How loot boxes are regulated depends almost entirely on where you live and whether the rewards can be traded for real money. There is no global rule: Belgium and the Netherlands have come closest to a ban, most of Europe leans on probability disclosure or an age floor, and the United States treats these systems mainly through consumer protection law rather than gambling statutes.
The practical consequence is a patchwork. A game can be completely legal in one country, restricted to adults in the next, and quietly removed or region-locked in a third.
Key takeaways
- Four levers do most of the work: gambling licensing, mandatory probability disclosure, consumer protection law, and minimum age ratings.
- Belgium and the Netherlands are the closest to an outright prohibition, and both positions have been challenged or softened in recent years.
- Japan, China and South Korea mandate drop rate disclosure; Australia pushes gambling-style titles toward an 18 classification.
- The US has no federal loot box law. The Federal Trade Commission acts through the FTC Act and state consumer protection statutes instead.
- A November 2025 FTC action against HoYoverse made selling loot boxes to under-16s without verifiable parental consent the most concrete US compliance line yet.
Table of Contents
- 1What Is a Loot Box?
- 2How is that different from buying an item directly?
- 3How is a loot box different from gacha?
- 4Why Loot Boxes Are Regulated
- 5What the research says about harm
- 6How Loot Boxes Are Regulated Worldwide
- 7Which Countries Prohibit or Restrict Loot Boxes?
- 8Where else are loot boxes restricted?
- 9What Rules Apply in the United States?
- 10What the November 2025 FTC action against HoYoverse changed
- 11Where state law adds its own layer
- 12How Are Loot Boxes Regulated in Europe?
- 13How Does Regulation Work in Asia-Pacific?
- 14What Must Developers Disclose?
- 15Are Loot Boxes Considered Gambling?
- 16Loot box or gacha, side by side
- 17Do Age Ratings and Platform Rules Make a Difference?
- 18What Protections Apply to Minors and High-Spending Players?
- 19What Should Players Do to Assess a Loot Box?
- 20Frequently Asked Questions
- 21Are loot boxes legal everywhere?
- 22Are loot boxes legally gambling?
- 23Do game developers have to show loot box odds?
- 24Can children buy loot boxes?
- 25Can I get a refund for loot box purchases?
- 26Conclusion
What Is a Loot Box?
A loot box is a virtual container that gives a player a randomised selection of in-game items when opened. The container is earned through play or bought with real money or virtual currency, and the contents are decided by a random number generator rather than by the player’s choice.
That randomness is the whole legal story. A cosmetic crate you can buy outright is a normal digital purchase. A crate whose contents you cannot see, cannot choose and cannot refund is a chance-based transaction, and chance-based transactions attract rules that direct purchases never face.
How is that different from buying an item directly?
Buying a specific skin is a fixed-price transaction. You know what you are getting before you pay, the price does not change between players, and a refund dispute is a straightforward consumer matter. The loot box removes all three certainties at once.
How is a loot box different from gacha?
Gacha is the same random-reward structure, usually sold in a rotating banner and usually wrapped around characters or equipment that drive progression. Cosmetic loot boxes are peripheral to how the game is played. Gacha is often central to it. Regulators and players treat the two very differently, and we cover the legal distinction further down.
Why Loot Boxes Are Regulated
Regulators do not use a single definition. Most apply a three-part test borrowed from gambling law, and a system that satisfies all three is the one most likely to be treated as gambling.
- Consideration. Did the player put something of value in? Real money counts. In-game currency earned by playing is a weaker but contested form of consideration.
- Chance. Was the outcome determined by randomness rather than skill? Almost every loot box qualifies here.
- Prize. Does the player receive something of value? An item with real-world resale value is far more dangerous than an item that only exists inside the game.
Worked example: a paid crate of purely cosmetic sprays with no trading function in a competitive shooter is weak on all three. A paid banner that hands out a playable character, on a platform where those characters can be sold to other users for money, hits consideration, chance and prize together.
What the research says about harm
The behavioural-science argument is that loot boxes use variable-ratio reinforcement, the same scheduling pattern that makes slot machines hard to stop playing. Repeated small wins keep the reward loop going, and a pity mechanic guarantees a payout only after enough failed attempts that players often report spending more than they intended.
Independent work by researcher Leon Xiao has repeatedly found that industry self-regulation produces very low compliance, with publishers disclosing odds in places most players never open. Forum discussion on r/gamedesign echoes that finding, arguing that disclosure in a menu nobody visits is not disclosure in any meaningful sense.
A Queen Mary University of London study reached a more pragmatic conclusion: a country-wide ban is not practically achievable, which is why most governments have chosen disclosure and age limits over prohibition.
