Loot Box Laws by Jurisdiction: What Indie Game Studios Must Know

What Is a "Loot Box" and Why Regulators Care

A loot box is a randomized reward mechanism: a player pays (with real money or purchasable in-game currency) and receives a randomized item. That simple transaction maps onto the three-element test that underlies gambling law in nearly every jurisdiction — consideration, chance, and a prize. Whether a particular loot box crosses the line into regulated gambling depends almost entirely on how each jurisdiction answers one question: do the virtual items constitute a "prize" of real monetary value?

For regulators, the secondary market is the fault line. Items that can only be used within a closed game present a weak prize argument. Items that can be traded between players, sold on third-party marketplaces, or converted to cash attain real-world value — and with that value, the gambling analysis clicks into place. This distinction explains why Belgium and the Netherlands imposed hard prohibitions while France and the United States have held back: European regulators looked at games where item trading fueled a multi-billion-dollar skin gambling economy and saw an unlicensed gambling product. The FTC saw a consumer protection problem instead.

In 2018, Belgium's Gaming Commission investigated FIFA 18, Overwatch, Counter-Strike: Global Offensive, and Star Wars Battlefront II and concluded that each met the game-of-chance definition — financial stake, element of chance, possibility of winning. The FTC's 2019 workshop reached a different framing: loot boxes can mask real costs through multi-tier virtual currency, and marketing them to children raises deceptive-practice concerns regardless of whether the underlying mechanic qualifies as gambling. Understanding both regulatory frames — gambling law and consumer protection law — is the foundation for any global launch strategy.

Belgium: The Most Restrictive Jurisdiction

Belgium operates the harshest loot box regime in the world. The Belgian Gaming Commission's April 2018 ruling declared that paid loot boxes constitute illegal games of chance under the Belgian Gambling Act whenever they satisfy four elements: a game component, a wager (real money or purchased virtual currency), a chance of winning or losing, and an element of randomness. The penalty structure is not administrative — it is criminal: imprisonment of six months to five years and fines up to €800,000.

After the 2018 ruling, Valve, Activision Blizzard, and 2K Games promptly disabled loot box trading for Belgian players. EA refused. The Commission referred EA to the Belgian courts by September 2018, and EA finally removed paid FIFA Ultimate Team packs in January 2019 — only after criminal prosecution became imminent.

A 2023 academic study by Leon Y. Xiao found that 82% of the 100 highest-grossing iPhone games in Belgium still offered paid loot boxes — an enforcement gap some studios have treated as tacit permission. That calculus shifted in January 2025, when the Antwerp Enterprise Court ruled in LS v. Apple that paid loot boxes are illegal games of chance and that Apple, as distribution platform, could be held liable for hosting non-compliant games. This is the first court judgment to confirm the Gaming Commission's 2018 position — and to extend liability to the distribution stack, not just the developer.

For an indie studio, the Belgian risk is asymmetric: enforcement has been inconsistent, but criminal exposure means a single investigation can be existential. The 2025 Antwerp ruling signals increasing enforcement appetite. The practical options are to disable paid randomized mechanics for Belgian users entirely, or to structure any loot box mechanic without tradeable or cash-convertible items.

Netherlands: Gambling Authority Enforcement

The Dutch Gaming Authority (Kansspelautoriteit, or KSA) established its loot box standard in April 2018: loot boxes whose contents are non-transferable are lawful in-game features; loot boxes whose contents are transferable — tradeable between players or convertible to real-world currency — are illegal games of chance under the Wet op de kansspelen. Developers were given until June 20, 2018 to disable transferable loot box functionality or face fines up to €830,000 and potential sales bans.

The KSA's most significant enforcement action targeted EA's FIFA Ultimate Team, where it imposed a €10 million fine in 2020. In 2022, the Dutch Council of State overturned that fine on a narrow ground: FIFA packs are not a standalone game of chance because they operate within the larger, skill-based Ultimate Team mode rather than as an independent gambling product. The court's logic — that a game of chance requires a standalone gambling product, not merely a randomized component embedded in a larger game — introduces a design defense for studios that fully integrate loot box mechanics into core gameplay rather than isolating them as separable features.

