Loot Box Laws by Jurisdiction: What Game Studios Must Know in 2025

Belgium criminalizes paid loot boxes with criminal fines up to €800,000 and prison sentences for non-compliant developers. The Netherlands reversed its own €10 million fine against EA after a court found the mechanic integrated into gameplay was not a standalone gambling product. The United States has never enacted a single loot box statute at any level of government. Any game studio with a live-service title that accepts real-money purchases for randomized rewards is simultaneously navigating these three outcomes — along with mandatory odds disclosure regimes in China and South Korea, a binding PEGI age-rating change taking effect in June 2026, and FTC dark-pattern enforcement risk that requires no gambling statute at all. This guide maps each jurisdiction's current requirements and enforcement posture so studios can design their monetization systems against the law that actually applies, not the one that is easiest to assume.

What Counts as a "Loot Box" Under the Law

Before a game studio can assess its regulatory exposure, it needs to answer one question: does the mechanic it ships legally constitute gambling? Gambling regulation across every major jurisdiction applies the same three-element test: there must be consideration (a real-money payment), chance (a random outcome), and a prize (an item with legally cognizable value). Remove any one element and, in most legal systems, the activity falls outside gambling law entirely. As the National Law Review has summarized, "if any one of the three elements is not present then the activity is not considered gambling."

For loot boxes, consideration and chance are almost never in dispute. Players pay real money for a random draw — that much is settled. The fight is over the prize element, and specifically whether virtual items — character skins, weapon camos, card packs — constitute a legally cognizable "prize" when they have no direct cash-out pathway. That question has produced sharply different answers depending on jurisdiction, and the divergence is not closing.

The Secondary-Market Tipping Point

Most studios design their loot box economies around cosmetic-only items that cannot be traded, sold, or redeemed for real currency within the game ecosystem. Under the dominant legal view, that design choice keeps the mechanic outside gambling regulation — virtual items isolated from real-world monetary value do not satisfy the prize element. Legal analysis from Pillar Legal PC frames this as an "Embedded-Isolated" structure: items exist inside the game and cannot leave, so there is no realizable monetary prize.

The analysis changes the moment a liquid secondary market forms. Once players can convert virtual items into real money — through a developer-sanctioned marketplace, a third-party trading platform, or a robust peer-to-peer resale ecosystem — regulators and courts across multiple jurisdictions have treated those items as a "prize" under gambling law, even where the developer never explicitly enabled cash-out. The same Pillar Legal analysis identifies this as the "Embedded-Embedded" structure: items move from in-game to real-world exchange value, triggering the full gambling-law analysis in most countries.

CS:GO skins are the canonical example. Valve built an in-game cosmetic system and a Steam Marketplace that allowed skin trading. Third-party skin gambling sites emerged that used those skins as betting chips — accepting deposits, operating roulette wheels and jackpot games, and paying out in skins convertible back to real money. Research published in Qualitative Criminology traces how regulators shifted focus once those secondary markets reached critical mass, treating skins as gambling currency regardless of their cosmetic-only design intent. The studio's architecture had not changed; the economic reality around it had.

Why Jurisdiction Still Controls the Answer

Even where all three elements are clearly present, jurisdictions differ substantially on what follows. The American Bar Association's survey of loot box law notes that in the US, "few if any laws specifically address gambling based on virtual items," while many EU member states have released position papers that reach divergent conclusions on whether virtual items constitute a cognizable prize at all. The ABA's analysis documents the resulting patchwork: Belgium imposed criminal-level fines of up to €800,000 and saw EA, Blizzard, and Valve withdraw operations; the Netherlands reversed course on appeal under a game-integration test; the UK treats most loot boxes as lawful under the Gambling Act 2005; and China has required mandatory odds disclosure since May 2017 under regulation 文市发〔2016〕32号.

