Loot Box State of Play 2024: Another trip around the world of regulation

We are back for another look at how different countries are regulating loot boxes. There is certainly less preoccupation with the legal question of whether loot boxes are banned as a form of gambling. Unless your paid loot boxes offer random rewards that can subsequently be transferred between players, I generally wouldn’t worry (except in Belgium where all paid loot boxes are banned).

However, several countries have imposed various requirements that must be separately complied with, mostly focused on:

1. Disclosing the presence of loot boxes in product listings and advertising
2. Disclosing loot box probabilities in specific ways
3. Imposing minimum age ratings against games with loot boxes.

These rules stem from either consumer protection law or newly created dedicated regulations.

You can catch up with previously imposed rules by reading the 2022 and 2023 editions of this series. Unless mentioned again, the rules remain as they were.

Unless your paid loot boxes offer random rewards that can be transferred between players, I generally wouldn’t worry

For those more legally and technically minded, further details are available in Section 2.2 of my PhD thesis on loot box regulation. Source materials in their original language (which is what should ultimately be relied upon) have been compiled in a repository for review.

As before, when I speak of ‘loot boxes,’ I very broadly mean any in-game purchases with randomised elements that are bought with real-world money, or with premium in-game currency that is bought with real-world money (so-called ‘paid loot boxes’). Basically, the player does not know exactly what they will randomly get as part of a purchase involving real-world money. This includes gacha mechanics and social casino games, for example.

Belgium: Ban on loot boxes

Some companies remain non-compliant with the Belgian gambling law requirement that loot boxes are prohibited. Very recently, Pokémon Unite decided to comply by disallowing in-game purchases by Belgian players and will eventually entirely withdraw services from the country.

We know the Belgian gambling regulator is struggling to actively enforce the ban and even recently admitted that a ban is disproportionate, but it could, at any moment, decide to criminally prosecute companies for illegally selling loot boxes. Please respect the law by either removing your games with loot boxes from that country or releasing an alternative version without paid loot boxes.

Additionally, advertising of games with loot boxes should not target Belgian users (there is usually an option to exclude them from being targeted, e.g. with social media ads). Doing so not only ensures legal compliance but also prevents wasting advertising costs on Belgian players who can’t (or at least shouldn’t be able to) play your games containing loot boxes anyway.

The Netherlands: Permitted but must follow consumer protection rules

Following a March 2022 court decision, all paid loot boxes (including those offering rewards that can subsequently be transferred between players) are lawful in the Netherlands. Even so, companies have been overly cautiously ‘complying’ by also not offering loot boxes to Dutch players since then, but that is unnecessary.

It is permitted to sell loot boxes in the Netherlands, and it would be remiss of me not to accurately inform you as such. In addition, the previous Dutch Government wanted to ban loot boxes to effectively overturn the court decision. However, a new Government is now in power, and it has confirmed to me in September 2024 that it does not have such plans.

However, being permitted to sell loot boxes does not mean that no other rules apply. In-game purchase offers must comply with overarching consumer protection law. The Dutch consumer protection regulator has published relevant guidelines, which companies should comply with.

The regulator recently fined Epic Games over €1.1 million for various breaches of consumer protection law that occurred when the company offered in-game purchases in Fortnite (an appeal is pending). This indicates that the national regulator is willing to act, and loot box-related enforcements may also be imminent in the Netherlands and elsewhere.

EU and beyond: Consumer protection law requirements

As to the consumer protection law requirements that are most pertinent to loot boxes, two issues should be highlighted. Firstly, any advertising for video games must make clear that the game contains loot boxes, if relevant. Secondly, loot box probability disclosures are required.

Respect [Belgian] law by either removing your games with loot boxes or releasing an versions without paid loot boxes

Both have been explicitly interpreted as required by the European Commission and communicated as such to the European video game industry representative bodies. The Netherlands, Italy, and the UK (applying EU rules adopted pre-Brexit) have sought to enforce these aspects.

Other consumer protection law requirements, such as not falsely advertising products as being available for a limited period of time only to make them available for purchase again later, must of course also be complied with.

The forthcoming EU Digital Fairness Act is also expected to better regulate loot boxes and in-game currencies, according to the new commissioner Michael McGrath, although it is unclear what specific rules will be imposed.

Austria: Even more contradictory cases

In relation to loot boxes whose random rewards can be transferred between players (i.e., the type I told you to worry about), players have successfully claimed for refunds in relation to loot boxes from both the FIFA (now EA FC) and Counter-Strike series.

