Lootbox Regulation in 2026: A Compliance Checklist for Game Studios Under EU, UK, and US Law

If your game studio ships a title with lootboxes or randomized in-game purchases in 2026, you are entering a regulatory environment that is fundamentally different from the one that existed even two years ago. The EU's Digital Services Act is now in effect for very large online platforms, with broader enforcement expanding to all platforms. The EU Consumer Protection Cooperation Network has published guidelines on microtransactions and virtual currencies that apply existing consumer protection law directly to game monetization design. The UK has moved from a "wait and see" posture to active ASA enforcement against app store listings that fail to disclose lootboxes. Belgium and the Netherlands have set enforcement precedents that are reshaping how major publishers design their monetization systems. And in the United States, state legislatures are reintroducing lootbox disclosure and minor-protection bills — New York's A9044 is just one example of a growing legislative trend that could fragment your compliance obligations across dozens of jurisdictions.

For indie and mid-size game studios, the challenge is not just tracking these developments — it is translating them into design decisions before you ship. A monetization system that is legal in one jurisdiction may be illegal, subject to disclosure requirements, or require parental consent infrastructure in another. Getting this wrong means delayed launches, platform rejections, regulatory investigations, and in some cases, criminal liability under gambling statutes. We have walked through similar multi-jurisdiction compliance challenges in our guide to lootbox laws across jurisdictions for indie studios, and the landscape has only grown more complex since then. This article is the practical compliance checklist you need before shipping a game with randomized monetization in 2026.

EU Digital Services Act and In-Game Purchase Transparency

The EU's Digital Services Act (DSA), which entered into force in February 2024 and became applicable to all online platforms by February 2025, imposes transparency obligations that directly affect game studios operating online platforms or distributing games through platforms subject to the DSA. While the DSA does not single out lootboxes by name, its provisions on transparency of terms and conditions, advertising transparency, and platform accountability create a regulatory floor that game distribution platforms must meet — and that flows downstream to developers. (EU Regulation 2022/2065, Digital Services Act)

More directly relevant to game studios are the Guidelines on Microtransactions and Virtual Currencies in Video Games published by the EU Consumer Protection Cooperation (CPC) Network in 2025. These guidelines interpret and apply existing EU consumer protection rules — particularly the Unfair Commercial Practices Directive — specifically to game monetization systems. While not legally binding in themselves, they represent the regulatory direction of travel and signal how enforcement will proceed under existing law. (GamingTechLaw, "Video Games and Microtransactions: New EU Guidelines on Virtual Currencies Aim to Transform Industry Practices," May 2025)

The CPC guidelines establish seven key principles that game studios must consider when designing or reviewing monetization systems:

• Price transparency: Digital content must display the real-world price, even when purchased with virtual currencies. If an item costs "200 gems," the equivalent price in euros must also be shown.
• Avoiding obscured costs: Games must avoid systems that make it hard to understand what a player is spending. Multiple layers of virtual currencies or confusing conversion rates are strongly discouraged.
• Preventing forced over-spending: Offering virtual currency bundles that exceed the required amount for specific content is seen as manipulative. Players should be able to buy exact amounts.
• Clear pre-contractual information: All relevant information — including product features, withdrawal rights, and pricing — must be available before purchases are completed.
• Right of withdrawal: Players should retain the right to withdraw from unused virtual currency purchases. Limitations on this right could violate EU consumer law.
• Fair contract terms: Agreements must avoid vague or unfair terms that unilaterally benefit the developer.
• Protecting vulnerable users: Special protections must be in place for minors and high-spending users, including parental controls, purchase limits, and prohibitions on marketing that encourages children to buy.

Beyond the CPC guidelines, the European Commission is developing the Digital Fairness Act, which is expected to be published in draft form by late 2025 or early 2026. Several EU member states — particularly the Netherlands — are pushing for the Digital Fairness Act to include an explicit ban on lootboxes. The Dutch government has stated that European-level regulation is more effective than national rules, given the international nature of the video game market, but has also acknowledged that an actual ban is not expected before 2026. (Franssen Tolboom, "Loot Boxes in Games: An Overview of Recent Developments," Jan. 2025)

For game studios, the practical implication is this: if your monetization system uses virtual currencies, lootboxes, or randomized rewards, you must design for transparency from the ground up. Display real-world prices. Avoid manipulative currency bundling. Provide clear pre-purchase information. And if you target EU consumers, build withdrawal rights into your virtual currency purchase flow.

UK: Industry-Led Protections and ASA Enforcement

The UK has taken a different path from Belgium and the Netherlands. Rather than legislating a ban, the UK government — through the Department for Culture, Media and Sport (DCMS) — pursued an industry-led approach. In July 2023, DCMS published guidance developed by a Technical Working Group convened with games industry representatives, coordinated by the trade body UK Interactive Entertainment (Ukie). The government's position, established in its July 2022 response to its call for evidence on lootboxes, is that purchases of lootboxes should be unavailable to all children and young people unless enabled by a parent or guardian, all players should have access to spending controls and transparent information, and better evidence and research should inform future policy. (UK Government, "Loot boxes in video games: update on improvements to industry-led protections," July 2023)

