Abstract
Loot boxes can be bought with real-world money inside video games to obtain random items of varying value. Although these mechanics are gambling-like, they are widely available for purchase, including in children's games. Many countries are considering better regulation. The rapid regulatory and policy developments and proposals across the world in recent years are summarized: (i) probability disclosure requirements in Taiwan, South Korea, and China; (ii) enforcement of gambling law in Belgium, Austria, Finland, the Netherlands, France, the UK, and Australia; (iii) enforcement of EU consumer protection law in Italy, the Netherlands, and the UK; (iv) age ratings and warning labels in Germany, Australia, and the U.S.; (v) expanding the legal definition of “gambling” so as to encompass loot boxes in Finland and Brazil; (vi) the ambitious dedicated regulatory regime in Spain; (vii) class action civil litigation in the U.S. and Canada; (viii) industry self-regulation in the UK; and (ix) attempts to ban online games of chance in India.
INTRODUCTION
Loot boxes are virtual items in video games that players open to obtain random rewards. The rewards are usually of varying value with the rarer rewards being highly desirable and valuable (both in terms of within the players' own perception and, where it is possible to buy and sell in-game items between players, in terms of their real-world monetary value 1 ). The more common rewards are generally undesirable and often nearly useless because they would be a duplicate or even a weaker version of other items the player already possesses. Some loot boxes can be obtained through gameplay (e.g., defeating an enemy) or otherwise opened without paying real-world money. Regulation and this article are, however, focused on loot boxes that are purchased with real-world money. This is because such paid loot boxes are conceptually and psychologically similar to gambling in that the player spent real-world money to participate in a randomized process to obtain rewards of varying value with the possibility of either “losing” (by obtaining a more common reward) or “winning” (by obtaining a rarer reward). 2 Hereinafter, references to “loot boxes” refer to paid loot boxes unless otherwise specified.
Besides referring to a specific visual implementation of monetization mechanics whereby the player spends real-world money to open a virtual box to obtain random content, “loot boxes” is also used as a short-hand term by researchers and player communities to refer to other products and mechanics inside video games that are bought to receive random rewards. 3 These include, for example, character summoning systems where the results are randomized and unknown at the point of purchase, which are often referred to by players as “gacha.” 4 Other such mechanics are depicted as “card packs” reminiscent of physical collectible and trading card games 5 or even portrayed using traditional gambling motifs, such as prize wheels and slot machines. The rather unwieldy term of “in-game transactions with randomized elements” is used by the Entertainment Software Rating Board (ESRB), which moderates video game content and provides age ratings in North America, to refer to all such mechanics. 6 This includes so-called social/simulated casino games wherein the player is able to spend real-world money to participate in traditional gambling activities but can never convert any winnings back into cash. 7 Hereinafter, the short-hand usage of “loot boxes” is adopted and takes the same meaning as the ESRB's terminology. Importantly, paid loot boxes can be subdivided into two categories: (a) “Embedded-Embedded” and (b) “Embedded-Isolated” loot boxes. 8 The former refers to loot boxes that (i) cost real-world money to purchase and (ii) whose content is transferable between players and thus have real-world monetary value (i.e., can be “cashed-out” 9 ). The latter refers to those that are (i) bought with real-world money but (ii) whose content cannot be transferred between players and thus do not possess real-world value (i.e., cannot be cashed-out). 10 This distinction is highly relevant for regulatory purposes.
Loot boxes are widely available in contemporary video games, 11 particularly on mobile platforms, where approximately 75% of the highest-grossing games would sell them in Western contexts 12 and about 90% would in Far East Asian markets. 13 Games classified as being suitable for young children would also often contain loot boxes, 14 such that 23% of UK 11–16-year-olds reported purchasing them in 2019, 15 as did 24% in 2022. 16 Many countries have considered or are considering regulating loot boxes because of their similarities to gambling and broader consumer protection concerns regardless of gambling connotations (e.g., lack of transparency). 17 Comprehensive reviews of the regulatory positions in various territories have been conducted by Schwiddessen and Karius between 2017–2018, 18 Moshirnia in 2018, 19 and Derrington et al. in 2020, 20 amongst others. However, loot box regulation is a rapidly moving policy area.
South Korea 21 and Taiwan 22 have since adopted new regulations for loot boxes, specifically, requiring probability disclosures. Advertising and consumer protection regulators in the UK 23 and theNetherlands 24 have also published guidelines in relation to loot boxes to assist companies with complying with existing EU regulation (that would likely be applicable to other EU countries as a consequence of harmonization). Two court judgments have respectively determined that loot boxes are legal (or rather not regulable) inthe Netherlands 25 but are illegal in Austria 26 under existing gambling law. Similarly, litigation has progressed in several Canadian 27 and U.S. 28 cases.
Prospective regulations have also developed. Draft laws or bills intending to regulate loot boxes have been published in Spain, 29 Finland, 30 Australia, 31 and Brazil (where two conflicting bills, one intending to legalize and the other intending to criminalize loot boxes, are simultaneously under consideration). 32 The UK Government concluded its consultation process on loot boxes 33 and decided upon the approach of relying on industry self-regulation rather than legislating; 34 the relevant self-regulatory guidance has since been published. 35 The Australian Government has also published its regulatoryproposal intending to require games containing loot boxes to be rated suitable only for people aged 15+ ata minimum. 36
Empirical policy research testing compliance with, and the effectiveness of, adopted regulation (e.g., Belgium's ban on loot boxes 37 and industry self-regulatory loot box presence warning labels 38 ), which allows for more informed commentary, has also advanced. Lastly, legal developments in Italy (where the consumer protection authority has enforced the EU Unfair Commercial Practices Directive (UCPD) 39 to force companies to disclose loot box presence and make probability disclosures) and Finland (where prosecution of illegal loot boxes was considered but could not proceed due to lacking jurisdiction) 40 and the “compliance” action taken by Valve in France in relation to Counter-Strike: Global Offensive (CSGO) (Valve Corporation, 2012) of changing how loot boxes are implemented, although predating the publication of prior works in the legal literature, were not analyzed previously.
This article therefore collates and presents all regulatory and policy developments that are known to me. The relevant documents (with redactions of personal and sensitive information as needed) are archived and made publicly available at the data deposit link found in the first footnote containing the Data Availability Statement. This article aims to be comprehensive but cannot claim to be perfectly so because the developments in some territories might have been missed due to language barriers. A summary of these developments is provided alongside some commentary: I hope that the data deposit link would act as a resource that would encourage further in-depth discussions.
For context, the psychology literature on loot boxes has also advanced in the past five years. Previous empirical research has consistently found a link between loot box spending and problem gambling, which has been relied upon to argue that the product is potentially harmful. 41 There are multiple potential explanations for this relationship: (i) people who developed problem gambling issues through traditional gambling may be disproportionally spending more money on loot boxes; (ii) people might be developing problem gambling issues through engaging with loot boxes; or (iii) some other explanation. The oft-cited weakness of previous studies is that they have all been cross-sectional, meaning that they could not prove directional causation, i.e., that loot boxes are causing harm, such as the development of problem gambling issues amongst video game players through purchasing loot boxes. However, two longitudinal studies examining the relationship between loot boxes and traditional gambling have recently been published. A positive relationship between purchasing loot boxes and participating in traditional gambling six months later has been found amongst Spanish young people. 42 Similarly, this relationship was found amongst U.S., UK, and Canadian young people; in addition, those who purchased loot boxes were also more likely to spend more money on traditional gambling. 43 Longitudinal studies that span longer periods of time remain forthcoming but the evidence base has improved such that there is now stronger and more reliable support for loot box regulation than before.
PROBABILITY DISCLOSURE REQUIREMENTS
This article begins with the two regions that have adopted new regulation that is already affecting, or will soon affect, companies. In contrast, most of the developments in other countries dealt with later are prospective and unconfirmed and may not necessarily be relevant for compliance purposes.
Taiwan: probability disclosures required since 1 January 2023
In July 2022, the Consumer Protection Committee of the Executive Yuan announced
44
the approval of an amendment to the regulatory document concerning online video games.
45
Article 6 thereof now provides that games offering “中獎商品或活動 [lottery-winning products or activities]” (i.e., in-game purchases that involve randomization very broadly defined and specifically including cases where the loot box is “earned” by players for free through gameplay but must be opened using a “key” that must be purchased using real-world money
46
) must disclose the percentage probability of winning each item. This means that a “category-based probability disclosure”
47
that, for example, only reveals the percentage probabilities of obtaining specific rarities of rewards and does not provide for the exact probability of obtaining each reward within that rarity category is arguably non-compliant. The disclosure needs to be made on the homepage of the game's website, the game's log-in page, or the “purchase page” and on the physical product packaging.
48
The use of the conjunction “or” means that disclosures do not need to be made at all locations listed, and it is unclear whether “purchase page” refers to where the game can be bought or where the relevant in-game purchase involving randomization can be bought. In addition, games are required to provide a reminder stating, “
, 
[This is a chance-based product; the consumer is not guaranteed to obtain any specific product by virtue of purchasing or participating]” or a similar message to that effect.
49
These rules became effective on 1 January 2023.
South Korea: probability disclosures required from 22 March 2024
In December 2020, a bill was proposed 50 in South Korea (Hanguk) by members of the National Assembly intending to amend the Games Industry Promotion Act, which has regulated the national video games sector since 2006. 51 One of the proposals was to have Clause 59 require probability disclosures for “확률형 아이템 [stochastic or probability/chance-based items],” 52 which was to be broadly defined under Clause 2 as in-game purchases involving randomization. 53 That bill has not progressed, but this particular amendment regarding requiring probability disclosures was adopted in substance through a separate procedure on 21 March 2023. Effective from 22 March 2024, the amended Article 33 requires that the probabilities for obtaining each item (i.e., category-based disclosures would again likely be non-compliant) must be published. 54
The exact requirements as to how the disclosures should be made are to be set out by presidential decree. 55 Article 19 of the corresponding presidential decree dealing with the enforcement of the Game Industry Promotion Act (specifically, the Table 3 attached to that Decree) sets out the technical requirements for displaying other game product information already required by Article 33 prior to the amendment, such as age ratings. 56 However, the presidential decree has not yet been amended to detail how to make probability disclosures for loot boxes as of July 2023. It is as yet unclear exactly how probability disclosures should be made in South Korea. Notably, a national industry self-regulator (the Game Self-Governance Organization of Korea (GSOK) of the Korea Association of Game Industry (K-GAMES)) has been requiring and policing probability disclosures since February 2017: 57 relatively detailed instructions as to what compliant disclosures would look like have been provided (e.g., that it must be made on the “purchase page”). 58 Later revisions of the self-regulatory code contained even further detail and example implementations in order “to avoid any misinterpretation and to provide correct understanding.” 59 The future role (if any) of the GSOK is unknown.
