Lootbox Laws by Jurisdiction: What Indie Studios Must Know Before Launch

Every lootbox mechanic works on the same model: a player spends money, a randomized draw determines what they receive. Different countries see that mechanic and reach opposite conclusions. In Belgium, it is criminal gambling. In the United Kingdom, it is not regulated as gambling at all. In the United States, no federal law exists, but a $20 million FTC settlement in January 2025 established what studios must do anyway. The Netherlands has fined publishers and then reversed itself. The EU is drafting legislation that could change the rules across an entire continent.

This guide maps the legal status of lootboxes in Belgium, the Netherlands, the UK, the United States, and the broader EU, and translates each jurisdiction into concrete pre-launch requirements. A seven-step compliance checklist closes the article. Studios shipping lootboxes or gacha mechanics into any of these markets face live enforcement risk.

The Regulatory Map: Three Approaches to the Same Mechanic

Regulators around the world see that same mechanic and reach opposite conclusions. Whether your implementation constitutes illegal gambling depends almost entirely on one question, and that question varies by jurisdiction.

Gambling law across most jurisdictions requires three elements to be present simultaneously: a player stakes something of value (consideration), the outcome is randomized (chance), and the player wins something of value (a prize). The first two elements are nearly always satisfied by a paid lootbox. The third is where jurisdictions diverge. The National Law Review's primer on lootbox legality identifies the prize element as the crux: whether items won constitute "money or money's worth" is the question that drives divergent regulatory outcomes worldwide.

Specifically, the dividing line is transferability. Most regulators focus on whether items won can be converted to real-world monetary value, whether sold on a secondary market, traded externally, or cashed out directly. Esports Legal News summarizes the standard across the US, UK, and EU: transferability outside the game is the primary factor separating jurisdictions that ban or restrict lootboxes from those that permit them.

That single test produces three distinct regulatory regimes. Belgium declared lootboxes illegal gambling outright. France treats them as lawful unless items are tradeable for real currency. The UK excludes them from gambling law entirely because rewards cannot be cashed out. The US has no dedicated lootbox statute at all. Same mechanic, four different answers.

For any studio launching in more than one market, the only defensible starting point is a jurisdiction-by-jurisdiction analysis. The sections that follow map each major market: what the rule is, what enforcement looks like, and what your game needs to do differently in each one. Indie studios navigating these overlapping legal frameworks often benefit from specialized tech law counsel before a global launch.

Belgium: The Outright Ban

Belgium is the strictest jurisdiction covered in this guide. In April 2018, the Belgian Gaming Commission investigated four major titles — Star Wars Battlefront 2, FIFA 18, Overwatch, and Counter-Strike: Global Offensive — and concluded that paid lootboxes violate the 2009 Belgian Gaming and Betting Act. The Commission's analysis applied a three-element test drawn from Belgian gambling law: a game of chance requires (1) a stake, (2) a chance-based outcome, and (3) a prize. Paid lootboxes met all three. Belgium did not create a new category — it applied existing gambling law and found lootboxes already inside it.

The compliance response from most major studios was immediate. Blizzard, Valve, and 2K Games removed lootbox mechanics for Belgian users shortly after the ruling. EA took a different position initially, publicly disagreeing with the Commission's legal interpretation. That resistance resulted in a criminal investigation. By January 31, 2019, EA had removed FIFA Points — the real-money purchase mechanism — from its FIFA titles in Belgium. The workaround EA landed on: players in Belgium can still open Ultimate Team packs, but only using in-game currency earned through gameplay, not purchased with real money. Removing the stake removes the gambling element.

For an indie studio, the EA timeline is instructive in two directions. First, enforcement is real. The world's largest sports game publisher faced a criminal investigation, not a regulatory warning letter. Second, there is a compliant path short of disabling the mechanic entirely: strip out the real-money purchase and let players access lootboxes only through earned currency. Whether that tradeoff makes business sense for a smaller studio depends on how central real-money lootbox revenue is to your model. If Belgium is a meaningful part of your market, you have two options under Belgian law: geo-block the mechanic for Belgian users, or restructure it so no real money is required to open a pack.