This divergence means a single global compliance posture cannot exist. A studio that designs to Belgium's standard — removing paid random mechanics with tradeable rewards — will satisfy most other jurisdictions as a side effect. A studio that designs only for the US regulatory environment, where no federal loot box law exists and the practical risk runs through FTC Section 5 dark-pattern enforcement, may find itself in direct violation of Belgian, Dutch, or Korean law the moment it accepts payments from players in those markets.

The sections that follow map the specific legal requirements and enforcement postures across Belgium, the Netherlands, the broader EU, the UK, the United States, China, and Korea — and close with a practical platform-by-platform compliance checklist. For studios building technology-facing legal strategies, understanding where each jurisdiction draws the line is the prerequisite to any monetization decision involving randomized purchases.

Belgium and the Netherlands: The Strictest Regulators

No two European jurisdictions illustrate the range of possible regulatory outcomes better than Belgium and the Netherlands. Both countries confronted the same industry at roughly the same time. Belgium concluded that paid loot boxes with tradeable items are illegal gambling and has spent seven years enforcing that position with escalating consequences. The Netherlands imposed a €10 million fine on EA, then watched its own highest court overturn it three years later. A studio publishing to either market must understand both outcomes — and why compliance in one does not guarantee compliance in the other.

Belgium: Criminal Exposure, Active Enforcement

In April 2018, the Belgian Gaming Commission ruled that paid loot boxes containing tradeable virtual items constitute illegal gambling under the Belgian Gambling Act of 7 May 1999. The consequences for non-compliant operators are not administrative — they are criminal. Under Belgian law, studios and their responsible parties face fines of up to €800,000 and prison sentences of up to five years for operating unlicensed gambling products.

The industry's response to that ruling was unambiguous. Electronic Arts disabled FIFA Ultimate Team loot boxes for Belgian players. Blizzard and Valve adjusted their games to remove paid random mechanics accessible to Belgian users. The compliance actions by major publishers demonstrated that the Belgian Gaming Commission's enforcement posture was credible — and that geo-blocking or mechanic redesign, not legal challenge, was the practical response.

Seven years later, Belgian enforcement is still active and its scope has expanded. In LS v. Apple, decided January 16, 2025 by the Antwerp Enterprise Court (18th Chamber), the court classified paid loot boxes in Top War: Battle Game as illegal games of chance under the Belgian Gambling Act. The court applied all four statutory elements: game component, wagers, chance of winning or losing, and randomness — all satisfied. More significantly, the court found that Apple facilitated access to unlawful gambling by hosting the game on the App Store. Distribution platform liability — not just developer liability — is now a live theory in Belgian law.

The practical compliance requirement for Belgium is binary: if your loot box mechanic involves real money, randomized outcomes, and items that have real-world monetary value (including through any secondary market), you cannot operate that mechanic for Belgian players without a Belgian gambling license. The realistic path for most studios is to geo-block the mechanic for Belgian IP addresses or redesign the economy to eliminate tradeability or secondary-market exposure.

The Netherlands: Game Integration as the Controlling Test

The Netherlands took an aggressive initial position. The Dutch gambling authority (Kansspelautoriteit, or KSA) fined EA €10 million in 2019 for FIFA Ultimate Team packs, applying a broad reading of the Dutch Betting and Gaming Act that treated randomized paid purchases as standalone games of chance requiring a gambling license.

EA challenged the fine, and on March 10, 2022, the Administrative Jurisdiction Division of the Dutch Council of State reversed it. The court's reasoning established what practitioners now call the game-integration test: "The fact that the packs are opened separately from the match or in-game task does not make it a separate game." The court concluded that loot boxes integrated into a broader game mode do not qualify as standalone games of chance requiring a Dutch gambling license. EA had not violated the Betting and Gaming Act.

The EA ruling narrowed Dutch enforcement exposure substantially for most developers. A loot box mechanic embedded within a larger game — where the randomized purchase serves the game's progression or play mechanics rather than operating as an independent wagering product — is likely lawful under current Dutch law. The KSA subsequently pivoted its enforcement focus away from game publishers and toward skin gambling sites and secondary-market operators, where the "standalone game of chance" argument is more straightforward.