As to enforcement, Article 38(9) of the newly amended Game Industry Promotion Act grants the relevant minister the power to order companies to make disclosures if they do not do so or else have provided false information. In addition, the minister may recommend or order the company to follow a corrective plan. Article 45 sets out the penalties for non-compliance, which may be imprisonment of up to two years or a fine of up to ₩20,000,000 (≈ £12,000). Failing to disclose loot box probabilities as required per se would not attract this penalty (Article 45(7) omits Article 33(2) and only punishes non-compliance with Articles 33(1) and 33(3)). However, non-compliance with a corrective order issued by the minister to make better disclosure under Article 38(9) is punishable (Article 45(11)). These deterrence powers are encouraging to see as they can better ensure that companies will comply.
China: dubious compliance and efficacy of probability disclosures
For many years, the mainland of the People's Republic of China (PRC) used to be the only jurisdiction to require loot box probability disclosures by law. Initially published in December 2016 and effective from 1 May 2017, the Chinese regulations have not been complied with well by the highest-grossing iPhone games. 60 Although 95.6% of games with loot boxes did make disclosures, most used methods that were visually hidden and difficult for players to access. 61 One criticism of the mainland Chinese regulation has been that it did not set out specific requirements as to how companies must comply (e.g., exactly how the disclosures need to be published and how visually prominent and accessible it must be), which resulted in giving companies discretion to comply sub-optimally and not provide maximal consumer protection. 62 The Taiwanese and South Korean regulations have not addressed this specific shortcoming by, e.g., requiring an industry-wide, uniform manner of prominent probability disclosures (although the South Korean Presidential Decree might still be amended to detail this).
A survey of mainland Chinese players also revealed that although 84.6% of players who purchased loot boxes reported seeing them, 72.4% did not report their spending behaviors changing; 19.3% reported spending less money; and 8.3% reported spending more money. 63 Therefore, even when the disclosures are seen by players, they might not be an effective harm reduction measure because the underlying purchasing behavior is rarely affected in the intended direction. Taiwan and South Korea have started to recognize the potential harms of loot boxes by requiring probability disclosures, but they and other countries may need to consider more interventionist regulations, if they wish to provide better consumer protection by more directly reducing spending.
APPLYING EXISTING GAMBLING LAW?
Besides adopting new laws to specifically regulate loot boxes, countries have also attempted to enforce existing laws. Two areas of law are particularly relevant: gambling law and consumer protection law.
Under the gambling laws of most countries, only Embedded-Embedded loot boxes legally constitute gambling, whilst Embedded-Isolated loot boxes do not, because the legal definition of “gambling” requires the prizes obtained from the loot box to possess real-world monetary value, e.g., in the UK by requiring the prizes be “money or money's worth.” 64 In contrast, Belgium's gambling law is uniquely broad in that Embedded-Isolated loot boxes would also constitute illegal gambling. 65 This distinction has already been explored in detail elsewhere. 66 Importantly, most countries' gambling regulators have not enforced gambling law against Embedded-Embedded loot boxes despite them being unlicensed and illegal under a plain interpretation of those countries' gambling laws. 67 However, there are three exceptions where gambling law has been applied, successfully or otherwise: Austria, the Netherlands, and Finland. Each country's experience presents a unique perspective. France also provides an interesting angle in that one company has purported to take rather dubious “compliance” action that is unlikely to stand up to scrutiny.
Belgium: no perceivable enforcement of “ban” on loot boxes
In April 2018, the Belgian gambling regulator published a report applying gambling law to a number of loot box implementations found in contemporaneous video games. 68 The conclusion was that any Embedded-Embedded and Embedded-Isolated loot boxes in video games would constitute illegal gambling in all cases as the regulator is unable to license such products as regulated gambling. 69 This is why it has been popularly said that Belgium has “banned” loot boxes, 70 even though this was done passively through the application of pre-existing law, rather than the adoption of new regulation. Companies have reportedly complied by (i) removing loot boxes from Belgian versions of games; 71 (ii) removing games that rely on loot boxes to monetize from the Belgian market; 72 or (iii) not publishing games that generate revenue through loot boxes in Belgium at all. 73
However, in practice, 82 of the 100 highest-grossing iPhone games on the Belgian Apple App Store continued to sell loot boxes. 74 The law has not been enforced because it is practically difficult to do so due to the vast volume of available content, 75 as separately admitted by the Belgian gambling regulator 76 and the Minister of Justice. 77 Games that were removed or not released in the Belgian market were also easily accessible by, for example, changing the Apple App Store's country setting to not be Belgium. 78 Some companies have since taken compliance action after that study result came out, 79 suggesting that at least some cases of non-compliance were due to the companies not having the requisite knowledge about their legal obligations.
The Belgian failure to impose a ban should be considered by other countries intending to seek a similar result through whatever means. Following the study, in September 2022, the Belgian gambling regulator has suggested that it might be more practicable to permit some loot boxes or to license them, rather than to attempt the difficult (and conceivably impossible) task of enforcing a ban on them. 80 (Notably, the regulator also recognized that physical collectible/trading card game booster packs containing random cards 81 would fall within the same category of illegal gambling as loot boxes and should be banned in Belgium at present, 82 contrary to legally incorrect comments previously made by a representative of the regulator in May 2018. 83 ) An education campaign targeting industry members and better informing them of their compliance obligations (potentially conducted through the app stores as part of the game uploading process) and a more realistic regulatory goal (e.g., of ensuring that none of the 500 highest-grossing games contain loot boxes 84 ) would be well-advised.
Austria: civil suit concluding that certain loot boxes are illegal gambling
In February 2023, an Austrian player successfully sued Sony for recovery of the sum of money he has spent on loot boxes in the FIFA video game series (Electronic Arts, 1993–2022). 85 The Hermagor District Court ruled in his favor and required Sony to refund the amount spent because the “Ultimate Team Player Packs” in FIFA are illegal gambling, as they are Embedded-Embedded loot boxes: specifically, (i) the player paid real-world money to open them; (ii) the content was randomized; and, importantly, (iii) the obtained loot box content constituted a “financial benefit” within the meaning of Austrian gambling law because it can be traded on a secondary market between players. 86 Importantly, even though Sony was allowed the opportunity to appeal that judgment, it has not done so, meaning that the judgment has since became final and binding. 87 One would reasonably have expected one of the world's most well-resourced technology companies to appeal had there been any valid legal grounds to do so. This is because a successful appeal could have set an informal precedent that would strongly discourage other players from attempting (supposedly unmeritorious) litigation in the future.
Unfortunately, the judgment is not publicly available: the court has denied a media request citing that it is not legally allowed to publish the judgment. 88 The non-public nature of the judgment (likely stemming from it being a civil claim between private parties, i.e., the player and the game company/platform, rather than a public administrative or criminal case commenced by the regulator or prosecutor) has obvious negative consequences for open justice and may be unfairly advantaging the industry by depriving legal information from the public domain. The industry would presumably have access to paid-for legal advice, but players could not easily have access to the same knowledge. 89
Interestingly, this case was brought against Sony (the platform provider and the party that took payment from the player for the loot boxes), rather than Electronic Arts (the developer and publisher of the game offering the illegal loot boxes), because the sales contract was concluded between the player and Sony. 90 It is not known whether Sony has sought compensation from Electronic Arts: whether the platform provider can ask the developer/publisher for a contribution in such claims is an interesting legal question. Further, the case was brought with the assistance of a litigation funder, who has publicly stated that more than 1,000 players have already contacted it to make potential claims that average around €800 (≈ £700) but may even be up to €85,000 (≈ £73,000) in extreme cases. 91 This suggests that the proverbial “floodgate” might have opened in relation to loot box litigation, at least in Austria and perhaps also other German-speaking jurisdictions where the gambling laws are very similar to Austria's. Players from countries where litigation funding is less permissible might find it more difficult to make similar claims in practice even when they have a solid legal case.
In August 2023, GamesIndustry.biz reported that Electronic Arts and Sony have lost a different loot box case in Austria and were ordered to refund €10,800 to a player, and a statement provided by Electronic Arts claimed that it has actually previously won another loot box case in Austria. 92 This latter point is contrary to how the public has hitherto understood the legal situation because the cases were not reported when Electronic Arts won, but the litigation funder has successfully widely promoted their victory over Sony. I have since obtained copies of the relevant judgments, which I am unfortunately unable to make publicly available. However, the four cases (two of which have since been appealed, and one of which has since been refiled and ruled on, thus providing a total of seven judgments) are summarized in Table 1. In addition, an eighth case, in which the player successfully sued Valve to have the money they spent on loot boxes in CSGO refunded (i.e., the same claim but in the context of a second game has been upheld), is included.
Summary of Various Loot Box Litigation in Austria
Summary of Various Loot Box Litigation in Austria
A detailed analysis of all these cases is beyond the scope of this article. However, the main takeaway is that only three cases were fully determined in the sense that the court actually decided on the question of whether the FIFA loot boxes infringed Austrian gambling law. (The other cases were not decided on their merits but instead on procedural or technical issues.) Two cases were in the player's favor. In the Hermagor case, the player won at first instance, and the defendant did not appeal. In Krautsieder, the defendants won at first instance, but that decision was reversed on appeal, so the player eventually won. Electronic Arts has publicly maintained that the Krautsieder appeal judgment was wrongly decided on “both the facts and law” and stated that it nevertheless has decided not to appeal because the judgment did not set a precedent. 93 It is curious that the defendants of both cases have decided not to appeal, if one is to believe that a further appeal by the companies would be meritorious, as surely an appeal court decision in their favor finding that loot boxes do not constitute illegal gambling (even though, strictly speaking, it would have no precedential value) would in practice deter future claims made with the assistance of litigation funders.