Research from 2023 found that roughly 82% of top games with lootboxes remain accessible to Belgian players, suggesting the Gaming Commission cannot enforce against every title. That enforcement gap does not create a legal safe harbor. Studios that are identified, particularly those with Belgian user bases generating measurable revenue, face the full criminal penalty structure. The Commission has demonstrated it acts when it has evidence. Counting on obscurity is not a compliance strategy.

If Belgium is in scope for your launch, the threshold question is whether your lootboxes require real money. If yes, you need either a geo-block or an earned-currency-only alternative before you go live. The compliance framework matters here too: Belgian user data processed in connection with unlawful gambling activity compounds your exposure. Sort out the monetization mechanic first; the compliance infrastructure follows from that decision.

Netherlands: Enforcement in Flux

The Dutch story on lootboxes runs through a single case that took four years to resolve, and the resolution did not deliver a clean answer. In 2018, the Dutch Gaming Authority (Kansspelautoriteit, or KSA) investigated ten video games and found that four violated Dutch gambling law. EA's FIFA Ultimate Team packs were among them. The KSA threatened a fine of up to €10 million, a number that got the industry's attention.

The lower court agreed with the KSA. Its reasoning turned on a specific design feature: FIFA player cards obtained from packs could be transferred to other players through the game's internal market. That internal tradability, the court held, satisfied the "prize" element of the Dutch gambling definition. The game did not need to allow cash-out to real currency. The ability to trade items inside the game was enough.

The Administrative Jurisdiction Division of the Council of State, the Netherlands' highest administrative court, reversed that result in March 2022. The appellate court asked a different question: not whether the lootbox mechanic involves chance, but whether the overall game constitutes a game of chance. Because FIFA is predominantly a game of skill, with match outcomes controlled by player tactics and controller inputs, the court held the game as a whole did not qualify. EA's penalty was revoked.

For indie studios, the Dutch framework produces two practical variables to evaluate. First: is your game skill-dominant overall, or is the lootbox mechanic central enough to the experience that a court would isolate it? Second: can players sell or trade lootbox contents outside your game for real money? Secondary market value, such as items listed on Steam's Community Market or third-party trading platforms, elevates Dutch legal risk regardless of the 2022 ruling. Build that audit into your pre-launch checklist for any game you plan to distribute in the Netherlands. If your items have secondary market value, treat the Dutch position as unsettled and get jurisdiction-specific legal advice before launch, rather than assuming the appellate win covers your design.

United Kingdom: Not Gambling — But Not Unregulated

The UK Gambling Commission has consistently held that lootboxes fall outside the Gambling Act 2005. The legal rationale is specific: rewards from lootboxes cannot be sold or otherwise exchanged for real-world currency, so they lack the "money or money's worth" value that British gambling law requires to classify a prize as something worth regulating. No Gambling Commission licence is required to offer lootboxes in the UK.

That ruling did not end the matter. In 2023, the government responded to the Culture, Media and Sport Committee's inquiry by declining to legislate, but directed the industry to produce binding-in-practice voluntary measures. The result was the UKIE Principles, published July 2023. Studios that sell to UK players should treat these eleven principles as a de facto compliance floor, because the government has indicated it may impose mandatory requirements if industry adoption proves insufficient.

Under the UKIE framework, studios must restrict lootbox purchases by under-18s unless a parent or guardian consents, disclose the probability of receiving each virtual item before purchase, provide easy-to-use spending controls for all players, and apply a default spending limit of £0 to child accounts on supported platforms. The government's own evidence found that only 1 in 5 parents used parental controls during the review period, so regulators are watching adoption rates closely.

A separate obligation runs through PEGI. On April 13, 2020, PEGI introduced its "In-Game Purchases (Includes Random Items)" descriptor. Any game with paid random items, defined as purchases where the player does not know the specific digital good they will receive before buying, must carry the descriptor on packaging and digital storefronts. Only 2.5% of games received the descriptor between August 2020 and May 2022, compared to 15% for general in-game purchases, which means most studios subject to this requirement are not yet complying.

