. The significant delay is unfortunate. I hope to see the results promptly in early 2026 so that more effective policies can be formulated.
On the enforcement front, the Advertising Standards Authority published three rulings relating to loot boxes. The rulings against Kabam and Nexters confirmed that a loot box presence disclosure is required on app store product listings, irrespective of whether the game company is UK-based.
The ruling against Hutch re-affirmed that loot box presence disclosure must not only be made but also, unsurprisingly, be reasonably visually prominent (so, automatically shown to the consumer without requiring them to perform an additional step, such as clicking on a hyperlink, to actively seek out the information).
Further, the probabilities of winning different prizes from loot boxes must not be presented misleadingly. Hutch was found to have misled consumers by presenting a loot box as a prize wheel showing equal spacing for each circular sector (and therefore implying equal probabilities, as that is how consumers expect real-life prize wheels to operate) for all possible rewards when that was not the case. The size of each circular sector should reflect the relevant reward’s corresponding chance of being obtained.
South Korea: Probability and presence disclosures
Since March 2023, South Korea has explicitly required loot box probabilities. Another related but less often discussed requirement is that any advertising of games with loot boxes must use a specific Korean phrase “확률형 아이템 포함 [Includes probabilistic items]” to disclose their presence. We found poor compliance on social media as most companies failed to disclose loot box presence at all and the few that disclosed in English are also not compliant.
Turkey: Advertising ruling against physical mystery boxes
The Turkish regulator found that the advertising of physical mystery boxes purporting to offer random electronic goods on Instagram was unlawful because the probabilities of obtaining different prizes were not disclosed and a fake countdown timer was used to pressure consumers into purchasing. This has implications for loot boxes under Turkish regulations, because broader consumer law requiring basic transparency and prohibiting unfair practices in all commercial contexts naturally also applies to video games worldwide.
Global: Increased scrutiny of loot boxes and video games
International Consumer Protection and Enforcement Network (ICPEN) is an international network of consumer regulators. In June 2025, it published the results of an international study examining “manipulative design practices” in video games. The method was frankly rudimentary and not explained in detail, and the problems identified are already well-known. However, the fact that ICPEN investigated should give companies pause about future non-compliance. Attention is finally being paid by regulators to the now well-established video game industry (which is something to be proud of, rather than shirk away from).
Disclosure: I was and remain involved with loot box-related policy developments, including several regulatory complaints discussed above. Readers may refer to the original sources linked to verify my interpretation. As before, this is not legal advice. This regulatory area is increasingly fragmenting and becoming more complex (e.g., requiring strict age assurance). Companies are well-advised to seek independent legal advice now and make preparations to avoid future headaches.
I thank Laura Henderson for assistance in preparing this article.
Via: gamesindustry.biz