Two risks remain for studios targeting Dutch players. First, the game-integration test is a legal judgment call, not a bright line — a mechanic designed primarily around purchasing random items rather than playing the game could still fail the integration analysis. Second, Clifford Chance reported in 2022 that the Dutch government was separately considering legislative amendments that would regulate loot boxes regardless of game-integration status, closing the loophole the EA ruling relied on. Any studio with material Dutch revenue should monitor that legislative track.

What Both Countries Require of You Now

Belgium and the Netherlands have reached different legal conclusions from the same starting point, but they impose complementary compliance demands on any studio operating in both markets. For Belgium: geo-block paid random mechanics with tradeable rewards, or obtain a Belgian gambling license and operate as a licensed gambling product — a path most game studios will not take. For the Netherlands: document the game-integration rationale for your loot box design, avoid mechanics that operate as standalone wagering products, and do not enable secondary-market trading that would reintroduce the prize-element question the KSA has not definitively resolved.

EU-Wide Considerations: VLOP Rules, PEGI, and Member State Variation

Belgium and the Netherlands represent endpoints on the EU regulatory spectrum — the strictest and the most recently liberalized — but studios distributing across Europe face obligations that exist above and below the member-state level. There is no single EU-wide gambling classification for loot boxes. What does exist is a three-layer compliance structure: member-state gambling law (which varies), PEGI rating and labeling obligations (which are harmonized across member countries), and platform-level obligations under the Digital Services Act that apply regardless of gambling classification.

Layer 1: Member-State Gambling Law

Absent EU harmonization, each member state applies its own gambling statute to loot box mechanics. Belgium's hard prohibition and the Dutch game-integration test represent two positions. France's ARJEL (now ANJ) has concluded that loot boxes are not subject to games-of-chance rules unless their contents can be traded for real money — making most French loot box economies lawful under general consumer protection rules provided no secondary market exists. Spain has proposed draft legislation that would redefine loot boxes as gambling and prohibit their sale to anyone under 18, though as of 2025 that bill has not been enacted.

Germany occupies a middle position: not a hard prohibition, but regulators have required probability disclosure notices and gambling-harm warnings on applicable games, with enforcement through existing consumer protection and youth protection frameworks. The practical variation across member states is wide enough that a studio cannot design to "EU compliance" as a single standard. The safest design approach is to build to Belgium's requirements — eliminate paid random mechanics with tradeable reward items — and treat any market with a more permissive standard as additional room within the design space, not as a reason to relax the architecture.

Layer 2: PEGI Labeling and the 2026 Rating Floor

PEGI rating obligations are the most concrete and immediate EU-level compliance requirement for studios seeking European distribution. Since April 13, 2020, any game containing paid random items must carry the PEGI "Includes Paid Random Items" notice on physical packaging and digital storefronts across all PEGI member countries. PEGI defines the notice as applying to "in-game offers to purchase digital goods or premiums where players don't know exactly what they are getting prior to the purchase (e.g. loot boxes, card packs, prize wheels)." This is not optional — submitting a game for a PEGI rating without the notice when the mechanic is present means the rating will not be issued.

A second, more consequential change takes effect in June 2026. Under PEGI's new interactive risk categories, any game containing paid random items — loot boxes, card packs, gacha systems, prize wheels — will receive a minimum PEGI 16 rating, regardless of the game's content rating under PEGI's traditional categories. A game with cartoon violence that would otherwise receive a PEGI 7 will be rated PEGI 16 if it includes a paid loot box mechanic. This change applies to all titles newly submitted from June 2026 onward.

The operational implications are significant. A PEGI 16 floor affects storefront placement, parental control defaults, and retailer stocking decisions. Studios planning titles for younger audiences with loot box monetization features face a direct conflict between their target demographic and their compliance posture starting in June 2026. Product roadmaps that extend beyond that date need to account for this constraint now — redesigning a monetization system close to launch is substantially more expensive than designing around it from the start.