With that said, the most recent case (the refiling of Mihajlovic) was decided on its merits in the companies' favor, but some background as to previous proceedings is needed before delving into that judgment. When Electronic Arts asserted in August 2023 that it has previously won cases, it has only done so on technicalities in two instances. The first is Stancic, wherein the player was unable to prove that he actually spent the amount of money claimed on in-game purchases in FIFA. His claim (and appeal) failed on that technical basis, although the first instance Leopoldstadt District Court did also express some support for Electronic Arts' arguments that FIFA loot boxes are not illegal gambling under Austrian law but ultimately did not decide the point. The second is Mihajlovic, wherein the court decided that Electronic Arts is not the appropriate defendant for the player to sue because the relevant contracts were between the player and Sony, such that Electronic Arts was not a party to those contracts. There are inherent conflicts between these various judgments, as there is no relevant system of precedence, such that the district courts would decide these cases on an individual basis. For example, in the appeal decision of Krautsieder, the court ordered Electronic Arts to refund an amount of money that the player spent using an Xbox game console through the Microsoft Store, even though the relevant contracts would have been concluded between the player and Microsoft only. The Krautsieder court did not demand that Microsoft be added as a party. This is directly contradictory to the court's reasoning in Mihajlovic, which would have required it.
Importantly, Mihajlovic was then refiled naming Sony (rather than Electronic Arts) as the defendant. The court decided that potential “illegal” financial gains derived from selling in-game content or entire player accounts containing loot box rewards on the black market (which has been prohibited by the game's Terms of Use) cannot be a “financial benefit” that would satisfy the relevant criterion of Austrian gambling law. This means that selling FIFA player packs is not offering gambling services. In addition, the facts that (i) loot boxes are not bought to make a profit and are instead used for entertainment and (ii) each loot box only costed a small amount of money (approximately €6) were taken into account. In combination, these meant that the exception that games of chance which are played “just to pass the time and for small amounts” are excepted from Austrian gambling law applied to video game loot boxes. In short, the court decided that even Embedded-Embedded loot boxes are not illegal gambling under Austrian law so long as the game company is not offering them so that players would buy them to obtain a financial profit. This reasoning is clearly contrary to those of the Hermagor case and the Krautsieder appeal.
Finally, an eighth judgment has since been handed down permitting the player to claim a refund for money spent on loot boxes in a second game (CSGO) where the loot box rewards could be transferred between players. Considering these mixed results, it is difficult to predict how future Austrian courts will decide loot box cases in the coming years. Judgments could go either way. Companies are therefore advised to be cautious. In any case, the public should be conscious of how some stakeholders (e.g., the litigation funders) are incentivized to promote a certain narrative about loot box regulation in a certain country (e.g., that loot boxes are definitely illegal gambling to encourage more claimants to come forward). It is important to learn about the perspectives of all parties involved. Finally, when the claims did succeed in relation to the FIFA video games, the courts ordered for the money to be refunded but also for the obtained loot box rewards to be removed from the player's accounts (which would, of course, be fair). However, this process might be technically difficult to carry out, particularly considering how older versions of games might no longer be operational.
Between 2018 and 2019, an attempt to enforce gambling law against Embedded-Embedded loot boxes was also made in Finland. Upon request from a police department to determine whether the loot boxes in CSGO infringe Finnish gambling law, the Gambling Administration of the National Police Board (i.e., the Finnish gambling regulator) expressed its opinion in document “POL-2018-22730.” 94 In summary, the Finnish regulator decided that CSGO loot boxes are a type of illegal lottery because the three relevant legal elements (stake, chance, and monetary gain) have been satisfied and the activity is unlicensed (and in fact can never be licensed because commercial lotteries for profit by private entities are not legally permissible). 95 However, despite that expression of opinion supporting prosecution, the Prosecutor's Office of Western Finland decided not to proceed with the prosecution. The reasoning for that decision was set out in the prosecutorial opinion “Dnro 041/14/18.” 96 That document has not been widely reported on (if at all).
A legal technical point prevented prosecution: specifically, a jurisdiction point. The prosecutors acknowledged the input of the Finnish gambling regulator in POL-2018-22730 that the relevant legal elements of the offence of providing an illegal, non-money, goods lottery 97 may potentially have been satisfied by Valve Corporation's provision of loot boxes in CSGO. 98 However, the U.S.-based company operating CSGO has not committed a crime within Finland because (i) the physical place of commission of the alleged crime is outside of Finland and (ii) the provision of an illegal non-money, goods lottery offence does not have a consequence element, 99 such that the crime cannot be deemed to have been committed in Finland on the alternative “consequence” ground for deriving jurisdiction. 100 Accordingly, the prosecutor had no jurisdiction and could not proceed. 101 Other methods of deriving jurisdiction were also not possible 102 (such as the crime having been “directed at a Finnish person” 103 ) because, inter alia, it is required that the offence must be punishable with imprisonment of at least more than six months for such methods to be applicable, but the harshest possible penalty for the illegal goods lottery offence would be six months imprisonment. 104 In short, although foreign companies might be committing criminal offences, Finnish prosecutors cannot act against them.
This failed attempt at prosecution due to a jurisdiction issue reveals obvious shortcomings in Finnish criminal law, particularly in relation to offences involving the internet. If this situation is deemed unsatisfactory by Finnish policymakers, then criminal law should be amended. Finnish gambling regulation must be improved as illegal goods lotteries offered by foreign companies are basically never regulable at present, despite the potential for harm. The other relevant offence of providing an illegal game of chance, 105 which can potentially impose a harsher punishment of over six months imprisonment, would also not be applicable because the additional element of “where the possible loss is clearly disproportionate to the solvency of at least one of the participants” generally could not be satisfied by loot boxes and other gambling-like products, except in extreme situations. This jurisdiction point is also of relevance to a bill that was proposed in Finland in September 2022 that intended to amend the definition of gambling (but which has since died due to a new term of Parliament starting). 106 That bill is addressed under section 6.1.
The Netherlands: court strikes down enforcement and a forthcoming ban?
In April 2018, the Dutch gambling regulator published a report finding that both paid and non-paid loot boxes (i) whose results are randomly decided and (ii) whose content possessed “market value” or real-world monetary value constitute illegal gambling unless licensed. 107 Further, the regulator is unable to license video game loot boxes as a form of regulated gambling because they are not empowered to do so. 108 Thus, both Embedded-Embedded and, indeed, the much rarer category of Isolated-Embedded loot boxes contravene Dutch gambling law in all cases and are prohibited. In 2019, the Dutch regulator then enforced its interpretation of the law against Electronic Arts for implementing allegedly illegal loot boxes in the FIFA video games that were transferable between players and thus possess real-world monetary value. 109 In 2020, on appeal by Electronic Arts against the financial penalty imposed in 2019, the District Court of The Hague upheld the Dutch gambling regulator's legal interpretation. 110
Electronic Arts then appealed again, and, in March 2022, the final judgment decided that before turning to determine whether the loot boxes contravened Dutch gambling law, it is necessary to consider the preliminary question of whether the entire video game or the loot boxes on their own should be assessed for potential infringement of gambling law. 111 Significant justification is required before the loot boxes can be separated out as an independent game for the legal analysis. For this preliminary question, according to the Council of State, the determinative factor is how the majority of players play the game. 112 The majority of players do not engage with the loot boxes in FIFA games as a separate element or an independent game and instead engage with them as part of the overarching game; therefore, it was decided that the loot boxes in FIFA cannot be assessed on their own as an independent game as to whether they infringe Dutch gambling law and instead the video game should be assessed as a whole. 113 It was not argued by the Dutch gambling regulator that the FIFA games as a whole infringed gambling law (in any case, they would not have), and, for that reason, the previously taken enforcement action was found to be unlawful and was overturned. 114 That judgment has been critiqued in detail elsewhere, including for failing to account for the experience of the minority of high-spending and vulnerable players, 115 but the judgment's implications are that video game loot boxes are not generally regulable under Dutch gambling law, such that nearly all implementations would be lawful.
Since then, in June 2022, unsatisfied with the judgment, members of the House of Representatives in the Netherlands have filed a motion asking for the government to consider a ban on loot boxes. 116 In June 2023, the Dutch minister in charge of consumer affairs sent a letter to the House of Representatives in which she stated that she will seek tougher regulation of commercial practices relating to video games at an EU-level. 117 In particular, she will seek to have loot boxes recognized as an unfair commercial practice “under all circumstances,” 118 which likely means having them listed under Annex 1 of the EU UCPD (thereby prohibited per Article 5(5)) and then transposed to national implementations thereof. The associated press release also stated: “As far as the cabinet is concerned, there will in any case be a ban on [loot boxes],” 119 which appeared to suggest that besides EU-level regulation, national regulation in the Netherlands was also being sought. When asked to clarify, the Dutch Government has since confirmed to me that a national ban on loot boxes is indeed being sought. 120 However, the exact details as to how this might be achieved and the relevant timeframe for adopting this ban have not been revealed. Said coalition Dutch Government has also since collapsed, 121 meaning that this ban might not be pursued further.
France: overly cautious and self-incriminating “compliance” action?
In June 2018, the then French online gambling regulator (ARJEL) briefly expressed its views on whether loot boxes are gambling by stating that only Embedded-Embedded loot boxes potentially could be. 122 The ARJEL was conservative and suggested that, depending on the factual circumstances, only companies that actively participate in turning the rewards from Embedded-Embedded loot boxes into real-world money (“il participe à cette monétisation”) would be providing illegal gambling (i.e., either actively prohibiting this from happening or even inaction and mere acquiescence may be sufficient to escape liability). 123
Very few video game companies actively allow players to convert their loot box prizes into real-world money: Magic: The Gathering Online (Wizards of the Coast, 2002) and NFT (Non-Fungible Token) games are rare exceptions. 124 However, turning loot box prizes into real-world money (“cashing-out”) is always possible where those virtual items are transferable between players because an external transaction between the players to exchange real-world money could make up any difference in value between the virtual items, thus facilitating the buying and selling of loot box prizes for real-world money. The French position is more restrictive by requiring the company to actively participate in the monetization, such that any external transactions even if they allow cashing-out would be deemed irrelevant. Other countries would have to decide what sub-types of Embedded-Embedded loot boxes are regulable under their gambling laws. This distinction is arguably artificial and inconsequential, such that it should not be taken into account for regulatory purposes: the potential harms of loot boxes (particularly as to gambling-like financial losses resulting from excessive purchasing) are not wholly caused or prevented by whether the video game company operating the game actively allows cashing-out. 125 The same type of harm would be present as long as turning loot box prizes into real-world money is de facto possible. Indeed, a game that allows conversion directly through the company is arguably safer as the player would not have to engage with a grey market that may involve scams and criminal proceeds. 126 Furthermore, when an official secondary market exists, some players would likely decide not to engage with loot boxes because they are no longer forced to do so (e.g., when they could only obtain their desired items from purchasing loot boxes) and simply directly purchase their desired items at a transparent price, thus reducing the potential harm those players might encounter.
