Loot box State of Play 2023: A global update on regulation

Loot boxes are still here with us in 2023, and some countries are finally catching up with regulation.

The approach taken in the past few years has generally been to determine whether different types of loot boxes legally constitute 'gambling' in different countries and, if so, then seeking to regulate them using pre-existing laws. However, more recently, countries have explored other potential options, such as enforcing consumer protection law; requiring that specific information be disclosed; or demanding action from age rating organisations.

In this article, I provide an update on the various policies I discussed last year in Loot Box State of Play 2022 and also summarise new developments. This piece highlights the key takeaways from my academic writing about loot box regulation globally, which is available here. More technical and legal details (including source documents in their original language) are available at that link for those interested in delving deeper.

When I speak of 'loot boxes,' I very broadly mean any in-game purchases with randomised elements that are bought with real-world money, or with premium in-game currency that is bought with real-world money (so-called 'paid loot boxes'). Basically, the player does not know exactly what they will get as part of a purchase involving real-world money. This includes social casino games, for example.

Belgium: The ban continues

Belgium continues to maintain its 'ban' on loot boxes because the country's gambling law has a uniquely wide definition. This means that loot boxes cannot be legally offered for sale to either children or adults. We know that the regulator has not enforced the law due to lacking resources, but companies, such as Roblox Corporation, have more recently taken compliance action. Even if the law is unenforced, companies would be well-advised not to breach it. Major hardware platforms, storefronts, and publishers would naturally demand compliance.

Even if the Belgian law is unenforced, companies would be well-advised not to breach it

The Netherlands: A ban was proposed but is uncertain

As discussed last year, the highest Dutch administrative court decided that loot boxes generally cannot be regulated under gambling law. Since then, policymakers have found this to be unsatisfactory and proposed changing the law to emulate the Belgian position, and I received official confirmation from the then Dutch government in July 2023 that they were pursuing a loot box ban (and even intended to advocate for this to be done at an EU-level). However, a new government is in the process of being elected, so we cannot be sure what might happen in the Netherlands in the future.

Austria: Certain loot boxes may be illegal gambling

A number of civil court decisions have considered whether loot boxes whose rewards can be transferred to other players (and thus possess real-world monetary value) would constitute illegal gambling. If so, players would be entitled to have the money they spent on loot boxes refunded to them.

Unfortunately, Austrian judgments from the lower courts are not published, but I have obtained copies of seven relevant decisions concerning loot boxes (including appeals). Frankly, the judgments are in conflict with each other because they were decided by different courts: different conclusions were drawn on the same point of law. However, there were at least two cases where the court decided that loot boxes whose rewards possess real-world monetary value constitute illegal gambling, and that the player was indeed entitled to a refund.

The relevant defendant companies have since decided not to challenge the decisions, partly because these did not set any precedents that future courts must follow. Indeed, other judgments contrarily decided that the same loot boxes would not constitute illegal gambling. These cases were issued by players with support from litigation funders, who have expressed that they would help to bring even more cases. I would therefore urge companies to be cautious when operating in Austria.

Germany: Age ratings account for loot box presence

In April 2021, the German Protection of Young Persons Act (JuSchG) was amended to require the German age rating organisation (the USK) to take into account the presence of 'gambling-like mechanisms' when making age rating decisions. This became effective from January 1, 2023. Games with loot boxes must be attached with the warning label of 'In-Game-Käufe + zufällige Objekte [In-game purchases + random items].'

This change in the law actually led to practical differences. The FIFA (now FC) video game series by Electronic Arts has always been given the USK age rating of 0 (approved with no restrictions). However, the newest rendition, EA Sports FC 24, was rated USK 12 (approved for young people aged 12+). In contrast, the ESRB and PEGI ratings were unchanged and remain E and 3, respectively.

I am personally slightly concerned that a football simulation game with no controversial elements (besides the loot boxes) is now deemed unsuitable for young people under 12 in Germany. Some parents may stop taking age rating advice seriously as a result, and I do not think encouraging companies to abandon the youth market by forcing a (significantly) higher age rating is wise. Young people would have significantly less content to enjoy. It might be a better policy to instead ask companies to also produce a version of the game with no loot boxes for young people and rate that version accordingly (this is already technically possible with EA Sports FC 24 by turning off in-game purchasing by default).

Australia: Mandatory minimum age ratings

A similar stance based on age ratings has been taken in Australia, but the rules are even more prescribed. In Germany, the USK has only been asked to consider loot box presence (without demanding a compulsory minimum age rating). In contrast, the amended Guidelines for the Classification of Computer Games 2023 of Australia (effective from 22 September 2024) require that games with loot boxes must be rated at least M (not recommended for persons under 15 years of age with no legal restrictions on access) and those with simulated gambling must be rated R 18+ (legally restricted to adults only).