Layer 3: DSA Obligations and the Pending Digital Fairness Act

The Digital Services Act (DSA) creates a third compliance layer that operates independently of gambling classification. Under the DSA, providers of online platforms accessible to minors are prohibited from exposing those minors to practices that can lead to excessive or compulsive spending — and the European Parliament has interpreted this obligation to cover paid loot boxes with random or unpredictable content. For studios distributing through platforms that meet the Very Large Online Platform (VLOP) threshold — currently defined as 45 million or more monthly active users in the EU — this means their distribution partners have binding obligations regarding how loot boxes are presented and marketed to minor users.

The DSA does not directly prohibit loot boxes in games, but it does prohibit VLOPs from targeting loot box advertising at minors and requires platform-level controls on minor access to applicable mechanics. A studio relying on a VLOP for EU distribution should understand whether the platform's compliance posture covers its loot box mechanic — or whether the studio bears secondary exposure through the distribution relationship.

Looking further forward, in October 2025 the European Parliament's Internal Market and Consumer Protection Committee adopted a report calling on the European Commission to ensure that the upcoming Digital Fairness Act bans loot boxes, in-app currencies, pay-to-progress mechanics, and other randomized real-money content in games likely to be accessed by minors. The Digital Fairness Act is not yet enacted, but the parliamentary signal is the clearest indicator yet that binding EU-wide loot box regulation is coming. Studios building five-year monetization strategies should treat EU harmonization as a planning assumption, not a speculative risk.

UK: Not Gambling (Yet), But Under Active Review

The UK's position on loot boxes is clear as a matter of current law: paid loot boxes are not gambling under the Gambling Act 2005. That position is well-established, officially confirmed, and the product of a deliberate government choice made in 2022 not to extend the Act's coverage to virtual items. What makes the UK a notable compliance risk is the condition attached to that choice — the government explicitly reserved the right to legislate if voluntary industry measures prove ineffective — and the evidence that those measures are failing.

Why UK Loot Boxes Fall Outside the Gambling Act

The Gambling Act 2005 requires that a gambling prize be "money or money's worth." The UK Gambling Commission's position, documented in the House of Commons Library research briefing (CBP-8498, updated August 2024), is that virtual items won through loot boxes cannot be cashed out for real-world money and therefore do not satisfy the prize element. No prize, no gambling regulation. This analysis holds so long as the virtual items remain isolated from real-world monetary value — the same secondary-market analysis that determines exposure across most jurisdictions applies here as well. A game that enables a liquid secondary market for its loot box rewards could shift the analysis even under current UK law.

In July 2022, the Department for Digital, Culture, Media and Sport (DCMS) announced the government's decision: no amendment to the Gambling Act 2005, but an industry-led approach to player protection. Lewis Silkin's analysis confirms that DCMS convened a working group of games industry representatives to develop voluntary standards. The government did not abandon the issue — it handed responsibility to the industry with an implicit warning that legislation would follow if the voluntary framework did not deliver results.

The Ukie Principles: What Voluntary Compliance Looks Like

In July 2023, UK Interactive Entertainment (Ukie) published 11 industry principles on loot boxes. The core obligations include:

• Technological controls that restrict anyone under 18 from purchasing loot boxes without explicit parental consent
• Disclosure of loot box presence before a game is purchased
• Clear probability disclosures for all randomized purchase mechanics
• Spend tracking and limit tools accessible to players

These are not legal requirements — they are industry commitments published by Ukie and endorsed by DCMS as the standard the government expects to see followed. Studios distributing games in the UK are not legally required to implement the Ukie principles, but failure to do so places them outside the framework that the government cited as its reason for not legislating. If enforcement of the voluntary standard is the condition for not creating a statutory one, non-compliant studios are accelerating the legislative outcome they want to avoid.