Despite the ARJEL having provided an interpretation of French gambling law that is very friendly towards industry interests, notably, one company has decided to take “compliance” action. In September 2019, Valve Corporation decided that, in France only, CSGO loot boxes would have to be placed inside a so-called “X-ray Scanner” before they can be opened. 127 The X-ray Scanner reveals the loot box's content and so, ostensibly, the player would know exactly what they will receive when they purchase the loot box. However, importantly, the player must purchase/open the loot box that they placed into the X-ray Scanner before they can scan another loot box. 128 This means that players are forced to open loot boxes that contain unsatisfactory rewards in order for them to try their luck on new loot boxes. Therefore, every time the player purchases a loot box, what they are receiving is not only the content from the latest loot box they scanned (which, by this point, is known and non-randomized) but also the opportunity to directly purchase the content from the next loot box (which is still randomized). Knowing that most loot boxes would contain prizes that are worth less than the purchase price (i.e., represents a loss), what the player is actually intending to purchase in this transaction is the randomization of the next loot box.
This particular loot box design simply puts one extra layer of delay between the purchase and the randomization but does not remove the gambling element or potential harms. It would be a sham to claim that the player is only directly purchasing the already known loot box content and somehow supposedly pays no heed to the randomization of the next loot box (which is what they are actually paying for). This method of purported “compliance,” or more accurately attempted circumvention of the law, does not stand up to scrutiny and is unlikely to be recognized as somehow being capable of converting the loot box into a lawful, non-gambling product. Indeed, Valve cannot have its cake and eat it too. This attempt at circumventing the law can be viewed as an admission that the company is offering Embedded-Embedded loot boxes, which constitute illegal gambling in most countries. Those other countries should actively enforce their gambling laws.
UK and Australia: enforcement against skin betting/gambling websites
An issue that is adjacent to loot box regulation but does not actually involve finding loot boxes themselves to be illegal gambling or not, is the regulation of so-called skin betting or skin gambling websites. As discussed in the introduction, the virtual items obtainable from loot boxes are transferable between players in some games (e.g., CSGO). These virtual items can often be used to change the cosmetic appearance of certain things inside the game and are thusly known as “skins,” although it is also possible to participate in skin betting/gambling with other, non-cosmetic, transferable virtual items that are not “skins” per se (such as virtual currencies). Websites that allow players to participate in traditional gambling activities by using skins as the stake have been popularized in recent years. 129 In the UK, 2% of 11–16-year-olds reported gambling (illegally) with virtual items on such websites in 2022. 130 The participation rate amongst adults is likely significantly higher: in one sample, approximately 70% of players who purchased loot boxes reportedly also used skins to gamble. 131
In February 2017, the UK gambling regulator prosecuted two individuals for operating an unlicensed website (FutGalaxy.com) that offered illegal gambling. 132 On this website, players could participate in traditional gambling activities, such as sports betting, using a virtual currency that was purchased with real-world money. 133 This virtual currency can then be exchanged for the virtual currency from the FIFA video games and which can then in turn be converted into real-world money. 134 This case did not relate directly to loot boxes; however, it recognized that the virtual currency from the FIFA video games can be converted into cash and are therefore “money's worth.” Factually, content from loot boxes in FIFA can also be converted into such virtual currency and then into cash. 135 Therefore, following the same logic adopted by the gambling regulator in the FutGalaxy.com case, FIFA loot boxes are offering prizes that are “money's worth,” within the UK legal definition of gambling. 136 The UK Government has applauded the gambling regulator for proactively taking enforcement actions against video game-related illegal gambling, specifically citing the FutGalaxy.com case (which is the only relevant instance of enforcement). 137 However, the regulator evidently has not been proactive with loot boxes, such as the player packs from the FIFA games, which are arguably unlicensed gambling. The regulator cannot be selective and must maintain the same legal interpretation by also enforcing the law against loot boxes that players purchase with real-world money and offer random prizes that can be converted back into cash (regardless of whether that conversion is done with or without the game company's permission, as this was deemed irrelevant in the FutGalaxy.com case).
In May 2023, similarly, the Australian online gambling regulator (Australian Communications and Media Authority; ACMA) investigated and concluded that the CS:GO Roll website contravened federal online gambling law by providing prohibited services. 138 Specifically, CS:GO Roll allowed players to deposit skins as stake to participate in gambling activities and then paid out any winnings in skins. The ACMA recognized that these skins could then be “converted into real money using third-party platforms” 139 and are thus “money or anything else of value” 140 within the Australian legal definition of gambling. 141 It then logically flows that loot boxes that randomly distributed those skins after payment of real-world money in the first place are also illegal online gambling: not recognizing them as such would be an anomaly that demands explanation.
Importantly, these two instances are not enforcement actions against loot boxes per se. However, they are examples of the application of gambling law and provide support for prosecuting the sale of loot boxes as illegal gambling. Regulators have accepted that (i) the virtual prizes from loot boxes and (ii) the virtual currencies that those prizes can be converted into have real-world monetary value. They must therefore also act against illegal loot boxes on that basis. Taking action in relation to skin betting/gambling does not equate to taking action against loot boxes and should not be presented as such (as the UK Government has arguably done 142 ). Indeed, enforcing the law against illegal loot boxes and thus removing the transferability of highly desirable virtual items from popular games would be an effective way to reduce skin betting/gambling by (i) removing the players' ability to use them as the stake and (ii) preventing such services from unfairly profiting from the popularity of those video games and those in-game items' inherent attractiveness.
APPLYING EXISTING EU CONSUMER PROTECTION LAW?
The second area of existing law that has been applied to address loot box harms is consumer protection law. The focus has been on the use of the EU UCPD (or rather national implementations thereof 143 ) in EU (e.g., The Netherlands and Italy) and ex-EU countries (i.e., the UK). Similar options are also available in other jurisdictions but have not yet been acted upon (e.g., prohibition of, and enforcement against, unfair commercial practices in the U.S. by the Federal Trade Commission 144 ).
Italy: information disclosure commitments obtained from companies
The Italian Competition Authority (AGCM), which enforces consumer protection law in the country, started investigating both Electronic Arts in December 2019
145
and Activision Blizzard in January 2020
146
for, inter alia, allegedly either providing misleading information on, or omitting material information about, the characteristics of, and the potential costs that may be incurred in, the video games implementing in-game purchases and loot boxes.
147
Both companies denied infringing consumer protection law
148
but committed to undertaking voluntary measures to address the AGCM's concerns.
149
These commitments included, inter alia:
disclosing the presence of generic in-game purchases by prominently displaying the relevant PEGI pictogram (a hand holding a payment card, see Figs. 1 and 2);
150
disclosing the presence of loot boxes with the dedicated PEGI text-based warning label of “In-game Purchases (Includes Random Items)” (or rather “Acquisti in-game (contiene elementi casuali))” (see Figs.1 and 2);
151
for Electronic Arts only, displaying the PEGI in-game purchase pictogram 66% larger than previously shown to make it more visually prominent;
152
for Electronic Arts only, attaching an additional text-based explanation about in-game purchases involving randomization;
153
for Electronic Arts only, disclosing the aforementioned information also on the physical packaging of relevant games;
154
providing parental control features, such as, for Electronic Arts, placing a spending limit of €0 by default on young people's accounts (i.e., prohibit in-game purchasing unless later deliberately approved by the parent)
155
and making the option of creating young people's accounts more prominent during the registration process,
156
and for Activision Blizzard, requiring the parent to deliberately unlock the option of making in-game purchases by young people before any money could be spent;
157
for Activision Blizzard only, disclosing the probabilities of obtaining random rewards from loot boxes;
158
and communicating these commitments to third-party platforms through which the companies' games are distributed.
159
The Current English PEGI Generic “IN-GAME PURCHASES” and Dedicated Loot Box “In-game Purchases (Includes Random Items)” Content Descriptors. © 2020 PEGI (Pan-European Game Information) Color images are available online.
The Current Italian PEGI Generic “ACQUISTI IN-GAME” and Dedicated Loot Box “Acquisti In-Game (Contiene Elementi Casuali)” Content Descriptors. © 2020 PEGI (Pan-European Game Information) Color images are available online.
These commitments were accepted by the AGCM as sufficient to alleviate its concerns. 160
However, notably, these information disclosure commitments in Italy only extended to the Italian versions of either companies' proprietary online video game store 161 (the Electronic Arts Origin Store and the Activision Blizzard Battle.net, respectively) and the relevant websites under their control. 162 This means that neither company was seemingly obliged to disclose the presence of loot boxes on third-party platforms through which they distribute their games, e.g., the Italian Apple App Store and Google Play Store. Indeed, they have not made the relevant disclosure on such platforms in relation to a number of games, including Hearthstone (Blizzard Entertainment, 2014), which was specifically named in the Italian enforcement action. 163 A summary review of the Italian Apple and Google stores revealed that, as of 9 July 2023, the two companies failed to make the necessary loot box presence disclosure in relation to some games as shown in Table 2. The situation on Google has only improved since January 2023 due to my study and subsequent communications with the age rating organizations, which meant that the disclosure was only very recently forcibly attached. 164
Compliance with Loot Box Presence Disclosure Requirement by Electronic Arts and Activision Blizzard on the Italian Apple App Store and Google Play Store (N = 5)
Note. “Not disclosed until recently” means that the loot box presence was only disclosed since January 2023 due to active intervention by me and compulsory application by the age rating organizations following from an academic study. 299
Importantly, the distribution of mobile games relies heavily on these two platforms. The AGCM failed to consider the situation on mobile platforms and should not have so readily accepted the companies' commitments as sufficient to satisfy all concerns. Interestingly, both companies committed to communicating the voluntary measures to third-party platforms that distribute their games (Sony, Microsoft, and Nintendo were specifically named by Electronic Arts). 165 However, it seems this commitment related only to communicating and did not extend to requiring these two companies to also comply with these measures on those platforms. The AGCM has hoped that these communications would lead to better compliance across the industry, 166 but that appeared to have been overly optimistic given that the compliance situation has been poor across both mobile platforms 167 and the platforms operated by the three major hardware providers. 168 The AGCM should also have obtained assurances from Electronic Arts and Activision Blizzard that they would comply with these measures on all third-party platforms that distribute their games on (perhaps with an exclusion only in cases where their games are being resold by another party, e.g., on eBay by a private seller). That would likely have led to those third-party platforms implementing methods by which all companies can make these disclosures on product listings if so desired (e.g., by ticking a specific box about loot box presence when uploading a game), which would have improved industry-wide compliance by reducing the burden on companies. In any case, the commitments only covered Italy, which means that the regulators of other EU countries would also have to enforce the law nationally before the companies would act more responsibly more widely. A more unified EU approach to enforcement would be ideal given that the law is, or at least should be, harmonized, e.g., where one national regulator takes the lead on a specific issue by conducting the investigation and then coordinating EU-wide enforcement that other national regulators would also agree to commence in their respective countries.