How Loot Boxes Are Regulated Worldwide
Four regulatory levers cover almost every jurisdiction in the world. The first is classification as gambling, which requires a licence or bans the mechanic. The second is mandatory probability disclosure, the most common approach in Asia. The third is consumer protection law, which is how the United States and much of Latin America handle it. The fourth is minimum age ratings, which raise the floor for who may buy without touching the mechanic itself.
| Jurisdiction | Status | Legal basis | Odds disclosure | Age rules |
|---|---|---|---|---|
| Belgium | Effectively prohibited without a licence | Gaming Commission ruling under gambling law | Not applicable while prohibited | Adults only |
| Netherlands | Restricted, with enforcement action taken | Dutch Gambling Act | Not applicable while restricted | Adults only |
| United Kingdom | Permitted, disclosure and age rated | Gambling Act and UK Gambling Commission guidance | Expected, with a minimum 16 rating for games with loot boxes | 16+ where loot boxes are present |
| European Union | No harmonised ban, national rules vary | Member state law, plus European Parliament pressure | Varies by member state | Varies by member state |
| France | Permitted with controls | Consumer and digital services law | Expected | Teen and adult rating requirements apply |
| Spain | Permitted, stricter items rules | National consumer law and loot box decree | Expected, with additional restrictions on certain items | Ratings apply |
| Germany | Permitted with disclosure | Youth protection and market surveillance rules | Expected for minors-facing titles | Strict separation for under-16 titles |
| Austria | Permitted with disclosure | Youth welfare law | Expected | Age-restricted where applicable |
| United States | Permitted, no federal loot box statute | FTC Act, state consumer protection statutes, COPPA | Only if the odds are misleading | App store rules block under-13 purchases without consent |
| Australia | Permitted, heavily rated | Classification rules covering simulated gambling | Expected | Gambling-style titles push toward 18+ |
| Japan | Permitted under specific rules | Gacha legislation with prior disclosure requirements | Mandatory | Teen classification rules apply |
| China | Permitted under strict approval | Game approval and monetisation review | Mandatory, published before purchase | Real-name verification and playtime limits |
| South Korea | Permitted, pressure rising | Game industry promotion law, youth safeguards | Mandatory, with disclosure requirements | Ad restrictions and youth protections |
| Brazil | Moving toward legislation | Pending bills and age verification proposals | Expected to be required | Proposed adult-only rule |
Read the table as a snapshot rather than a rulebook. Several of these lines are under active review, and the Netherlands in particular has shifted more than once.
Which Countries Prohibit or Restrict Loot Boxes?
Belgium is the reference point. The Gaming Commission ruled in 2018 that loot boxes constitute gambling, which means a publisher needs a gambling licence to offer them. Most studios responded by removing paid boxes from the Belgian build rather than licensing.
The Netherlands went further through enforcement rather than legislation. Authorities concluded that some loot boxes fell under the Dutch Gambling Act because the items had a transferable value, and titles that kept selling boxes faced action.
Distinguishing a formal rule from a headline matters here. In both countries the core position has been challenged in court or reopened for review, and publishers have treated both markets as grey enough to test. That is why you will still find Belgian and Dutch players in live boxes. It is also why you should not treat the current position as permanent.
Where else are loot boxes restricted?
Australia restricts them through classification rather than prohibition. Titles that use simulated gambling mechanics and casino-style presentation can be pushed into an 18 category, while mechanically similar games with less gambling imagery may stay rated for younger players. Players have noticed that the standard tracks how a game looks more than how it works, and several communities have raised that inconsistency as a design problem.
What Rules Apply in the United States?
Loot boxes are not banned in the United States, and there is no federal statute that prohibits them. Attempts to classify them as gambling under state law have generally failed. In Kater v. Churchill Downs, the Ninth Circuit held that virtual chips had no value outside the game and so were not a thing of value in the gambling sense, and similar cases have followed.
What regulates them instead is consumer protection law, which is a slower but broader tool. The Federal Trade Commission can act under the FTC Act against practices it considers deceptive or unfair, and state attorneys general have parallel authority under unfair or deceptive acts and practices statutes. That gives regulators room to attack specific mechanics rather than the whole category.
What the November 2025 FTC action against HoYoverse changed
In November 2025 the FTC took action against HoYoverse over the monetisation of Genshin Impact, with a proposed civil penalty in the tens of millions. The part that matters for players is not the money. It is the requirement that publishers cannot sell loot boxes to players under 16 without verifiable parental consent.
That is the clearest US compliance line to date. It is narrower than a ban, and it applies to a specific age group rather than every player, but it makes age verification a legal requirement instead of a store-front suggestion.
Where state law adds its own layer
States have been more active than Congress. Several have introduced or pursued loot box labelling and disclosure bills, and state consumer protection statutes give prosecutors a route into misleading odds. Children are covered separately by COPPA, which restricts data collection and purchases from under-13s, and by app store rules that require parental consent before a minor spends.