There is also an advertising enforcement layer. The Advertising Standards Authority has already acted against studios under the CAP Code for failing to disclose material information about lootbox mechanics, independently of gambling law. For studios distributing in the UK, the practical compliance picture is three obligations stacked together: no gambling licence required, but PEGI descriptor required for rated games, UKIE parental controls and disclosure infrastructure required in practice, and ASA disclosure standards required for any marketing. If you are building compliance infrastructure across multiple jurisdictions, the UK parental consent and odds disclosure stack slots naturally alongside GDPR age-gating requirements you will already be building for EU users.

United States: No Lootbox Law, Real Legal Risk

No federal lootbox statute exists in the United States. The FTC held a workshop on loot boxes and microtransactions in August 2019, then published a staff perspective paper in August 2020 summarizing stakeholder concerns. That paper produced no rulemaking and no enforcement action. State-level attempts fared no better: bills introduced in California, Hawaii, Minnesota, and Washington all failed to advance. As of 2025, no US federal or state lootbox law has passed.

That legislative silence does not mean the space is safe. The FTC's January 2025 settlement with Cognosphere (the entity behind Genshin Impact) settled for $20 million and exposed exactly where US enforcement risk lives. The FTC alleged Cognosphere violated Section 5 of the FTC Act through unfair and deceptive practices: the odds of obtaining a specific featured character were as low as 0.3%, potentially requiring $360 to $540 in spending, while the game's marketing obscured this. The settlement required Cognosphere to accurately disclose lootbox odds, implement parental consent for users under 16, and make currency exchange rates transparent. Section 5 covers any unfair or deceptive act or practice in commerce. Misrepresenting lootbox odds fits squarely within that authority.

The Cognosphere case also combined lootbox deception claims with COPPA violations. The FTC alleged Cognosphere unlawfully collected personal data from children under 13 without verifiable parental consent. The settlement required deletion of unlawfully collected data and implementation of proper consent procedures. Studios cannot self-certify their way out of COPPA exposure with a disclaimer stating the game targets adults. Regulators assess actual marketing practices and design elements, including visual style, character design, and the age composition of the actual player base. If a game's design attracts children under 13, COPPA applies regardless of what the terms of service say.

On the disclosure side, the ESRB adopted an In-App Purchases (Includes Random Items) label in April 2020. Any ESRB-rated game with lootboxes should carry it. The label is voluntary, not legally mandated, but applying it demonstrates transparency and aligns with the FTC's stated expectation that lootbox costs be "clear and transparent." For a US studio distributing on major platforms, applying the ESRB label is the baseline. Accurate odds disclosure and COPPA compliance for any game that may reach children under 13 are the floor above that.

The EU-Wide Landscape: Where the Rest of Europe Stands

The European Parliament has been the loudest institutional voice on lootboxes in Europe. On January 18, 2023, MEPs adopted a report calling on the European Commission to analyze how lootboxes are sold and to assess whether to propose either a ban on paid lootboxes for minors or a mandatory default-disabled mechanism. In late 2025, MEPs from the Internal Market and Consumer Protection Committee urged the Commission to outlaw lootboxes and randomized gaming features that provoke gambling-like behavior in children. Neither call has yet produced EU-level legislation.

Gambling regulation remains member state competence under EU law. No harmonized lootbox standard is in force as of early 2026. What exists is a patchwork of national positions that studios must navigate individually. A Digital Fairness Act is projected for Q4 2026 and may implement either a complete lootbox ban for games accessible to minors or a mandatory parental consent requirement across all member states, making it the legislation studios should track most closely.

Germany

Germany has not classified lootboxes as gambling under the 2021 Glücksspielstaatsvertrag (Interstate Gambling Treaty). The more immediate compliance touchpoint is age rating. Effective January 1, 2023, the USK, Germany's age rating commission, expanded its assessment criteria to factor in lootboxes, other in-game purchases, and online chat features as "possible online risks" when classifying a game. A game with prominent paid lootboxes targeting younger audiences will face scrutiny at the rating stage, which affects distribution. GDPR data protection obligations apply to user data collected in connection with lootbox monetization in Germany, as in all EU member states: data practices targeting or incidentally reaching minors require particular care.