The primary takeaway from this pair of Italian enforcement actions is that information disclosures about whether a game contains (i) in-game purchases, (ii) loot boxes specifically, and (iii) the probabilities of obtaining random rewards from loot boxes are arguably already required by EU consumer protection law. The omission of such information may infringe national implementations of Article 7 of the EU UCPD. Indeed, the European Commission's Guidance on the interpretation and application of the UCPD has recognized the Italian enforcement actions and opined that the three matters listed above are indeed already required to be disclosed across the EU countries. 169 This may be a comparatively generous interpretation of the law, but it may therefore not technically be necessary to pass dedicated laws to require these, although adopting specific regulation would still bring clarity as other jurisdictions appear to disagree as to what information disclosure is required, as discussed below in relation to the Netherlands' and the UK's interpretations.
In February 2020, the Dutch Authority for Consumers & Markets (ACM) published its “Guidelines on the Protection of the Online Consumer,” 170 which has since been updated in March 2023. 171 The Guidelines required that the purchase price of all in-game purchases (including loot boxes specifically) must be stated in terms of real-world currency (i.e., euros). 172 The justification is that “[asking players to pay using fantasy in-game currency rather than euros] breaks the association with real money and causes users to spend more readily.” 173 (Although this may be a genuine concern, as far as I am aware, there is no empirical evidence of this occurring in a video game context. The UK advertising regulator contrarily suggested that this information might even undermine consumer understanding of the price by blurring virtual currency with real money, which, as discussed below, is not convincing.) The probabilities of winning rare prizes (i.e., probability disclosures) were also recognized as an important feature of the product and were required to be published alongside the sale offer. 174
These two information disclosure requirements were derived from the ACM's interpretation of the Dutch national implementation of Article 7 of the EU UCPD (which means that the Dutch court might disagree with it, such that it is not the law per se). The consumer protection law enforcers of other EU countries and the UK may or may not come to the same view. It is yet unknown whether companies have complied with the Guidelines by (i) displaying the purchase price of loot boxes in euros and (ii) making probability disclosures in the Netherlands. The evidence from the UK in mid-2021 was that only 64% of the highest-grossing iPhone games containing loot boxes disclosed probabilities, even though all were required to do so by Apple's platform self-regulation. 175 Very few games were showing loot box purchase prices in real-world monetary terms. It is unlikely for game companies to make dedicated national versions of the games that differ in their disclosure features, and thus it is likely that the Dutch versions of a number of popular games remain non-compliant with the Guidelines. The ACM is not known to have yet taken any enforcement actions.
UK: disclosure of the presence of in-game purchases and loot boxes
In September 2021, the Committee of Advertising Practice (CAP), which is responsible for drafting advertising rules in the UK, 176 published the “Guidance on Advertising In-game Purchases.” 177 Companies were warned against giving consumers incorrect impressions about their chances of winning rare items, e.g., by presenting “near-misses” (whereby the player is shown to have just missed-out on winning the rare item). 178 Companies were also told not to falsely advertise offers as being time-limited when they are not (i.e., would be offered again later), 179 which would be a direct infringement of the national implementation of Article 5(5) (and Annex 1) of the EU UCPD. 180 Companies were also required to disclose that a video game contains in-game purchases and “random-item purchasing” (i.e., loot boxes) specifically through the use of the relevant PEGI labeling (see Fig.1) or otherwise. 181
Many games were proven not to have made a loot box presence disclosure on the Google Play Store and Apple App Store in the UK in January 2023. 182 The Guidance is somewhat horizontally enforceable in the sense that a private party may make a complaint against an advertiser for alleged breach, which would be investigated by the advertising regulator (rather than requiring the regulator to exclusively act on its own initiative). Consequently, in May 2023, I made two complaints to the Advertising Standards Authority alleging breach of the Guidance to test the advertising regulator's willingness to enforce these published rules. The processing of this pair of complaints remains pending as of July 2023.
Two potential rules that the CAP decided not to draft into the Guidance (and are therefore not required) are also noteworthy. Firstly, it was proposed by some respondents 183 (including me 184 ) during the consultation process 185 for drafting the Guidance that probability disclosures should be required. These are likely already required 186 under Article 7 of the EU UCPD as “material information” 187 that must not be omitted, 188 as the Italian consumer protection regulator has impliedly agreed by accepting industry commitments to that effect and as the Dutch regulator has explicitly opined as detailed above. However, the CAP refused to adopt this requirement citing that, although some countries have now required this, there was ”no sufficient basis” to require this at present because there was “no evidence” that this information is understood or used by players, affects player behavior, or reduces risk of potential harms. 189 Whilst probability disclosures do not appear to effectively reduce the spending of most players, it may help a minority of players to spend more responsibly. 190 Such information also provides transparency and accountability to the transaction. Players are known to collate loot box opening results to uncover the underlying probabilities and verify disclosures. 191 Such behaviors demonstrate that the information is important to at least some players and that this process can reduce the likelihood of companies implementing predatory probabilities (e.g., those that change according to spending behavior 192 ), as these would then be embarrassingly discovered by players through their investigation. In any case, the legal “basis” (in the CAP's words) for requiring this would have been the UK Consumer Protection from Unfair Trading Regulations (CPUTR) implementing the EU UCPD; an incontrovertible scientific basis is not necessarily required but would have nonetheless been arguable.
Secondly, during the consultation, 193 the CAP itself proposed in the draft Guidance to require companies to provide the “equivalent real-world price” of in-game purchases where these are sold to players in terms of fantasy in-game currency. 194 This would have been identical to what the Dutch regulator has required as discussed above. However, two industry respondents to the consultation argued that there is supposedly conflicting prior advice from another UK consumer protection regulator. 195 In January 2014, the Office of Fair Trading (OFT) published the “Principles for Online and App-based Games.” 196 The OFT's functions have generally been overtaken by the Competition and Markets Authority (CMA), which has indeed since adopted these Principles as its own. 197 The CAP has identified Principle 4 as the relevant section, 198 which states that, “The commercial intent of any in-game promotion of paid-for content, or promotion of any other product or service, should be clear and distinguishable from gameplay” (i.e., in-game purchases should be distinguishable from gameplay). 199 The CAP then concluded that “maintaining a separation between [virtual currencies and real currencies]” was more important than providing a statement about the “equivalent real-world price” of the in-game purchase. 200 Indeed, the CAP even went as far as to say that providing this information “may even undermine [consumer understanding of the price]” by blurring the line between virtual currencies and real money. 201
This is an extreme shift to the CAP's original position prior to the consultation and appears to be a rather perverse interpretation of Principle 4. Contrary to what the CAP has argued, providing the “equivalent real-world price” would actually be a method for companies to signify that this is a real money purchase that is separate from regular gameplay. The presence of virtual currency makes it more difficult for players to separate real money transactions from gameplay, and this can be resolved by either removing virtual currencies or providing the real money price. The only case where the commercial intent might be unclear as a result of implementing this measure is if the in-game currency portrayed in the game happens to be a fantasy version of pound sterling, the legal tender in the UK (in which case that game should be prevented from implementing that as the virtual currency as a narrative design choice, rather than vice versa). There may be other practical reasons to decide against requiring this information to be provided. For example, the real money price is difficult to calculate because the virtual currency used to purchase loot boxes might be purchased using real-world money or earned through gameplay and thus be in a mixed pot, although it would still be incumbent on companies that decided to implement this complication when it is not necessary to cause this difficulty to resolve that. Regardless, the argument that providing this information would somehow undermine consumer understanding of the real-world monetary price of the purchase is illogical. In any case, those Principles were adopted nearly a decade ago, given how quickly the video game industry has developed (and how the average video game consumer makes spending decisions might have changed), they should be due for an update.
Revealingly, the industry response also stated that a private dialogue was held between the industry and the Dutch regulator during which the regulator supposedly “clarified” that, in the Netherlands, the requirement to display the price of in-game purchases in real money (as discussed above) does not actually apply broadly and only applies “where the player is initially invited to make an in-game virtual currency purchase” and “not in any subsequent transaction involving such in-game virtual currency.” 202 Had this “clarification” been true, then this requirement would not actually exist in the Netherlands because it would not be applicable to any transactions that might be confusing because they are priced in virtual currencies. The only type of transaction that it supposedly would then apply to would be the purchase of virtual currency using real-world money: that type of purchase can only be priced in real-world currency, so the requirement would be redundant. The specific advice on how loot boxes must be priced in real money terms 203 would also be inapplicable. Therefore, it seemed highly doubtful that this “clarification” could have been made.