Notably, the M rating is not legally binding, and this distinction between loot boxes and simulated gambling is difficult to draw. Companies intending to offer loot boxes in Australia should ensure that no traditional gambling motifs or allusions are used.

Taiwan and South Korea: Probability disclosures

Mainland China was the first to require companies to inform players of the likelihood of obtaining various potential rewards since 1 May 2017. Industry stakeholders (such as the ESA and Video Games Europe in 2019) have demanded that this is done elsewhere as well, meaning that this requirement is technically in force in nearly all countries as industry self-regulation.

Since then, probability disclosures have become increasingly officially required as a matter of law. Taiwan started requiring this from 1 January 2023, and South Korea will require this from 22 March 2024. Notably, Taiwan additionally requires a warning message to be attached stating: 'This is a product with a chance to win prizes. Consumers' purchase or participation in the event does not mean that they will obtain specific products.' South Korea is expected to also set out more specific rules about how disclosures should be made in due course.

Companies intending to offer loot boxes in Australia should ensure that no traditional gambling motifs or allusions are used

Italy and the Netherlands: Probability disclosures

Outside of Asia, the Dutch and the Italian consumer protection agencies have argued on the basis of EU consumer protection law (specifically, national implementations of the Unfair Commercial Practices Directive) that not disclosing loot box probabilities is a misleading commercial practice, specifically a misleading omission. The laws in other EU countries are supposed to be the same, so companies operating in this region would be well-advised to make probability disclosures. Indeed, as mentioned, these should be required by industry self-regulation (e.g., platform rules) in any case.

The Netherlands: Real money purchase price

Interestingly, the Dutch consumer protection agency also argued that all in-game purchases (including loot boxes) must show their price in euros (even though they might not be directly purchasable using euros), in addition to just their price in terms of the premium in-game currency. This measure is intended to make clear to the player how much each in-game purchase costs in real-world monetary terms. The UK advertising regulator has previously decided against requiring this after consultation.

UK and beyond: Loot box presence warning labels

Another measure intended to provide players and parents with more information is the requirement that game with loot boxes need to append a warning label stating: 'In-game Purchases (Includes Random Items).' This is required internationally by major age rating organizations and platforms. PEGI has fined Blizzard Entertainment for failing to disclose loot box presence during the rating process, which caused Diablo Immortal to operate for a year without the required label. The fine was only €5,000, which was only 0.001% of the game's revenue on some platforms in that first year of its release. Nonetheless, given the potential reputational damage, companies should always disclose the presence of all relevant content to age rating organisations.

Indeed, beyond industry rules, the UK advertising regulator has also determined that Hutch Games was in breach of advertising rules for failing to disclose the presence of loot boxes on its games' Apple App Store and Google Play Store listings. Companies should ensure that all video game advertising (including on social media) provides, at a minimum, the legally required information. Given that the UK advertising rules stem from EU consumer protection law, I suggest that the legal position is similar in other EU countries (and am indeed in the process of asking relevant regulators to enforce the law).

UK: Improved industry self-regulation by UKIE

The UK Government decided to ask UKIE, the main industry body, to better self-regulate loot boxes. UKIE has since published 11 principles. Probability disclosures and presence warnings (discussed above) are both required. Importantly, loot boxes must not be sold to under-18s without parental consent. Amongst other commitments, companies should also implement more lenient refund policies when parents make contact, and support the UK Government Video Games Research Framework (Can academic researchers have some industry data on loot box spending, please?)

US and Canada: Class action suits continue

Many civil cases have been brought in relation to loot boxes in the US and Canada. I am personally of the view that most of these do not have merit either because unsustainable arguments (and even factual errors) were made or better arguments were omitted. However, notably, Epic Games settled the claims in the US and Canada (without admitting liability). This suggests that some companies might want to put the loot box issue to bed and draw a line in the sand, regardless of any merits the legal arguments may have.

Spain, Finland, Illinois, and Brazil: Other developments

Finally, the Spanish draft law, Finnish bill, and Illinois bill on loot boxes discussed last year have either died or not progressed (and are therefore presumed dead). However, the Brazilian bill intending to ban loot boxes does appear to be slowly progressing through the legislative process.

To disclose relevant conflicts: I was and am personally involved in some of the enforcement actions that have been discussed. Companies are advised to seek specialist legal advice, given that loot box regulation is diverging more and more across jurisdictions. It is no longer just gambling rules that loot boxes must not infringe. Many other national requirements must also be complied with.

I thank Laura L. Henderson for her assistance in preparing this article.