The loot box purchasing contracts were deemed to be illegal (because the product being offered contravened gambling law and was illegal) and therefore reversible. This meant that some players were able to claim for refunds if they wished to do so and were dedicated enough to follow through with litigation.

At the same time, other cases on the same ground have failed, with the court instead finding that the relevant loot box was lawful, and, by extension, the contract was valid, and therefore no refund was owed by the company to the player. Michael Linhard of Salburg Rechtsanwalts – a law firm representing players seeking refunds – has confirmed that an appeal to the Supreme Court has been filed and that a decision is expected before Summer 2025, which will hopefully definitively answer the legal question. Although technically non-binding, a Supreme Court judgment will be highly persuasive and precedent-setting.

The players’ legal actions were generally supported by litigation funders, who would wish to publicise their success in order to find more clients. Similarly, video game companies are incentivised to publicise their contrary success to dissuade further claims. This has meant that either side has promoted their own wins and so the public has not received the most balanced reporting.

Germany: 12+ age ratings for loot boxes

Having reviewed all decisions made by the German national age rating organisation, the USK, in 2023 under updated rules, I can confirm that all games with loot boxes have been rated USK 12 (approved for children aged 12+), including games whose previous annual editions were rated merely USK 0 (approved without restrictions).

The USK said that the decisions have been, and will continue to be, made on a case-by-case basis, so a deviation (i.e., a lower age rating of USK 0 or 6 for a game containing loot boxes) is hypothetically possible. However, given this established practice and the lack of any deviation thus far, companies offering games with loot boxes should prepare to receive at least USK 12 in Germany.

In addition, the USK has confirmed that for digital app storefronts (e.g., the Google Play Store), all games with loot boxes will automatically receive USK 12 at a minimum because it is not possible to manually review each game. This automatic system is currently being implemented.

In contrast, PEGI in Europe and the ESRB in North America merely highlight loot box presence and do not account for it when making age rating decisions, although PEGI has punished companies with fines for both (i) not disclosing loot box presence when the game contains them and (ii) incorrectly disclosing loot box presence when the game does not actually have them. The ESRB does not publish any information on enforcement actions taken but is empowered to heavily fine companies.

Because different age rating organisations are dealing with loot boxes in divergent ways, we now have the rather contradictory situation where a game’s physical box sold in the UK displays PEGI 3 on its front, but when the box is opened, the disc inside displays USK 12 instead. This is done because of the manufacturing process but is certainly going to confuse consumers and parents who may not understand the intricacies of different age rating systems and potentially erode their trust in these systems overall.

We now have the rather contradictory situation where a game’s physical box sold in the UK displays PEGI 3 on its front, but when the box is opened, the disc inside displays USK 12 instead

Australia: M (Not recommended for under-15s) age ratings

A rule similar to the German one started applying in Australia from 22 September 2024. Games with loot boxes will receive the M (not recommended for children under 15) rating at a minimum from the Australian Classification Board, whilst games with simulated gambling will receive R 18+ (legally restricted to adults only). Games that were rated prior to 22 September 2024 may keep their older (lower) rating even though they contain relevant mechanics.

However, if the game’s loot boxes or simulated gambling mechanics are updated after 22 September 2024, the game will automatically become unclassified and illegal to be offered by operation of law, until the game is re-rated under the new rules. Such updates include introducing new loot boxes and amending the potential rewards of existing loot boxes.

Genshin Impact and Zenless Zone Zero, for example, were both released before 22 September 2024 but have had their age ratings increased to M after 22 September 2024 following my complaints due to the company having made loot box-related updates that invalidated the games’ previous ratings.

Importantly, the simulated gambling rule applies not just to so-called social casino games that allow players to spend real-world money on simulated gambling mechanics (playing on slot machines or poker) without the possibility of converting any winnings back into cash. Games with interactable simulated gambling mechanics that do not involve real-world money through in-game purchases will also get R 18+.

Interactive traditional gambling motifs (e.g., slot machines) are heavily regulated irrespective of whether they involve real-world money. This emulates the PEGI 18 rule for such mechanics that has applied in Europe since 2020. Companies should carefully consider whether to portray traditional gambling in their video games.

Mainland China, Taiwan, and South Korea: Specific probability disclosure rules

In 2023, the Shanghai-based company behind Survivor.io was fined CN¥10,000 (£1,100) in Mainland China for failing to disclose loot box probabilities as this was deemed to have been a breach of consumer protection law. Companies operating in China are therefore urged to be even more cautious: please ensure that every loot box, however minor, has a probability disclosure.