I sought a response on this point from the Dutch regulator in July 2023. The ACM confirmed in September 2023 that discussions were indeed held with the industry on several occasions. However, the ACM has always conveyed the position that has been expressed publicly and formally through the Guidelines (that the requirement to display euro pricing applies to all in-game purchases). Importantly, “at no point in time has the ACM provided the alleged ‛clarification’ as mentioned in the [Ukie publication].” Given this forceful denial from the ACM, it would appear that the Association for UK Interactive Entertainment (Ukie) has misled the CAP during the consultation process for the draft Guidance (either intentionally or unintentionally due to a gross misunderstanding of the ACM's position). This arguably may be perceived as having compromised the consultation process because false information may have been taken into account; however, the documents provided by the CAP regarding what information it has taken into account and how that was used do not make direct reference to this particular point. 204 This misleading information is therefore unlikely to have affected the results of the consultation, which appear to have been most strongly influenced by the CAP's interpretation of the OFT Principles. 205
AGE RATINGS AND WARNING LABELS
Germany: requiring age ratings to account for the presence of loot boxes
In April 2021, the German Protection of Young Persons Act (JuSchG) was amended to explicitly highlight, inter alia, “glücksspielähnliche Mechanismen [gambling-like mechanisms]” as “risks to the personal integrity of children and young people” (§ 10b(3)). The same amended subsection also requires the German video game age rating system, Unterhaltungssoftware Selbstkontrolle (USK), to take the presence of such mechanics (i.e., loot boxes) into account when deciding what age rating to give to video games. The USK amended its policies accordingly and began applying those from 1 January 2023: this includes also labeling any games containing loot boxes with the warning of “In-Game-Käufe + zufällige Objekte [In-game purchases + random items].” 206
This measure has led to perceivable change in how games are rated in Germany. For example, Electronic Arts' series of football video games (which were formerly known as the FIFA series and are now marketed as EA Sports FC series) used to always consistently receive the lowest age rating of USK 0 (or approved with no restrictions). However, the newest rendition EA Sports FC 24 (Electronic Arts, 2023) received USK 12 (or approved for young people aged 12 or above) on the basis that the game contains loot boxes and “pressures to act” (which is defined very widely as something stressful including, e.g., a countdown timer for when in-game purchases would expire). 207 In contrast, PEGI rated FC 24 PEGI 3 (or suitable for all age groups), and the ESRB gave it E (or suitable for everyone), as they have always done for previous editions. This measure affects the underlying age rating (in addition to merely signaling the presence of loot boxes, as the ESRB and PEGI have done) and therefore more prominently draws potential problems to the parent's attention, thus allowing German young people under 12 to be better protected from potential loot box harms.
Changing the USK's age rating criteria through legislative amendments is only possible in Germany because the national video game age rating system has a legal backstop and allows for external oversight. The same cannot be as easily achieved in other jurisdictions where the age rating system is entirely industry self-regulatory, e.g., the ESRB in North America and PEGI in Europe. Indeed, in countries where age ratings are advisory only and have no legal enforceability (and potentially never could have that due to constitutional reasons) at present, e.g., the U.S., 208 this measure is not practical. Whether it is an appropriate policy to demand games that would otherwise be deemed suitable for very young children to receive a higher age rating that renders them suitable only for older teenagers only on the basis that loot boxes are present can, and should, be debated. On one hand, increased protection is provided; however, on the other hand, young children are being deprived of access to certain entertainment products (particularly considering that many of them may be able to enjoy the underlying game without engaging with any loot boxes). The information that parents need in relation to loot boxes is not necessarily that the game is only suitable for young people aged 12 or above, but is instead that the game contains loot boxes; how that might be a concern; and how that “feature” might be turned off. In addition to (or indeed instead of) forcing these games to bear a considerably higher age rating than what they would have received but for the presence of loot boxes, it may be wise to also demand that companies release a child-appropriate version of the same game without loot boxes to ensure that young people experience no potential detriment through this policy, rather than to permit companies to simply abandon the young children market.
Australia: mandatory minimum age ratings for games with loot boxes
In July 2021, it was reported that Andrew Wilkie MP intended to introduce a national bill to better regulate loot boxes. 209 This bill was finally introduced in November 2022. 210 Two measures were proposed. Firstly, any games containing loot boxes must be rated suitable for those aged 18+ only. Secondly, a warning that the game contains loot boxes must be provided as “consumer advice,” which must, inter alia, be shown on the packaging. 211 Those proposals are not particularly remarkable but the definition for a “loot box” in the bill must be scrutinized. The term “loot box,” according to the bill, “means a feature of a computer game where digital containers of randomized virtual items can be obtained for consideration.” 212 Two issues are immediately evident.
Firstly, this definition refers restrictively to “digital containers.” This is not sufficiently broad as to cover all in-game purchases with randomized elements as discussed in this article's introduction. A gacha character summoning mechanic, for example, cannot be said to be a “digital container” of randomized virtual items. Social casino games, which may well be more harmful than loot boxes because they earn more money from their highest spending players than games of other genres, 213 would also not be covered. Mechanics where the purchasing process is more convoluted are also not obviously included, such as in Pokémon GO (Niantic, 2016), wherein the player can pay real-world money to fight a Pokémon and, upon whose defeat, the player has a random chance of obtaining a rare and “shiny” version of said Pokémon (but the company has not made probability disclosures as to the likelihood of the Pokémon being shiny, and the age rating organizations do not recognize such mechanics as purchases with randomized elements 214 ). Legal arguments might be attempted to say that these other mechanics should be interpreted by the court as being covered by the law anyway despite the drafting language; however, it would be helpful for the face of the law to not plainly exclude these other implementations of in-game purchases with randomized elements which the legislator is intended to cover. Indeed, the Explanatory Memorandum to the bill clarifies that: “It is intended this definition is wide enough to capture features with a randomized reward function even when strictly not a ‛box’ or a ‛crate’, for example a virtual prize wheel.” 215 Given that is the case, the “digital container” wording should not be in the definition. This issue has been caught during the drafting process and should be fixed forthwith. In any case, regulation should not be overly restrictive so as to unwisely encourage companies to implement complex purchasing processes that further distance the spending of real-world money from the randomized rewards so as to circumvent the law. A loot box that is advertised as such is more transparent about what it is and likely safer for consumers.
Secondly, this definition refers to the fact that these loot boxes must be “obtained for consideration.” This appears to be an attempt to draft the requirement that these loot boxes must be paid for with real-world money (including when cash is spent to purchase virtual currency, which is then used to buy loot boxes), rather than loot boxes that are obtained without any involvement of real-world money, as the Explanatory Memorandum to the bill clarifies. 216 “Consideration” is a well-known legal term in contractual contexts and could refer to non-monetary matters (e.g., virtual currency obtained solely from gameplay or completing an in-game task), 217 which are not intended to be covered by the bill. A better definition for a “loot box” for the purposes of the bill would be: “an element within a computer game that involves direct or indirect purchase with money and whose results are random.”
Whilst the Wilkie Bill remains under consideration, a house committee conducted an inquiry into online gambling, including loot boxes and social casino games. 218 Before the inquiry report was published, in March 2023, the Australian Government announced that it will seek to change the video game classification regime to account for these gambling-like elements. 219 Games containing “simulated gambling” (i.e., social casino games and other games with simulated gambling features) would receive the mandatory minimum classification of Restricted (R 18+), thus limiting them to adults 18 and over. 220 Games containing “paid loot boxes” would receive, at minimum, the Mature (M) rating, which would mean that they are “not recommended for persons under 15 years.” 221 More information about this proposal (specifically a draft version of the Guidelines for the Classification of Computer Games 2023, 222 which I have commented on in detail elsewhere 223 ) has since been provided in May 2023 through a consultation process. 224
Again, there are two issues. Firstly, and importantly, the minimum M age rating for games with paid loot boxes is only advisory: there would be no legal restrictions on them. 225 Another classification of Mature Accompanied (MA 15+) exists and would place some legal restrictions on games so classified (e.g., cannot be sold to a minor under 15 without parental consent 226 ). The MA 15+ is also overridable by the parent, like the advisory M rating. Therefore, it may be advisable to require the classification of all games with loot boxes MA 15+, rather than M, at a minimum. This alternative provides more legal enforceability but also preserves parental discretion.
Secondly, the Australian Government proposal requires the delineation of “simulated gambling” from “paid loot boxes.” 227 This would be difficult to implement in practice. The respective definitions would inevitably have to turn on some aesthetic features of the “simulated gambling” elements (e.g., how such mechanics' appearance emulates traditional gambling) which would be subjective, particularly in relation to borderline cases. This would likely lead to several companies disputing whether their mechanic should have been classified as simulated gambling or paid loot boxes, which might be costly for the classification board to resolve. Indeed, video games with simulated gambling features would be incentivized to remove traditional gambling motifs, thus making them less easily distinguishable as “gambling” and thereby potentially more insidious and harmful because players might find it more difficult to appreciate what they are engaging with. It would be easier to treat both as “in-game transactions with random elements” and regulate both under the same umbrella definition (with identical minimum age rating requirements).
The government announcement has somewhat pre-empted the house committee inquiry report. However, one highlight therein is that the committee recognized the importance of developing a more effective presence warning label for simulated gambling elements that is better than what the industry has adopted on its own (see Fig. 1), 228 which empirical research has shown that consumers do not understand and therefore is ineffective. 229
The Guidelines have since been agreed by all states and territories 230 and, on 24 October 2023, were formally adopted. 231 No substantive changes were made, when compared to the May 2023 draft. The Guidelines will come into force on 22 September 2024 so as to “give industry time to adjust to the changes.” 232 The relevant minister further stated that: “These changes will apply to games that are released from September next year and will not apply retrospectively.” 233 What non-retroactivity means in this context has not yet been clarified. In October 2023, the Classification Reform Policy team in response to the author's request in September 2023 for further clarification stated that “the finer details of implementation” have not yet been finalized.
Unfortunately, following from what the minister has said, it appears likely that games that were initially released prior to September 2024 would never have their age ratings re-evaluated even though they might offer loot boxes and be highly popular (e.g., Genshin Impact (miHoYo, 2020) and League of Legends (Riot Games, 2009)) or, indeed, subsequently offer loot boxes for sale for the first time. Indeed, most of the highest-grossing games for many years to come would be “older” games released before September 2024. 234 This means that, despite the adoption of new regulations, consumer protection would not be provided in practice in relation to the most popular games. It would be ideal if older games would be required to get their age ratings reassigned according to the new criteria upon each new software update. This means that games that are continually being maintained and generating revenue through loot boxes must follow the most up-to-date rules and meet the current (higher) standard of consumer protection. If this would not be required, then alternatively, companies that wish to act more socially responsibly should at least be given the option to increase the age ratings for their own games offering loot boxes voluntarily. The Australian Classification Board should also encourage this by waiving any relevant service fees.
U.S.: Illinois loot box warning bill died like many other previous bills
In February 2021, a bill was filed in the U.S. state of Illinois intending to require the following warning label to be attached to games containing loot boxes:
“Attention Parents: A Loot Box System exists in this game that permits an unlimited amount of REAL MONEY to be spent without any age restriction. REAL MONEY is exchanged for random digital items. This process has been linked to REAL LIFE GAMBLING ADDICTIONS in both children and adults. Please regulate your own spending as well as your children's spending.”
