Lootbox Compliance for Game Studios: What Regulators in the EU, UK, and US Actually Require

If your indie game includes randomized reward mechanics — loot boxes, gacha pulls, card packs, or any system where players spend real or premium currency for a chance at unknown rewards — you are stepping into one of the most actively evolving regulatory zones in gaming. The rules differ by country, they are changing fast, and the penalties for getting it wrong are real. In this guide, we break down what EU, UK, and US regulators actually require before you ship a game with "surprise mechanics," and what your studio should do to stay compliant.

Why Lootbox Laws Matter for Indie Studios

You might think lootbox regulation only concerns AAA publishers like EA or miHoYo. It does not. Regulators are increasingly targeting game companies of all sizes, and app stores are beginning to enforce requirements that apply regardless of your studio's scale. The Dutch Gambling Authority fined EA €10 million for FIFA Ultimate Team loot boxes in the Netherlands — a penalty upheld by a district court in October 2020 after the court rejected EA's arguments that the packs did not constitute gambling (GamesIndustry.biz, Oct. 2020). In January 2025, the US FTC announced a $20 million settlement with Cognosphere, the distributor of Genshin Impact, over deceptive loot box marketing and children's privacy violations — requiring the company to ban loot box sales to teens under 16 without parental consent, disclose drop probabilities in fiat currency terms, and offer direct fiat-currency purchase options alongside premium currency (FTC Press Release, Jan. 2025).

For indie studios, the risk is not just fines — it is platform delisting, age-rating changes that tank discoverability, and the possibility that your monetization model becomes non-compliant mid-live-service. Understanding the regulatory landscape before you ship is cheaper than retrofitting compliance after launch.

The EU Patchwork: Bans, Ratings, and Consumer Protection

Belgium: Outright Ban (With Limited Enforcement)

Belgium remains the only EU country where all paid loot boxes are prohibited under pre-existing gambling law. The Belgian Gaming Commission concluded in 2018 that loot boxes constitute illegal gambling games. However, enforcement has been inconsistent — the regulator itself has acknowledged difficulty monitoring compliance, and many games continue to offer loot boxes to Belgian players. Still, some companies have complied: Pokémon Unife shut down services in Belgium and the Netherlands rather than modify their loot box systems (GamesIndustry.biz, Dec. 2024).

What this means for your studio: if you plan to sell your game in Belgium, you should either remove paid loot boxes for Belgian players or release a Belgium-specific version without them. Advertising games with loot boxes to Belgian users is also prohibited, so exclude Belgium from your targeted ad campaigns.

The Netherlands: Permitted, But Consumer Protection Rules Apply

After a March 2022 court decision overturned the Dutch Gambling Authority's broader gambling-law-based prohibition, paid loot boxes are technically lawful in the Netherlands. However, the Dutch consumer protection regulator has published guidelines requiring transparency in in-game purchase offers, and in 2024 it fined Epic Games over €1.1 million for consumer protection violations related to Fortnite's in-game purchases (an appeal is pending) (GamesIndustry.biz, Dec. 2024). The current Dutch government confirmed in September 2024 that it does not plan to reinstate a loot box ban (GamesIndustry.biz, Dec. 2024).

Key takeaway: loot boxes are legal in the Netherlands, but you must comply with consumer protection law — including disclosing that your game contains loot boxes in product listings and advertising, and publishing accurate probability disclosures.

Germany: Age Rating Impact

Germany's national age rating organization, the USK, applies a minimum rating of USK 12 (ages 12+) to all games containing loot boxes under updated rules adopted in 2023. This applies even to games whose previous editions received USK 0 (no restrictions). On digital app storefronts like the Google Play Store, the USK automatically assigns USK 12 to any game flagged as containing loot boxes (GamesIndustry.biz, Dec. 2024).

For indie studios, this means a loot box mechanic can push your game from an all-ages rating to a 12+ rating in Germany, potentially reducing your audience. Factor this into your monetization decision early.