The 2025 Compliance Research — and What It Signals

The condition for UK legislation is documented noncompliance with the voluntary framework. In 2025, research published in Royal Society Open Science (co-authored with the 5Rights Foundation) found that compliance with the Ukie self-regulation on the Apple App Store was effectively nonexistent. The longitudinal study found essentially no enforcement of the standards across sampled games — no parental consent controls, no probability disclosures, no spend tracking tools — despite the 2023 publication of the principles.

This finding matters because the government's own articulation of its 2022 decision included an explicit reservation of legislative power. The 2025 research provides exactly the kind of documented, peer-reviewed evidence of systematic non-compliance that parliamentary committees cite when recommending legislation. UK studios that have not implemented Ukie-aligned controls are not just non-compliant with an industry standard — they are contributing to the evidentiary record that will be used to argue for mandatory legislation.

The practical advice for UK market studios is to implement the Ukie principles now, before the regulatory environment forces the issue. The PEGI labeling obligation (the "Includes Paid Random Items" notice under the current framework, and the PEGI 16 floor from June 2026) is already mandatory regardless of gambling classification. Age-gating and probability disclosure are directionally consistent with where every major jurisdiction — Belgium, Korea, China, the console platforms — has landed. The studios building those controls into their games now will face no incremental compliance cost if UK legislation arrives; the studios that have not built them will face a retroactive redesign of their monetization infrastructure.

United States: FTC Posture, State Bills, and No Federal Law

The United States has the least developed loot box regulatory landscape of any major gaming market. There is no federal loot box law. No state has enacted one. Every bill introduced in Congress or state legislature targeting loot boxes has died without passage. A studio publishing to US players faces no statutory loot box compliance obligation — but that does not mean the US market is without legal risk. The real exposure is narrower and more operational than gambling classification, and it runs through the Federal Trade Commission.

The Federal Legislative Record

The most prominent federal effort was the Protecting Children from Abusive Games Act, introduced in 2019 by Senator Josh Hawley. The bill would have prohibited loot boxes in any game playable by minors. It did not pass. As the National Law Review confirms, the United States does not have any federal law or legal framework that specifically addresses loot boxes as of 2025. The bill represented peak legislative momentum on the issue and produced nothing.

State-level attempts fared no better. Hawaii introduced HB 2686 and SB 3024 in 2018, which would have prohibited loot box sales to consumers under 21. Both failed to meet final deadlines. Minnesota introduced a bill restricting loot box sales to under-18s and requiring labeling. Washington and California introduced similar proposals. All failed. As of 2025, no US state has an enacted loot box statute. Studios can confirm this background, but should not mistake the absence of law for the absence of risk.

The FTC: Where the Real Exposure Lives

The Federal Trade Commission held a public workshop on loot boxes on August 7, 2019, and published a staff perspective paper in August 2020. The FTC staff paper documented consumer protection concerns raised at the workshop — particularly regarding children, confusing purchase flows, and the use of in-game currency as a mechanism for obscuring real-money costs. The paper did not recommend formal rulemaking. What it did was identify the analytical frame the FTC would use if it chose to act: not gambling law, but unfair or deceptive trade practices.

The FTC's authority under Section 5 of the FTC Act prohibits "unfair or deceptive acts or practices" in commerce. Fenwick's post-workshop analysis identifies the specific purchase flow patterns the FTC would scrutinize: in-game currency layers that obscure the real dollar cost of a purchase; pre-checked quantity selectors that push players toward larger purchases; misleading "deal" framing that creates a false sense of value; and the absence of meaningful odds or expected-value disclosure. None of these require a gambling statute to prosecute — they fall squarely within the FTC's existing enforcement authority over deceptive commercial practices.

For US studios, the practical compliance question is not "is this gambling?" — the answer is almost certainly no under current US law. The question is: "does our purchase flow accurately disclose what players are buying, what it costs in real dollars, and what probability they have of receiving each category of item?" A purchase flow that passes that test has minimal FTC exposure. A purchase flow with layered currency obfuscation, suppressed odds, and dark-pattern upsells has real Section 5 risk regardless of what Congress has or has not done.