235
Said label has been critiqued elsewhere for likely exaggerating the harm of loot boxes and being reminiscent of tobacco product warnings, 236 although it remains a policy decision whether some amount of fearmongering is appropriate in order to address the public's concerns. This bill has since expired as a new session of the state legislature commenced in 2023. 237
This non-outcome is similar to the fate of many other U.S. state and federal bills that have previously been attempted (mostly between 2018 and 2019) but have all since failed. 238 The various intended proposals are shown in Table 3. The drafting language of the various bills often seemingly borrowed from each other as they were highly similar. The suggested motions ranged from (more cautiously) requiring relevant authorities to further investigate the loot box issue to (more paternalistically) restricting the sale of loot boxes and games containing them to those aged 18+ or 21+. A number of bills also wanted to require probability disclosures (see section 2 above) and sometimes provide auditing powers to relevant authorities. Other bills intended to require either (a) the mere disclosure of the presence of in-game purchases without requiring any further comment on their potential harms or (b) more interventionist warning labels that warned of potential harms. The proposed warning in New York was relatively tame and suggested “gambling-like mechanisms … may be harmful or addictive,” 239 but the proposed warning in Minnesota in contrast spoke rather worryingly of “a gambling-like mechanism that may promote the development of a gaming disorder that increases the risk of harmful mental or physical health effects, and may expose the user to significant financial risk.” 240
Summary of Various State and Federal Loot Box-Related Bills Proposed in the United States
Summary of Various State and Federal Loot Box-Related Bills Proposed in the United States
Note. *=intended to require presence disclosure of generic in-game purchases only and not loot boxes specifically.
Finland: expanding the definition of “lotteries”
In September 2022, a bill was proposed by Sebastian Tynkkynen in the Finnish Parliament intending to expand the definition of a “lottery” (a type of gambling) so as to include loot boxes that offered only “virtually utilizable profits,” in addition to those that offered a “monetary gain.” 241 Tynkkynen has clarified that he intends to broadly regulate loot boxes that (i) cost money and (ii) offer random prizes, regardless of whether those prizes possess monetary value. 242 This is therefore an attempt to emulate the Belgian regulatory position on loot boxes. Such proposals must therefore duly consider whether the enforcement failure in Belgium and negative consequences thereof can somehow be avoided by the local regulator (see section 3.1). 243 This can potentially be achieved by allocating sufficient funding and manpower, rather than assuming that the (likely already underfunded) gambling regulator can simply take up this extra task.
Notably, Finnish gambling law differentiates between “money lotteries” 244 and “goods lotteries” 245 depending on whether prizes are literally cash. Loot boxes would in any case remain goods lotteries because they offer virtual items and not money. This means that the same jurisdiction difficulty that prevented the criminal prosecution of loot boxes that offered monetary gains (see section 3.3 above) would also prevent the prosecution of loot boxes that offers virtually utilizable profits even had the law passed. Without proposing to amend other aspects of Finnish criminal law, the bill would not achieve its intended legislative goals of better regulating loot boxes. Were the bill to have passed as initially drafted, only Finnish companies, such as Supercell and Rovio, would be restricted from selling loot boxes and thereby commercially disadvantaged. Other foreign companies can continue to offer loot boxes for sale to Finnish consumers with impunity. The negative economic implications for the local Finnish game industry ought to be considered. The bill has since expired as a new session of Parliament began after elections were held in April 2023. Tynkkynen was re-elected and has confirmed to me that he intends to propose the bill again (hopefully with necessary amendments, as I have informed him of the aforementioned issues). 246
Brazil: two competing bills intending either to legalize or criminalize
In July 2019, a bill was proposed in the Chamber of Deputies (the lower house of the legislature) that intends to require probability disclosures for loot boxes. 247 This bill would therefore recognize their presumed legality, as they have been available on the market anyhow. Non-compliance would be supervised by a competent body, and a channel would be set up for any member of the public (e.g., including competing companies) to report non-compliance. 248 Non-compliant companies would be punished with an initial warning that can then extend to an one-off fine or even a daily fine. 249 The fine can be between R$5,000 and R$100,000,000 (≈ £500–£16,000,000) depending on the company's economic situation. 250 The very high maximum limit should be recognized as potentially providing strong deterrence against non-compliance even in relation to large international corporations (cf. PEGI's very low maximum fine discussed below under section 9.1). The bill remains under consideration as the latest update was provided in April 2023. 251
However, in October 2022, another bill was proposed in the Federal Senate (the upper house) that intends to prohibit loot boxes and consider them to be “jogos de azar [games of chance]” 252 under criminal law. 253 It is not known how the conflict between the two bills would be resolved or even whether their respective proponents are aware of their counterparts. For example, when the Commission on Human Rights and Participatory Legislation was commenting and providing a positive opinion on the senate bill in June 2023, it did not refer to the conflicting chamber bill at all (e.g., argue why the more restrictive approach is preferable). 254
DEDICATED LOOT BOX REGULATION
Spain: highly ambitious dedicated regulatory regime
Between February and March 2021, the Spanish Directorate General for the Regulation of Gambling (DGOJ) organized a public consultation on loot box regulation. 255 Subsequently, in July 2022, a draft law intending to regulate loot boxes was published alongside a separate consultation process seeking feedback. 256 Importantly, the draft law did not use the term “loot boxes” in its drafting language. Instead, the more neutral alternative terminology of “random reward mechanisms” was used, as recommended by the academic literature because the use of “loot boxes” might exclude other implementations of randomized in-game purchases. 257 Only Embedded-Embedded loot boxes that (i) the player paid real-world money for, (ii) provide randomized content, and (iii) whose content can either be transferred between players or be redeemable for real-world money would be regulable per Clause 3(c). Embedded-Isolated loot boxes were never intended to be covered by the draft law (this was confirmed to me by the DGOJ in a meeting on 20 June 2023). 258
The consultation refers to this concept of “interchangeability [intercambiabilidad]” to describe how the prizes possess real-world economic value criterion that can be satisfied. I am of the view that “interchangeability” has the same meaning as the prizes being “money or money's worth,” which is the criterion used in the gambling laws of many countries (e.g., the UK 259 ; see section 3.6 above). However, an alternative, more restrictive interpretation would be that to satisfy the “money or money's worth” definition would require the game company itself to provide a direct option to cash-out any loot box rewards into real-world money, and that mere interchangeability between players would not (even though the players can enter into a real-world money transaction external to the video game to achieve the purpose of cashing-out). The latter is the AREJL's French position described under section 3.5. The Spanish draft law provided clarity as to what is required of the prizes for the law to apply: future bills in other countries should also ensure that this criterion is clearly delineated.
Clause 6(1) of the draft law intends to prohibit access to loot boxes (whose rewards can be cashed-out) by minors (i.e., under 18). This would require companies to conduct real-world identity verification on players and not sell loot boxes to them until this has been done (Clause 6(2)). The advertising of loot boxes would be required to provide a warning about participating in moderation (Clause 7(2)) and be heavily restricted (Clause 7(3)), although the intended ambit of this was unclear. The advertisement of loot box content is often done without reference to how such content can only be obtained from loot boxes. For example, the advertising of new playable characters in Genshin Impact that can only be obtained from loot boxes through YouTube video trailers does not reference that fact. 260 Would such a video constitute loot box advertisement? If not, because loot boxes were not explicitly referenced, then the advertising restrictions would be easily circumventable. If so, because the intention is to encourage loot box purchase, then the restrictions would have applied very broadly to include even the general advertising of the underlying video game containing loot boxes.
Players would also be granted the right to access information on, inter alia, the probabilities of obtaining various rewards (Clause 8(b)), the real-world monetary cost of purchasing loot boxes displayed in euros (Clause 8(c)), and their purchasing history and the amount of money already spent (Clause 8(d)). The DGOJ would be able to require the aforementioned information to be disclosed in specific manners (Clause 9), thus addressing concern that companies might comply sub-optimally due to the probability disclosure requirements being unspecific and discretionary elsewhere (see section 2.3 above). Companies must also allow players to self-exclude from future participation (Clause 10); set spending limits (Clause 11); and make pre-commitments about how many loot boxes they intend to buy (Clause 12). Non-compliance by companies would be punishable, depending on the severity, with written warnings; fines of up to €3,000,000 (≈ £2,600,000); or the termination of the provision of internet services.
The Spanish draft law is particularly ambitious by establishing an array of harm minimization features borrowed from the traditional gambling context. However, it has not progressed. A general election is to be held in July 2023. This regulatory effort may or may not be pursued further depending on the policies of the next government. In any case, the draft law is highly unlikely to become law by the originally intended effective date of 2 January 2024.
MISCELLANEOUS CIVIL LITIGATION
U.S. and Canada: numerous cases, including class actions
A comprehensive review of the current status and potential final disposal of numerous civil actions brought by players against video game companies (including many class action suits) in the U.S. and Canada is beyond the ambit of this article. Indeed, many remain in progress, so it would be difficult to comment. A general observation is that the litigation process is always protracted and that claimants have not managed to be easily successful. This is in part because some of the arguments being attempted are not arguable at all, and they are detracting from the potentially legitimate and viable claims.
For example, in Sutherland v. Electronic Arts,
261
the claimant attempted to argue that not only Embedded-Embedded but also Embedded-Isolated loot boxes involve “the opportunity to win or lose ‛money or money's worth.’”
262
The claim is obviously bound to fail in relation to Embedded-Isolated loot boxes, but the pleading still included them alongside the potentially viable claim concerning Embedded-Embedded loot boxes only. Including irrelevant and unarguable points obviously distracted the court to the claimant's detriment. In addition, the preoccupation of the pleading with Embedded-Isolated loot boxes also caused the claimant to fail to plead relevant facts specifically concerning Embedded-Embedded loot boxes. For example, the claimant seemingly never pled that the virtual currency that loot box items can be sold for in the in-game auction house can then be transferred into real-world money (see section 3.6 above). Such omissions (and also the conflation of Embedded-Embedded and Embedded-Isolated loot boxes) led the judge to the partially incorrect conclusion that “…virtual currency can only be used to buy loot boxes or virtual items for use within the defendants' video games” and that “…virtual currency and virtual items in loot boxes can never be ‛cashed out’ to gain money or money's worth.”
263
Those conclusions would be correct in relation to Embedded-Isolated loot boxes, but they are wrong in relation to Embedded-Embedded ones, as such those found in the FIFA games, which are indeed part of the Sutherland v. Electronic Arts case. The judge recognized that the pleading might be improved through being amended but decided against allowing the claimant to do so citing the importance of ensuring fair litigation through strict case management.