The EU-Wide Consumer Protection Framework

Beyond individual national laws, the European Commission has explicitly interpreted EU consumer protection law as requiring two things for games with loot boxes: (1) advertising must clearly indicate that a game contains loot boxes, and (2) loot box probability disclosures must be provided to players (GamesIndustry.biz, Dec. 2024). The Netherlands, Italy, and the UK (under pre-Brexit EU rules) have all sought to enforce these requirements. The forthcoming EU Digital Fairness Act is expected to further regulate loot boxes and in-game currencies, though specific rules have not yet been finalized (GamesIndustry.biz, Dec. 2024).

UK: Industry-Led Protections, Not a Ban

In July 2022, the UK government's Department for Digital, Culture, Media and Sport (DCMS) published its response to a call for evidence on loot boxes, concluding that it would not legislate a ban or amend the Gambling Act at that time. Instead, the government set out three objectives: (1) children and young people should not be able to purchase loot boxes without parental approval, (2) all players should have access to spending controls and transparent information, and (3) better evidence should be developed to inform future policy (GOV.UK, July 2022).

In July 2023, DCMS published an update confirming that the UK games industry trade body Ukie had developed and published industry-led guidance on paid loot boxes. The guidance commits to using technological controls to restrict anyone under 18 from acquiring paid loot boxes without parental consent, improving age assurance, and providing spending controls and transparent information. The government explicitly stated that if industry-led measures do not deliver meaningful improvements, it "will not hesitate to consider legislative change" (GOV.UK, July 2023).

For indie studios targeting the UK market: comply with Ukie's industry guidance even if you are not a Ukie member. Implement parental controls with default £0 spending limits on child accounts, disclose loot box presence and probabilities, and provide accessible spending controls. The UK's Advertising Standards Authority (ASA) also enforces rules requiring that ads for games with loot boxes must not mislead consumers about the odds or nature of the rewards.

US: FTC Scrutiny, State Legislation, and Consumer Protection Law

FTC Enforcement: The Genshin Impact Settlement

The FTC's January 2025 settlement with Cognosphere (Genshin Impact's distributor) is the most significant US enforcement action involving loot boxes to date. The FTC alleged that Cognosphere misrepresented and exaggerated winning probabilities, paid a streamer to post a doctored loot box opening video showing impossible results, and used multiple virtual currency layers to confuse children and obscure the real-world price of loot boxes (FTC Press Release, Jan. 2025).

The settlement requires Cognosphere to: prohibit under-16 loot box purchases without express parental consent (requiring age verification); offer direct fiat-currency purchase options alongside premium currency; disclose accurate probabilities and the range of potential real-world costs for obtaining rare "chase" rewards on the purchase screen; and disclose the number of loot boxes purchasable with each virtual currency bundle (GamesIndustry.biz, Dec. 2025).

The FTC settlement signals that even without dedicated federal lootbox legislation, US consumer protection law — Section 5 of the FTC Act — applies to loot box practices. Misrepresenting odds, obfuscating real prices through currency layers, and targeting minors are all actionable under existing law.

State-Level Legislation

While no US state has enacted a comprehensive lootbox ban, multiple state legislatures have introduced bills targeting loot boxes and randomized reward mechanics. New York's Assembly Bill A9044, introduced in 2025, would prohibit the sale of loot boxes to minors and require probability disclosures (NY Senate, 2025). Similar bills have been introduced in California, Washington, Minnesota, and Hawaii in recent legislative sessions, though most have stalled in committee.

The state-level landscape is fragmented and fast-moving. Indie studios shipping in the US should monitor legislative developments in their key markets and design compliance architectures that can accommodate future state-specific requirements — particularly around age verification and probability disclosure.

The Gambling vs. Disclosure Distinction

In the US, the key legal distinction is whether a loot box system constitutes "gambling" under state law (which typically requires three elements: prize, chance, and consideration) or falls under consumer protection regulation (which requires disclosure and transparency but not a gambling license). Most loot boxes that do not allow players to cash out or transfer rewards for real money do not meet the legal definition of gambling in most US states. However, systems that allow secondary-market trading of rewards — like CS:GO skin trading — are more likely to face gambling-law scrutiny.

This distinction matters for compliance design. If your loot boxes are "closed-loop" (rewards cannot be transferred or cashed out), your primary compliance obligation is disclosure: publish accurate probabilities, do not misrepresent odds, and avoid dark patterns that obscure real-world costs. If your system allows any form of cash-out or transferable rewards, you face a significantly higher regulatory risk profile and should consult counsel before shipping.