Platform Obligations Fill the Regulatory Gap

The absence of US law does not mean US-market studios face no loot box compliance obligations. Platform policies have created a de facto regulatory floor that applies to every studio distributing through major channels. The ESA announced in August 2019 that Microsoft, Nintendo, and Sony would require disclosure of loot box odds for new games and existing games adding new loot box features by end of 2020. Apple's App Store Review Guidelines (section 3.1.1) require pre-purchase odds disclosure as a condition of App Store approval. Google Play's developer program policies include an identical requirement.

The one notable exception is Steam. Research published in 2024 confirmed that Valve has not implemented a binding system-wide odds disclosure requirement equivalent to the console platforms or mobile storefronts. Studios relying solely on Steam for PC distribution face a gap between their platform's requirements and the disclosure standards that every other major channel enforces. That gap is also where the FTC's "deceptive practice" framing would have the most traction — Steam players are not receiving the pre-purchase probability information that iOS, Android, Xbox, PlayStation, and Nintendo Switch players are entitled to under platform policy.

The ESRB's "In-Game Purchases (Includes Random Items)" label applies to all games with randomized paid mechanics on US platforms. Applying the label is required for ESRB-rated titles. Together with platform odds disclosure requirements, it establishes a minimum US compliance floor that exists in the absence of any statutory requirement: disclose the mechanic's existence at point of sale, and disclose the odds before the player commits real money.

China: Mandatory Probability Disclosure

China established the global standard for mandatory loot box odds disclosure in 2017 — earlier than any other jurisdiction — and the operational requirements it set remain among the most detailed and specific of any regulatory regime worldwide. Studios targeting the Chinese market must build a dedicated disclosure infrastructure before launch. But the significance of China's framework extends beyond China: compliance with its requirements provides a substantial head start on South Korea's 2024 implementation, and the design patterns it demands are increasingly treated as baseline hygiene by regulators across all major markets.

The Operative Regulation: 文市发〔2016〕32号

China's Ministry of Culture issued its loot box regulation in December 2016 (reference number 文市发〔2016〕32号), with requirements taking effect May 1, 2017. The full title is "Notice of the Ministry of Culture on Regulating the Operation of Online Games and Strengthening Concurrent and Ex-Post Supervisions." As Game Developer reported at the time of implementation, the regulation requires publishers to:

• Publicly disclose the name, property, content, quantity, and draw probability of every virtual item obtainable through a randomized purchase mechanic
• Publish this information on the game's official website or a dedicated probability disclosure page
• Publicly announce actual draw results — showing what players across the user base have received — on a prominent location, while protecting individual user privacy
• Maintain records of random draw results for at least 90 days for government review

The disclosure obligation is not limited to aggregate statistics or approximations. Chinese regulators expect per-item probability figures, not rounded ranges, and the 90-day records requirement means studios must maintain a detailed transaction log sufficient to demonstrate that actual drop rates match the published probabilities. This is an operationally significant infrastructure requirement, not a labeling exercise.

Non-compliance carries regulatory consequences ranging from warnings and content removal to suspension of game distribution rights in China. For studios that have invested in Chinese market entry — given the scale of the Chinese gaming market — these are not abstract risks. The regulation has been actively applied since 2017, and Chinese regulators have demonstrated a willingness to enforce against international publishers operating in the market.

South Korea: Article 33 and the 2024 Implementation

South Korea followed China's framework with its own mandatory disclosure requirement, implemented through an amendment to the Game Industry Promotion Act. The National Assembly amended Article 33 of that Act on March 21, 2023, with requirements taking effect March 22, 2024. Kim & Chang's analysis of the amendment establishes that video game companies must disclose loot box probabilities in the games themselves, in advertisements, and on official websites. The fine for violations is up to KRW 20 million (approximately USD 15,000) per violation, and enforcement began in the first period after the March 2024 effective date, with 266 violation findings documented.