The practical compliance picture for the Netherlands has two firm rules. First, the transferability prohibition has never been challenged — no court has overturned the KSA's core finding that tradeable loot box items constitute gambling. If your game allows players to trade or sell items on secondary markets, disable that functionality for Dutch users. Second, the 2022 EA ruling suggests that deeply embedded randomized mechanics (not separable from the main game loop) carry lower enforcement risk than bolt-on loot box stores operating as separate gambling products. For indie studios launching live-service games in Europe, these two points define the architectural decisions that determine Dutch compliance from day one.

Germany, France, UK, and EU-Level Developments

No EU-harmonized loot box regulation exists under the Digital Services Act or Digital Single Market framework. What exists instead is a patchwork of national positions that forces studios to conduct jurisdiction-by-jurisdiction analysis for every European market.

Germany has not classified loot boxes as gambling. The 2021 amendments to the Youth Protection Act (JuSchG) treat loot boxes and in-game purchases as "interaction risks" that can elevate a game's age classification under the Commission for Youth Media Protection (KJM) — not BaFin, which handles financial products. The operative compliance obligation for German distribution is parental consent gating with default-restricted settings: games must implement controls that block interaction risks by default, changeable only by parents.

France is the most permissive major European market. Gambling regulator ARJEL (now ANJ) concluded in 2018 that loot boxes fall outside French gambling law because prizes from loot box openings "very rarely" constitute monetizable gains. No enforcement actions have followed. France represents the clearest European market for studios using standard non-tradeable loot box mechanics.

The UK took a middle path in July 2023. The government declined to classify loot boxes as gambling products, opting instead for industry-led protections: mandatory probability disclosure, parental consent gates for under-18 purchases, and accessible spending controls. The government explicitly retained the threat of legislation if industry adoption proves inadequate — making the UK's current self-regulatory framework a floor with an escalation mechanism attached.

DLA Piper's survey of 30+ jurisdictions confirms that "a universally accepted standard of consumer protection regarding loot boxes remains elusive." Denmark, Sweden, and Spain have flagged gambling-like characteristics without enacting specific rules. For European launches, treat Belgium and Netherlands as hard prohibitions, UK as a disclosure-and-consent compliance regime, and France and Germany as markets requiring youth-protection structuring rather than gambling analysis.

United States: No Federal Law, State-Level Movement

The United States has no federal loot box law. The FTC's August 2020 staff perspective paper — the official output of its 2019 loot box workshop — declined to recommend regulation, instead calling for industry self-regulation: probability disclosure, display of in-game spending in real-dollar terms, and direct-purchase alternatives to randomized mechanics. That posture sets the current federal compliance baseline.

The more consequential US development came in January 2025. The FTC settled with HoYoverse, developer of Genshin Impact, for $20 million. The settlement banned HoYoverse from selling loot boxes to users under 16 without parental consent and required accurate odds disclosure, real-currency exchange rate transparency, and direct purchase availability for all items obtainable via loot box. The FTC's theory was COPPA violations for child data collection and FTC Act Section 5 deceptive practice violations for misrepresenting odds and obscuring real costs through multi-tier virtual currency. This settlement is the concrete US enforcement template: three failure modes — odds deception, currency obfuscation, and child marketing without parental consent — map directly onto the practices studios must avoid.

State legislation has produced media attention but no enacted law. Hawaii SB 3024 (2018), which would have prohibited loot box game sales to consumers under 21, passed committee but stalled in the House after ESA opposition. The same pattern has repeated across Minnesota, Washington, and Missouri. Industry lobbying has been effective at the state level.

For mobile studios, platform policies fill the gap. Apple's App Store Review Guidelines (§3.1.1, December 2017) and Google Play (May 2019) both require disclosure of odds for every item type prior to purchase. These are contractual obligations — violation triggers app removal, not a regulatory fine, making them the highest-immediacy compliance risk for most indie studios. ESRB's "In-Game Purchases (Includes Random Items)" label, mandatory since April 2020, is the equivalent requirement for console and PC distribution.