Practical Compliance: What Your Studio Should Do Before Shipping

1. Classify Your Reward System Correctly

Before anything else, determine what type of randomized reward system your game uses. Ask: Is the reward purchased with real money or premium currency? Can rewards be traded, sold, or transferred between players? Is the reward earned through gameplay (no payment required) or only through payment? These answers determine which regulatory regime applies. Paid loot boxes with transferable rewards carry the highest regulatory risk. Earned-only reward systems (where players cannot pay real money for random rewards) face the least regulation.

2. Publish Accurate Probability Disclosures

Across all three jurisdictions — EU, UK, and US — probability disclosure is the single most consistent requirement. The European Commission has interpreted EU consumer protection law as requiring it. UK industry guidance calls for it. The FTC's Genshin Impact settlement requires it on the purchase screen without requiring additional player input. Best practice: display drop rates directly on the loot box purchase interface, in plain language, before the player commits to a purchase. Do not bury probabilities in a separate menu or require players to navigate away from the purchase screen.

3. Implement Age-Gating and Parental Controls

The UK requires that children under 18 cannot purchase paid loot boxes without parental consent. The FTC's Genshin Impact settlement prohibits under-16 purchases without express parental consent. Germany's USK automatically rates games with loot boxes at 12+. Australia requires a minimum M rating (15+) for games with paid loot boxes as of September 2024 (GamesIndustry.biz, Dec. 2025). Implement robust age-gating and parental control systems — default spending limits of £0 on child accounts, age verification beyond self-declaration, and clear parental consent flows.

4. Avoid Currency Obfuscation

The FTC specifically flagged the use of multiple virtual currency exchange layers to obscure the real-world monetary cost of loot boxes as a deceptive practice. If your game uses premium currency (gems, coins, crystals), ensure that the real-world price of each loot box is clearly displayed alongside the currency cost. Do not require players to perform mental math to convert between multiple currency tiers. The Genshin Impact settlement requires disclosing the fiat-currency equivalent directly on the purchase screen.

5. Do Not Misrepresent Odds

This should be obvious, but the FTC's enforcement action against Cognosphere included allegations of exaggerating winning probabilities and paying a streamer to post a doctored video showing impossible loot box results. Ensure your published probabilities are accurate, test them regularly, and do not engage in promotional content that implies better odds than your system actually provides.

6. Geo-Restrict Where Necessary

If you cannot reasonably comply with Belgium's ban on paid loot boxes, geo-restrict your game or release a Belgium-specific version without loot boxes. Similarly, monitor regulatory changes in each market you operate in — the landscape is evolving, and what is compliant today may not be tomorrow.

Actionable Next Steps

If your studio is planning to ship a game with randomized reward mechanics, here is what we recommend doing before launch:

• Audit your reward system: Classify it as paid vs. earned, transferable vs. closed-loop, and premium-currency vs. direct-fiat. This determines your regulatory exposure.
• Map your target markets: Identify every country you plan to launch in and document the specific requirements for each. Belgium, Germany, the Netherlands, the UK, the US, and Australia all have distinct rules.
• Implement probability disclosures: Build drop-rate transparency directly into your purchase UI. Do not rely on external websites or FAQ pages.
• Design age-gating and parental controls: Default child accounts to £0 spending limits. Implement age verification beyond self-declaration where feasible.
• Review your currency system: If you use premium currency, ensure real-world prices are clearly visible at the point of purchase. Avoid multi-layer currency conversion that obscures costs.
• Consult counsel before shipping: Lootbox regulation is jurisdiction-specific and evolving. A compliance review before launch is far less expensive than a regulatory action after launch.

If your studio is building a monetization model around randomized rewards, we can help you navigate the compliance landscape across jurisdictions. Just as we help studios evaluate game engine licensing risk and protect their IP from day one, we can help you structure a loot box system that survives regulatory scrutiny — before you ship, not after you receive a letter from a regulator. For a broader overview of legal considerations for your studio, see our indie game studio legal guide.