I also note that the draft law intending to heavily regulate many aspects of online games published at the end of 2023 is highly unlikely to be adopted.

Beyond merely requiring probability disclosure for loot boxes, companies should also ensure compliance with more specific and unique rules. In Taiwan, the probabilities must be disclosed as percentages and the following message or equivalent must be displayed: ‘此為機會中獎商品，消費者購買或參與活動不代表即可獲得特定商品 [This is a product with a chance to win prizes. Consumers’ purchase or participation in the event does not mean that they will obtain specific products.].’

South Korea has now published detailed guidance in both Korean and English about how legally required disclosures should be made. In particular, any disclosed probabilities must be exact: for example, ‘< 1%’ is unacceptable as it fails to provide sufficient detail. This has forced EA to publish better probability disclosures for Apex Legends.

So-called pity mechanics that eventually guarantee a rare reward after a predetermined number of loot box openings also require a separate probability disclosure if any randomisation is involved in the determination of the pity reward. Any website disclosure must be text-searchable and must not be shown as screenshots or images of tables that are difficult to parse.

Finally, any advertising for video games with loot boxes must disclose their presence using the specific phrase of ‘확률형 아이템 포함 [includes probabilistic item(s)].’

UK: UKIE industry self-regulation takes effect and advertising decisions

From 18 July 2024, the UKIE industry self-regulatory principles on loot boxes became effective. I can already report that many popular games in the UK failed to comply after that date despite having been given a grace period of one whole year: e.g., not providing probability disclosures as required and not disclosing loot box presence on social media adverts. I would urge voluntary compliance, as poor compliance now will mean stricter regulation in the future that severely curtails industry interests.

The UK advertising regulator (the Advertising Standards Authority) has upheld four complaints that I made against companies that failed to disclose loot box presence. Many other complaints against other companies have also been informally resolved through the regulator’s compliance team writing to the relevant companies to demand compliance.

Loot box presence is material information that must be given to consumers on app store product listings and all forms of advertising, e.g., social media adverts. The disclosure text must also be sufficiently visually prominent: flashing some very small text for a quick second is not good enough and still illegal. Please ensure that consumers are properly given the information that they have a legal right to receive.

In Ireland, I have also sought stricter enforcement of consumer law and advertising rules. No decisions have been published by the Advertising Standards Authority for Ireland (ASAI) as the relevant companies have decided to comply after being informed of my complaints. I can share that it is required that app store listings disclose loot box presence.

However, the ASAI also ruled that social media advertising needs not also disclose loot box presence if it links to a store listing that discloses. This is contrary to the UK position and likely incongruent with EU consumer protection law (because engaging with the social media ad to visit the store listing is already a ‘transactional decision’ that was made without the provision of material information within the meaning of the Unfair Commercial Practices Directive). I would advise making the disclosure on social media ads as well to avoid unnecessary risks and also to treat consumers more fairly.

Spain: Loot boxes with transferable content to be banned for under-18s

A draft law intending to regulate loot boxes was previously published in 2022. However, that law failed to pass.

A new draft law on protecting young people online was published in 2024, and the only provision is that paid loot boxes whose rewards are transferable between players are banned for under-18s. Most companies need not be concerned, but those offering loot boxes like the ones found in the EA FC series and Counter-Strike 2 are advised to make relevant preparations to comply.

Brazil: Loot boxes to be confirmed as illegal

A similar draft law intending to better protect young people online is slowly progressing through the Brazilian legislature. If passed, the loot box-relevant provision will confirm that these products are already a form of illegal gambling that neither children nor adults may participate in under pre-existing criminal law.

US: Poor legal arguments inevitably fail

Many others and I have commented before that various civil cases brought in the US against video game companies by players in relation to loot boxes were without any merit. This has been proven true, for example, with the appeal of Mai v. Supercell Oy ending in Supercell’s favour, although other cases remain live. Most loot boxes are not illegal gambling in most jurisdictions, and companies are generally permitted to implement them. Fallacious legal arguments won’t change that fact.

Full disclosure: I have personally been involved in some of the enforcement actions mentioned. The presentation of the various regulations is frank and fair, but companies are advised to seek independent specialist legal advice.

It is very unfortunate that many online media reporting of legal developments, publications from consumer organisations, and even official press releases from governments are often wrong or inaccurate about the law. It is risky for companies to rely on such sources. The area is becoming increasingly complicated, and multi-jurisdictional legal advice is often needed to ensure global compliance.

I thank Laura L. Henderson and Solip Park for their assistance in preparing this article.