264
In any case, although successful in striking-out part of the claim, Electronic Arts should be criticized in making the following public statement:
“We're pleased that the trial court rejected, as a matter of law, the allegations of unlawful gaming. The court's decision reaffirms our position that nothing in our games constitutes gambling.”
265
This hearing was not the proper trial for the case (which is yet to come, as other parts of the claim were allowed to proceed), and the court did not reject the allegations of unlawful gaming per se and merely decided not to entertain them in this instance. Future litigation should properly focus on Embedded-Embedded loot boxes, particularly those found in games by companies that allow cashing-out within the game (e.g., Magic: The Gathering Online 266 ).
One notable exception to the claimants being unsuccessful is Epic Games' settlement of both the U.S. and Canadian class action suits without any admission of liability. In the U.S., 267 Epic agreed to distribute to all player accounts that have purchased loot boxes either US$7.99 (≈ £6) or US$9.98 (≈ £8) depending on the game. 268 In addition, Epic set up a settlement fund of US$26,500,000 (≈ £20,000,000) for U.S. players. Each player was permitted to claim for any damages to be paid either in virtual in-game currency (up to US$79.99 (≈ £61) or US$99.98 (≈ £77) in value, depending on the game) or in cash (up to US$75 (≈ £57)). Epic also agreed to refund any purchases made by minors without parental consent up to US$50 (≈ £40). In Canada, Epic agreed (with court approval in February and March 2023) to pay Canadian players who bought loot boxes a total of CA$2,750,000 (≈ £1,600,000), with each person receiving up to CA$25 (≈ £15). 269
INDUSTRY SELF-REGULATION
UK: Ukie's industry principles and guidance on loot boxes
In September 2020, the UK Government launched a call for evidence and consultation process on regulating loot boxes 270 after two committees from the House of Commons and from the House of Lords respectively raised their concerns. 271 The government response, published in July 2022, decided that “it would be premature to pursue legislative options … without first pursuing enhanced industry-led protections,” even though potential legislation was not dismissed outright in the event industry self-regulation does not effectively reduce harm. 272 Precisely one year later, the UK trade body representing the video game industry (Ukie) published 11 principles and related guidance on loot boxes 273 that have been endorsed by the government. 274
These principles do not break any new ground. Requiring companies to make loot box presence disclosures (Principle 4) 275 and probability disclosures (Principle 5) 276 and to provide robust parental control features (Principle 1) are measures that should already have been implemented as industry self-regulation several years ago. 277 Notably, the principles and guidance are not intended to be “prescriptive,” meaning that there will unlikely be industry uniformity and consistency when following them. For example, with probability disclosures, Principle 5 failed to establish an industry standard method of compliance. The shortcomings of mainland China's experience of requiring probability disclosures by law have not been taken into account (see section 2.3 above). Furthermore, Principle 5 would recognize a category-based disclosure as compliant, contrary to the regulations in Taiwan and South Korea (see sections 2.1 and 2.2 above). In many games, the perceived value of different rewards found within the same rarity differs widely: it is unhelpful to fail to inform players of their chances of obtaining specific individual items. Similarly, with parental control features, the guidance presents “industry best practice,” such as setting a spending limit of £0 by default on child accounts. However, it fails to actually require companies to implement this. The industry was also given a whole year as an implementation period: it must be queried whether giving companies that much time to comply is really justified.
Importantly, these self-regulatory principles also have no in-built enforceability. Neither Ukie nor the government has stipulated what percentage of the highest-grossing games complying would be deemed as satisfactory self-regulation (I previously suggested 95% 278 of the 500 highest-grossing games by 1 September 2023 to them in January 2023 when asked to comment on a draft version of the principles). I previously published in the leading UK industry media venue on these potential issues so it cannot be said that Ukie and the government have not been put on notice to address these concerns. 279 Companies cannot be fined or delisted for non-compliance, unless a platform provider (such as Apple) or the age rating organization (PEGI) steps in. However, previous experience has shown that those stakeholders have not strictly applied their enforcement powers. For example, 36% of the highest-grossing iPhone games with loot boxes failed to make probability disclosures in mid-2021 but still remained available for download on the Apple App Store. 280 This high prevalence rate of non-compliant games shows that Apple has not actively enforced its own rules. Another example is PEGI's recent enforcement action. My study identified that some companies failed to disclose to PEGI the presence of loot boxes in their games, which resulted in PEGI incorrectly failing to label these games as containing loot boxes. 281 For committing a “serious” breach of the PEGI Code of Conduct (which this was deemed to be), 282 two companies were fined €5,000 (≈ £4,300) each. 283 Even though the fine could have been between €5,000–€20,000 (≈ £4,300–£17,000), PEGI chose to apply the lowest possible fine. For context, one of the games that was fined generated US$525 (≈ £400) million in revenue in the one year since its release, 284 such that the fine represented only 0.001%. The highest fine for a third breach in the “serious” category is only €75,000 (≈ £64,000), as loot box-related failures can never fall within the “very serious” category because they are never capable of affecting the numerical age rating. 285 PEGI should consider giving itself the power to imposing higher fines, including GDPR (General Data Protection Regulation)-type, percentage-based fines on global turnover. This example shows that PEGI does not have sufficient deterrence powers nor is it willing to use the little power that it does have to its potential maximum to punish bad actors. Hopefully stakeholders like Apple and PEGI will better enforce their own rules in the future, but as it stands, the Ukie principles and guidance, whose policing relies on these self-regulators that have not previously been assertive, lack accountability.
The Ukie principles and guidance also did not deal with social/simulated casino games, which the Australian Government has recognized as more concerning than traditional loot boxes by requiring them to have a higher minimum age rating (see section 5.1 above). It has been PEGI policy since 2020 to rate any games with “simulated gambling” or “gambling” PEGI 18 (i.e., suitable for adults only). 286 However, the current problem is that, on both the Google and Apple stores (see Fig. 3), some older but very popular and high-grossing games in the “casino” category are not rated adults only and are instead rated 12+ or even lower. It may be sensible for PEGI to not go back and change the very low age rating for every historical game. 287 However, these casino games on iOS and Android are still generating significant amounts of revenue today, potentially from underage players. This loophole needs to be stopped. Such games would have received a PEGI 18 rating had they been submitted after 2020. It should be simple to apply the highest age rating mandatorily to all games tagged with the casino category or with gambling or simulated gambling content descriptors. 288
Social Casino Games That Are Rated Suitable for Minors (Specifically, 12+) on the Google Play Store and Apple App Store. © 2023 SpinX Games & CLASSMOBI Color images are available online.
Finally, neither the Ukie principles and guidance nor the UK Government have discussed how these commitments would be communicated to non-Ukie member companies. Many popular games, particularly on mobile platforms, are operated by smaller companies based in other parts of the world that may not have access to proper legal advice. After my study finding that the Belgian “ban” on loot boxes was not complied with by 82 out of the 100 highest-grossing iPhone games, 289 companies behind games like Roblox (Roblox Corporation, 2006) and Empires & Puzzles (Small Giant Games, 2017) took compliance action by changing the Belgian versions to remove loot boxes. 290 This demonstrates that at least some cases of non-compliance were due to a lack of knowledge, rather than malicious. It is important that the UK rules are widely disseminated, and this should be one of the focus areas during the 12-month implementation period. Done well, players in other parts of the world might also benefit from these measures. Why would a responsible company remove consumer protection features from other countries' versions, right?
India: attempted bans on online games of chance struck down as unconstitutional
India has no regulation explicitly dealing with loot boxes inside video games, although the national Public Gambling Act 1867 in theory prohibits, with some exceptions, any games that are not a “game of mere skill” 291 and there are state laws to the same effect. 292 Loot boxes as a standalone mechanic are evidently not games of skill and must therefore be caught. However, gambling law has not yet been so applied to deal with loot boxes. Indeed, there have been no attempts through other laws to directly address loot boxes either. Notwithstanding, the States of Karnataka, 293 Kerala, 294 and Tamil Nadu 295 have all respectively attempted to more strictly regulate certain online games of chance (in particular, rummy and poker). Intentionally or not, the state laws of Karnataka and Tamil Nadu were both drafted with such broad language that video game loot boxes are undoubtedly captured and banned as a result.
Notably, these state laws have all since been struck down by the relevant High Court as unconstitutional because, inter alia, contrary to Western perspectives, 296 rummy and poker are viewed as games of skill, rather than games of chance, such that attempting to regulate them under the guise of regulating gambling is ultra vires. 297 A Supreme Court ruling is reportedly expected on this point in the imminent future. Tamil Nadu has already adopted new legislation in an attempt to draft a constitutionally permissible version of the intended regulation, including establishing a Tamil Nadu Online Gaming Authority with the mandate to regulate online games regardless of whether they involve elements of chance (i.e., including video games). 298 In any case, that particular point which caused the state laws to be struck down is not relevant to loot boxes, which on their own do not involve any element of skill. States are not prevented by the Constitution to regulate loot boxes. If the aforementioned state laws are upheld by the Supreme Court or if alternative, constitutionally compliant versions are adopted (as seemingly already done in Tamil Nadu), then loot boxes would likely fall within their ambit and be banned. However, whether the laws would be so enforced is another question.
CONCLUSION
This article has sought to provide a whistle-stop tour around the world of loot box regulation. A diverse range of approaches are being considered and have been presented. The Belgian experience of failing to “ban” the mechanic has shown that a particularly restrictive approach is unlikely to work perfectly effectively; however, that should not dissuade policymakers from taking action if they deem doing so to be appropriate. Being realistic about what can be achieved (given the known difficulties of regulating technology) and providing sufficient funding to meet those goals are important. Considering the developing evidence base, it is unacceptable to not intervene to at least ensure transparency and fairness in the consumer experience through the proper enforcement of existing laws. Whenever gambling or consumer protection laws are breached, the relevant enforcers must take proactive action. The industry is conscious of the threat of regulation and should act more responsibly to prevent overly paternalistic regulation that is detrimental to all stakeholders. As it stands, in countries where players (particularly minors) are not being adequately protected by regulation (either due to a lacuna in the law or the lack of enforcement), it would be prudent for players and parents to take care in learning more about loot boxes and how to prevent their potential harms. In principle, the burden should never be on the individuals to protect themselves from harmful commercial products, but when confronted without sufficient regulatory protection, individuals need to be pragmatic and protect themselves as needed.