How Are Loot Boxes Regulated in Europe?
Europe has no single loot box law. Regulation sits with individual member states, which has produced four broad models rather than one rule. The UK’s approach is disclosure plus an age rating, France and Austria lean on disclosure and youth protection, Spain adds item-level restrictions, and Germany applies stricter separation rules to titles aimed at under-16s.
The UK position is the one most players ask about. The Gambling Commission has said consistently that where in-game items cannot be cashed out, the position differs from gambling. In practice that means paid boxes stay legal, but expectations have hardened: odds should be visible, and from 2026 the rating floor for games containing loot boxes has moved to a minimum of 16.
At EU level the pressure is political rather than legislative. The European Parliament has voted to call on the Commission to act on loot boxes alongside gaming addiction and gold farming. That is not yet binding law, but it shapes how national regulators and platform holders behave.
| Market | Legal position | What must be disclosed | Spending protections | Player rights |
|---|---|---|---|---|
| United Kingdom | Permitted, 16 rating floor | Item probabilities, close to the purchase point | Platform parental controls apply | Gambling Commission complaint route for misleading conduct |
| France | Permitted with controls | Odds and rate limiting on some titles | Pre-set spending caps in some cases | Consumer protection remedies |
| Spain | Permitted with item rules | Odds, with some items restricted in youth-facing titles | Parental consent requirements | Consumer authority complaints |
| Germany | Permitted with disclosure | Odds for titles aimed at minors | Strict separation for under-16 audiences | Market surveillance complaints |
| Austria | Permitted with disclosure | Odds | Youth welfare review | Standard consumer remedies |
How Does Regulation Work in Asia-Pacific?
Asia-Pacific is the region that treats drop rates as a publishing requirement rather than a courtesy. Japan, China and South Korea all require probability disclosure, and in China the odds must be published before you can buy.
Japan runs gacha as its own legal category. Random-reward mechanics must be disclosed in advance, and titles fall under youth classification rules that apply different limits by age band. Players get a genuine regulatory framework rather than a voluntary one.
China adds the game approval system on top. Titles need approval before release, monetisation mechanics are reviewed during that process, and real-name verification brings playtime and spending limits that few other markets match.
South Korea requires drop rate disclosure and has tightened youth advertising restrictions. When EA removed paid loot boxes from EA Sports FC in the Korean build, the reaction on r/pcgaming was less about the removal itself than about the message it sent: publishers will drop a feature in one country rather than lose the revenue, which left players in every other market feeling the rules only reach them when a regulator forces the issue.
Australia works through classification, as covered above. Brazil is the jurisdiction worth watching next. Bills on loot boxes and age verification have advanced through the legislative process, and if any of them pass, Brazil would become the largest market to impose a hard restriction.
What Must Developers Disclose?
Where disclosure duties exist, they usually cover the same handful of things. Here is what each one looks like from a player’s side, and the question worth asking when you cannot find it.
| Requirement | What it means in practice | What to ask the game |
|---|---|---|
| Item probabilities | Exact drop rates for each rarity tier | Can I see the percentage for the item I actually want, before I spend? |
| Pity counter progress | How close you are to a guaranteed rare | Is my guaranteed-pity progress visible and does a duplicate convert to something? |
| Purchase price | Cost per pull in real and virtual currency | What is the cost of the worst realistic outcome, not just one pull? |
| Age rating | The classification the game carries | Is the rating shown in the store listing rather than buried in a menu? |
| Odds change notice | Warning when rates are adjusted | Was this rate changed after launch, and was I told? |
| Purchase history | A record you can export or review | Can I see exactly what I spent and when? |
If a game cannot answer any of these, that tells you something useful before you spend a cent.
Are Loot Boxes Considered Gambling?
Sometimes, and the answer turns on five questions rather than one. What is the mechanic? A pure chance draw is much closer to gambling than a pick-one-of-three with visible contents. How was it paid for? Real money strengthens the case; in-game currency earned through play weakens it, though not to zero. Does the item have real-world value? An item you can sell to another player is in a completely different category from a spray you cannot. Who is allowed to play? Age restrictions reflect a recognition that this is not a purchase most children should make unsupervised. Can the prizes be transferred? Transferability is the single strongest indicator that regulators look at.
A pity counter that guarantees a rare item after a set number of attempts is a genuine mitigation, and regulators do consider it one. It does not make the mechanic not gambling, because the reward still arrives on a random schedule, but it changes how the risk reads.
Loot box or gacha, side by side
The short version: loot boxes are usually cosmetic and peripheral, gacha usually carries characters or equipment that decide outcomes. Cosmetic-only crates face lighter regimes. Gacha that gates power attracts much harsher treatment, both from regulators and from players, who tend to judge pay-to-win systems far more severely than the same random draw attached to a costume.