Korea's framework is operationally similar to China's but narrower in its recordkeeping requirements. The mandatory disclosure locations — in-game, in advertising, and on official websites — are more expansive in one respect: advertising disclosure means that any marketing material showing or describing a loot box mechanic must include probability information, not just the in-game purchase flow.

Japan: The Kompu Gacha Prohibition

Japan's regulatory approach to randomized purchase mechanics is more targeted than China's or Korea's. The only hard legal prohibition in Japan's gacha ecosystem applies to "complete gacha" (kompu gacha) mechanics — systems where players must collect a complete set of randomly obtained items in order to unlock a bonus rare item. Legal analysis from Monolith Law Office Tokyo explains that the Japanese government effectively banned complete gacha in 2012, treating the set-completion mechanic as a form of prize display violation under existing law.

All other gacha mechanics remain lawful under Japanese law, subject to CESA (Computer Entertainment Supplier's Association) and JASGA industry self-regulation that requires probability disclosure and prohibits specific exploitative patterns. Japan does not impose China-style mandatory governmental disclosure. Studios must avoid complete gacha structures entirely and follow CESA voluntary norms, but the compliance threshold is substantially lower than in China or Korea.

Building China-Compliant Infrastructure That Scales

A studio that builds probability disclosure infrastructure for China — per-item probability tables, public disclosure pages, 90-day transaction logs — arrives at Korean compliance having done roughly 80% of the work. The Chinese framework's operational requirements are the more demanding set, and Korean compliance is primarily additive (advertising disclosure) rather than architecturally different. Studios entering either market without this infrastructure face a harder path: the disclosure system has to be built before launch in China and before accepting Korean payments after March 2024, and retrofitting it to an existing live game is more expensive than designing it in from the start.

The Japan complete-gacha prohibition is a design constraint rather than an infrastructure requirement. Map your mechanic against the complete-gacha definition — a system where random item acquisition leads to a set-completion bonus — and confirm your design avoids it. Most standard loot box and gacha mechanics do not trigger it, but combination or collection systems with secret set-completion rewards require explicit legal review before shipping to Japanese players.

Platform Rules and Practical Compliance Guidance

Every major distribution platform — App Store, Google Play, Xbox, PlayStation, Nintendo eShop — now requires odds disclosure as a condition of listing a game with loot box mechanics. This is not a regulatory requirement; it is a platform contract requirement. A game without pre-purchase probability disclosure will not be approved for iOS distribution, will not pass Google Play review, and will not ship on any major console. Platform policy has effectively created a global odds disclosure floor that exists independently of whether any particular jurisdiction has enacted a loot box statute.

Platform-by-Platform Requirements

Apple App Store: Section 3.1.1 of the App Store Review Guidelines requires that apps offering loot boxes or other randomized virtual item purchases must disclose the odds of receiving each type of item prior to purchase. This requirement is a hard rejection condition — a game without compliant probability disclosure will not be approved for App Store distribution. The disclosure must appear before the player commits to the purchase, not after.

Google Play: Google Play's developer program policies include an identical requirement: apps containing loot boxes "must clearly disclose the odds of receiving those items in advance of purchase." The Google Play policy applies both to the Google Play Families policy (games accessible to children) and the broader developer program. Non-compliant apps may be rejected at review or removed post-publication.

Xbox, PlayStation, Nintendo: In August 2019, the ESA announced that Microsoft, Nintendo, and Sony would all require odds disclosure for new games and game updates adding loot box features, effective by end of 2020. The console platform commitments cover the same mechanics as the mobile platform requirements: randomized paid purchases must disclose the probability of each item category before the player pays.