Asia-Pacific: China, Japan, Korea

The Asia-Pacific region is best understood as a mandatory-disclosure zone: all three major APAC game markets require probability disclosure, with China operating the oldest framework and South Korea the most actively enforced.

China was the first jurisdiction globally to mandate loot box probability disclosure. Effective May 1, 2017, the Ministry of Culture required online game operators to publicly announce the name, properties, content, quantity, and probability of all virtual items obtainable through randomized draws, with results published on official websites or in-game and records maintained for at least 90 days. The disclosure must be "true and effective" — accurate odds are required, not just a disclosure mechanism. Studios launching in China must implement a compliant disclosure system before market entry, with recordkeeping infrastructure to support NPPA audits.

Japan operates a prohibition-plus-self-regulation framework. In May 2012, the Consumer Affairs Agency declared "complete gacha" (kompugacha) — mechanics requiring collection of specific randomized item sets to unlock a prize — an illegal card-matching scheme under the Act against Unjustifiable Premiums and Misleading Representations. The industry self-regulatory body JOGA recommends per-item probability disclosure (not just rarity-tier disclosure) as the standard for compliant gacha mechanics. Standard gacha remains legal in Japan; only the set-collection variant that gates rewards behind completing a randomized series is prohibited.

South Korea passed a mandatory probability disclosure amendment to the Game Industry Promotion Act in February 2023, effective March 22, 2024. The law requires disclosure in-game, in advertisements, and on official websites. The enforcement record in the first year is striking: GRAC monitored 1,255 cases and found 266 violations, with approximately 60% involving foreign-developed titles. Penalties reach ₩20 million (approximately $14,400 USD) in fines or two years imprisonment. Foreign studios are disproportionately represented in violations — a direct consequence of launching without verifying Korean-specific disclosure compliance.

Practical Compliance Framework for Indie Studios

No indie studio can afford to manage a full 30-jurisdiction compliance matrix simultaneously. A four-tier sequential framework reduces the analysis to decisions that matter at launch.

Tier 1 — Platform submission requirements (universal). Before any jurisdictional analysis, confirm platform compliance. Apple App Store (§3.1.1) and Google Play both require odds disclosure for every item type prior to purchase — failure triggers app removal. The ESRB's "In-Game Purchases (Includes Random Items)" interactive element label is mandatory for console and PC games distributed through ESRB-rated channels. These are contractual obligations, not regulations, and breach has the fastest consequence: distribution loss. Complete Tier 1 before submitting to any store.

Tier 2 — Trading functionality gate (Belgium and Netherlands). Does your game allow players to trade items, sell them to other players, or convert them to cash? If yes, that single design decision creates unlawful gambling in Belgium and the Netherlands. Valve disabled item trading for CS:GO players in both countries after the 2018 rulings. For indie studios, the options are geo-fenced disabling of trading functionality for BE and NL users, or designing a closed-item economy from the start. The Belgian penalty structure — criminal imprisonment up to five years — is the highest-stakes compliance decision in your global launch.

Tier 3 — Mandatory probability disclosure. China requires per-item public disclosure with 90-day recordkeeping since 2017. South Korea requires in-game, in-ad, and website disclosure since March 2024 — with 266 violations found in year one, 60% involving foreign developers. The UK's industry framework and Japan's JOGA guidelines both recommend per-item disclosure as the compliance standard. Implement a single accurate disclosure system covering all four markets simultaneously.

Tier 4 — COPPA and child-targeting analysis (US). The FTC's $20 million HoYoverse settlement established the US enforcement model: accurate odds disclosure, real-currency exchange rate transparency, parental consent gates for under-16 users, and direct-purchase availability for all loot box items. If your game targets or is likely to attract users under 13 (or under 16 for loot box sales), implement COPPA-compliant consent flows and accurate pricing transparency before US launch.