Do Age Ratings and Platform Rules Make a Difference?
They matter a lot, and they are not the same as national law. A rating tells you how a title is classified for a given market. A platform rule tells you what that store will allow. National law tells you whether the mechanic is legal at all.
ESRB, PEGI and IARC all incorporate consideration of in-game purchases and chance-based mechanics into the classification, which is why so many games carry a higher age rating than their content would otherwise suggest. Apple and Google require parental approval before a minor spends, and both have tightened those consent flows. PlayStation and Nintendo apply their own regional and age rules on top.
Steam and Epic storefronts add their own restrictions in particular territories, sometimes a regional lock and sometimes a warning. None of these replace a regulator’s decision. What they do is make the practical experience stricter than the letter of the law in your country.
What Protections Apply to Minors and High-Spending Players?
The protections that exist are real but unevenly applied. Parental controls on the platform or console usually include spending limits, approval prompts and the ability to block purchases outright. Where parental consent is legally required, verification is more meaningful than a checkbox, which is precisely the distinction the FTC action against HoYoverse was about.
Some markets add self-exclusion for gambling-adjacent systems, spending caps enforced at the game level, and restrictions on which items can appear in youth-facing titles. Where none of that is present, the practical tools are still on your device: set a hard purchase limit, remove stored payment details, and require a password for in-app purchases.
For unauthorized purchases by a minor, keep the receipts and the store’s parent support route open. In practice, chargebacks through your card issuer are the path players report as working, and forum threads on refunds consistently point to documented, dated purchase records as the thing that makes a difference.
What Should Players Do to Assess a Loot Box?
You can evaluate a loot box in about ten minutes without any special knowledge. Find the odds first, in the store listing or the in-game information panel, and if the game will not show them, that is your answer. Then calculate the realistic worst case by multiplying the cost per pull by a realistic number of attempts rather than one.
Next, set a hard budget before your first purchase and treat it as final. Never borrow to buy boxes, and remove stored card details from the store so friction does the work for you. Turn on purchase confirmation prompts and spend limits at the platform level, not in the game, because the game controls are the ones you are most likely to disable.
Finally, record what you spend and when. If a rate changes mid-banner or a purchase turns out to be misleading, that record is what you will need for a store complaint or a chargeback. Keep in mind that both national law and platform policy change, so check your own country’s current position rather than trusting an article, including this one, to be permanently current.
Frequently Asked Questions
Are loot boxes legal everywhere?
No. Belgium has treated paid loot boxes as gambling without a licence, and the Netherlands has enforced gambling law against titles that sell transferable items. Most other markets allow them with conditions such as probability disclosure or a minimum age rating. Because positions shift, check your own country’s current regulator guidance before assuming a mechanic is legal where you live.
Are loot boxes legally gambling?
It depends on five things: whether the outcome is pure chance, how you paid, whether the item has real-world value, whether minors can buy, and whether prizes can be transferred or sold. A cosmetic crate with no resale value that only works inside the game is unlikely to qualify. A paid banner handing out tradeable characters usually does.
Do game developers have to show loot box odds?
In many markets, yes. Japan, China, South Korea and parts of Europe require drop rate disclosure, and China requires the rates to be published before purchase. Elsewhere, including most of the United States, disclosure is only compelled when a regulator argues the odds presented were misleading. Always check whether the odds shown are per-item or an aggregate figure.
Can children buy loot boxes?
Rarely without some gate in place. The UK applies a minimum 16 rating to games with loot boxes, and a November 2025 FTC action against HoYoverse made it unlawful to sell loot boxes to under-16s in the United States without verifiable parental consent. Apple and Google also require parental approval before a minor spends, and app stores block purchases by under-13s by default.
Can I get a refund for loot box purchases?
It depends on why you are asking. Unauthorized purchases by a minor are the strongest case, and documented, dated receipts submitted through the store’s parent support route are the thing that usually works, with chargebacks through your card issuer as the fallback. Disliking a result is generally not a refundable ground, because the purchase was the chance itself rather than an item you were sold.
Conclusion
There is no universal rule for how loot boxes are regulated, and anyone who tells you there is one is describing their own country. Start by finding the odds for the specific banner you are looking at, then check what your jurisdiction currently requires, since disclosure duties and age floors change more often than people expect.
After that, use the controls you already have: platform spending limits, purchase confirmation prompts, removed saved payment details, and age ratings you actually read. Those four things will protect your budget in every jurisdiction, including the ones that never regulate this at all.
This article is general information about regulatory approaches, not legal advice. Rules and enforcement positions change; check your national regulator or a qualified lawyer for advice about your situation. Last updated October 2026.