Austria

Austria's legal position shifted significantly in December 2025. The Austrian Supreme Court issued its ruling in Case 6 Ob 228/24h on December 18, 2025, holding that FIFA Ultimate Team lootboxes do not constitute gambling under Austrian law. The Court applied a holistic assessment principle and a rational expectation test for mixed skill-chance games: despite the randomized pack contents, player control over match outcomes through tactics and execution was sufficient to defeat the gambling classification. Austria's ruling applies a structurally similar skill-integration analysis to the one that succeeded in the Netherlands in 2022. Studios whose games have a dominant skill component benefit from this ruling; studios selling pure chance mechanics in a thin game wrapper do not.

Spain and France

Spain's Ministry of Consumer Affairs released a preliminary regulatory bill in July 2022 proposing lootbox regulation as part of a broader effort to protect minors from addictive behaviors. No final legislation has passed. France takes the same transferability-based position as the Netherlands: lootboxes are not gambling unless items won can be exchanged for real-world currency. Studios operating non-tradeable, closed-economy lootboxes face no gambling classification risk in France under current law.

Compliance Checklist Before You Launch with Lootboxes

Jurisdiction-by-jurisdiction lootbox law produces one practical result: you cannot pick a single global policy and ship. The checklist below maps each major market to a concrete action. Work through it before you submit to any storefront.

1. Map your distribution footprint. List every country where your game will be sold or downloaded. This list drives every subsequent step. A game exclusive to the US App Store has a very different compliance posture than one distributed globally on Steam, Google Play, and the Nintendo eShop.
2. Belgium and Netherlands: assess secondary market value. If Belgium is in scope, you have two options: geo-block Belgian users from the lootbox mechanic, or replace real-money lootbox purchases with earned in-game currency only. EA established this template in January 2019 and it remains the industry model. For the Netherlands, the operative risk is whether lootbox contents can be sold or traded on external secondary markets. If your items lack external exchange value and your game is skill-dominant overall, the 2022 Dutch Council of State ruling reduces your exposure considerably.
3. UK: apply the UKIE Principles and the PEGI label. The UK does not regulate lootboxes as gambling, but the UKIE's July 2023 voluntary principles set the practical compliance floor. Apply the PEGI In-Game Purchases (Includes Random Items) descriptor on packaging and storefronts. Restrict lootbox purchases by under-18s without parental consent. Implement default spending limits of £0 for child accounts. Provide odds disclosure before purchase. Non-compliance invites both ASA enforcement under the CAP Code and the mandatory legislation the government has explicitly threatened.
4. United States: accurate odds disclosure is not optional. No dedicated federal lootbox law exists, but the FTC's January 2025 settlement with Cognosphere established what Section 5 of the FTC Act requires in practice: accurate odds disclosure before purchase, transparent real-money costs, and parental consent gates for users under 16. Apply the ESRB In-App Purchases (Includes Random Items) label on all ESRB-rated releases. If your game may reach children under 13, run a full COPPA audit: the Cognosphere case combined COPPA violations with the lootbox deception claims, and the FTC explicitly rejected self-certification based on disclaimer language alone.
5. EU (excluding Belgium): build for the Digital Fairness Act. No EU-wide lootbox law is in force as of 2026, but the European Parliament's November 2025 resolution urges the Commission to outlaw lootboxes in games accessible to minors. A Digital Fairness Act projected for Q4 2026 is expected to require either an outright ban in minor-accessible games or mandatory parental consent. Implement odds disclosure and parental consent infrastructure now. Treat Germany's USK age-rating review (in effect since January 1, 2023) as a design consideration. Monitor Spain, where a proposed regulatory bill has been in progress since July 2022.
6. Platforms: satisfy every applicable storefront policy. Apple's App Store has required odds disclosure since December 2017 under Section 3.1.1 of its Review Guidelines. Google Play adopted the same requirement in May 2019. Microsoft, Nintendo, and Sony have committed to equivalent odds disclosure requirements on their platforms. Steam does not currently require odds disclosure, though regulatory scrutiny of this gap is increasing: publish odds on Steam anyway. Apply voluntary disclosure on the Epic Games Store as well (Epic has not published a documented lootbox odds policy as of early 2026).
7. Document your compliance decisions in writing. For each jurisdiction in your distribution footprint, write down the decision made, the authority it is based on, the date of the decision, and who approved it. Regulators and platform review teams move faster when you can show a reasoned compliance record rather than a defensive explanation after the fact. Revisit the document before each major content update and before entering any new market.