Steam: Valve is the significant outlier. Research published in 2024 in a peer-reviewed journal confirmed that Valve has not implemented a binding system-wide odds disclosure requirement equivalent to the other major platforms. Games with transferable loot boxes on Steam frequently fail to display even the PEGI "Includes Paid Random Items" label. Steam's developer-facing policies do not include an odds disclosure requirement with enforcement mechanisms comparable to those Apple or Google have implemented. A studio that ships a loot box mechanic on Steam without voluntary odds disclosure is operating below the standards of every other major platform — and at higher FTC Section 5 exposure, since Steam players are not receiving the pre-purchase probability information their console and mobile counterparts receive as a condition of platform access.

ESRB Labeling

For North American distribution, the ESRB's "In-Game Purchases (Includes Random Items)" descriptor applies to all games containing loot boxes or other randomized paid mechanics. Applying the descriptor is required for ESRB-rated titles and must appear on physical packaging and digital product pages. The ESRB descriptor is the US market's equivalent of the PEGI "Includes Paid Random Items" notice — both inform buyers at point of sale that the game contains a randomized purchase mechanic before they commit to the purchase price.

Pre-Launch Compliance Checklist

The following checklist synthesizes the mandatory requirements across all jurisdictions and platforms covered in this guide. Each item corresponds to a specific legal or platform-policy obligation confirmed in the research above. A studio that clears every item on this list before launch has addressed the primary compliance exposure in every major market where it is likely to publish.

1. Build a per-item probability disclosure system. Every item obtainable through a randomized purchase must have a documented probability. This is required by China (文市发〔2016〕32号), Korea (Article 33, Game Industry Promotion Act, effective March 2024), Apple App Store, Google Play, and Xbox/PlayStation/Nintendo platform policies.
2. Conduct Belgium feasibility analysis. If your loot box mechanic involves paid random draws with items that have any secondary-market monetary value, determine whether to geo-block Belgian IP addresses or redesign the mechanic. Operating a non-compliant paid loot box accessible to Belgian users carries criminal exposure up to €800,000 and five years imprisonment. The 2025 LS v. Apple ruling confirms that distribution platform liability is live as well.
3. Implement secondary-market lockout for EU distribution. Items that can be traded for real money on any secondary market trigger gambling analysis in Belgium, the Netherlands (under the pre-2022 KSA theory), and any jurisdiction that uses a "money or money's worth" prize test. If you intend to permit secondary-market trading, get jurisdiction-by-jurisdiction gambling law analysis before enabling it.
4. Age-gate loot box purchases. For UK market compliance with the Ukie principles, parental consent is required for under-18 purchases. Spain's pending legislation would require age verification for all under-18 players. Belgium's enforcement already covers minor access to gambling-equivalent mechanics. Build the gate now.
5. Apply PEGI "Includes Paid Random Items" label. Mandatory since April 2020 for all PEGI-rated games containing loot boxes. From June 2026, your game will receive a minimum PEGI 16 rating regardless of content if it contains paid random items — account for this in product and marketing planning for any title submitting after that date.
6. Apply ESRB "In-Game Purchases (Includes Random Items)" descriptor. Required for ESRB-rated titles distributed in North America.
7. Publish China and Korea probability disclosures before launch. China requires a public probability page and 90-day transaction log maintenance. Korea requires disclosure in the game, in advertising, and on the official website. Both must be in place before the first paying user in those markets.
8. Audit your purchase flow for FTC dark-pattern risk. Review in-game currency conversion layers, pre-checked quantity selectors, "deal" framing that obscures real costs, and the absence of spend tracking or limit tools. FTC Section 5 exposure is the primary US enforcement mechanism, and it applies to the purchase experience regardless of whether any loot box statute ever passes.

Platform policy and regulatory law are converging on the same set of requirements: disclose what's in the box and what it costs, verify the age of the player buying it, and don't design the purchase flow to obscure what's happening financially. Studios that build to that standard from the start spend no incremental effort on compliance. Studios that treat monetization design and legal review as separate conversations typically find them intersecting at the worst possible time — during crunch, close to a ship date, with a geo-block of a material market as the only fast option.

Promise Legal helps game studios map their loot box mechanics to the legal regimes where they publish. Contact us to review your monetization structure.