The UK Gambling Commission has not classified lootboxes as gambling under the Gambling Act 2005, but it has commissioned research through its Advisory Board for Safer Gambling that examines the association between lootbox purchasing and problem gambling. The government's call for evidence found an association between lootbox purchases and problem gambling, but noted that evidence has not established a causal relationship. (UK Gambling Commission, "Loot boxes: Advice to the Gambling Commission from ABSG")

However, the absence of gambling classification does not mean the UK is a regulatory free-for-all. The Advertising Standards Authority (ASA) has been actively enforcing against game studios that fail to disclose lootbox mechanics in their advertising — including app store listings. In a series of rulings issued in 2025 and 2026, the ASA established that the presence of lootboxes within a game is material information to a consumer's decision to purchase or download it. The ASA's guidance, reviewed in 2025, requires that app store listings for games containing lootboxes clearly state this in a prominent location — for example, "Includes random-item purchases" or "Contains loot boxes." The ASA has ruled that generic labels like "Offers In-App Purchases" are not sufficient to inform consumers that those purchases may include lootboxes. (ASA, "Thinking outside of the (loot) box," Feb. 2026)

The ASA has also ruled that its jurisdiction extends to app store listings targeting UK consumers regardless of the location of the advertiser — meaning a studio based in Canada or Cyprus that distributes a game with lootboxes to UK consumers through an app store is subject to ASA enforcement. This extraterritorial reach means that indie studios cannot assume they are outside UK regulatory scope simply because they are not based in the UK.

For game studios, the UK compliance requirements in 2026 are:

• Disclose lootbox presence prominently in app store listings and any advertising that promotes the game to UK consumers.
• Implement parental controls that restrict anyone under 18 from acquiring paid lootboxes without parental consent, including default £0 spending limits on child accounts.
• Provide spending controls that all players can access and are aware of.
• Ensure age assurance that reduces reliance on self-declaration, consistent with the government's stated expectations.

Belgium and the Netherlands: The Enforcement Precedent

Belgium was among the first countries to take enforcement action against lootboxes. In 2018, the Belgian Gaming Commission concluded that certain lootboxes constituted a game of chance and were therefore subject to Belgian gambling law. The Commission specifically identified four elements that brought lootboxes within the scope of gambling legislation: a bet (money or virtual currency that can be exchanged for money), an element of chance, a possible win, and the element of risk. Following this determination, several major publishers — including EA, Blizzard, and Square Enix — removed lootboxes from their games in Belgium rather than face criminal prosecution.

The Netherlands followed a similar path. In 2018, the Dutch Gaming Authority (Kansspelautoriteit) concluded that some lootboxes violated the Dutch Betting and Gaming Act. However, the Dutch regulatory approach was significantly complicated by a March 2022 ruling from the Dutch Council of State, which found that regulating lootboxes through national gambling legislation was problematic because a lootbox is almost always part of a broader (skill-based) game. Regulating through gambling legislation would mean that entire video games would fall under gambling law — an outcome the court found untenable. (Franssen Tolboom, Jan. 2025)

Since the Council of State ruling, the Dutch government has shifted its focus to the European level. The Minister of Economic Affairs has stated that he expects the European Commission to publish a draft of the Digital Fairness Act by the end of 2025, and that he will urge the Commission to include a ban on lootboxes in that legislation. The minister has acknowledged that national rules can be more easily circumvented by international game providers, while European rules force providers to adjust their business models globally. (Franssen Tolboom, Jan. 2025)

For game studios, the Belgium and Netherlands precedent creates a practical decision point. If your game includes paid lootboxes and you distribute in Belgium, you face potential criminal liability under gambling law. If you distribute in the Netherlands, the current regulatory path is uncertain — but the Dutch government has signaled its intent to push for an EU-wide ban. Studios that design monetization systems without considering these jurisdictions risk being forced to redesign or pull their games from significant European markets.

The practical approach most studios have adopted: build a region-specific monetization system that can disable or modify lootbox mechanics in jurisdictions where they are restricted. This requires architecture-level decisions — not post-launch patches. If your monetization system is deeply integrated into your game's progression design, disabling lootboxes in Belgium is not as simple as toggling a feature flag. It may require rebalancing your entire progression economy.

US State-Level Legislative Activity

The United States has no federal law specifically regulating lootboxes. But state legislatures have been increasingly active. While earlier efforts — including a 2019 bill introduced by Senator Josh Hawley at the federal level — failed to gain traction, state-level bills are proliferating.

New York has introduced Assembly Bill A9044 in the 2025-2026 legislative session, which addresses lootbox and in-game purchase transparency. The bill represents a growing trend of state-level legislation targeting how games disclose randomized purchase mechanics to consumers, particularly minors. (NY Senate, A9044, 2025-2026 Session)

Washington State has been active through its Gambling Commission, which has published analysis on lootboxes and their relationship to gambling law. The Commission has examined whether certain lootbox mechanics meet the definition of gambling under Washington law, focusing on whether the element of prize, chance, and consideration are present. (Washington State Gambling Commission, Loot Boxes analysis)

Several other states — including California, Minnesota, and Hawaii — have introduced or considered lootbox legislation in recent sessions. While most of these bills have not yet been enacted, the trajectory is clear: state legislatures are increasingly focused on requiring disclosure of lootbox odds, restricting lootbox purchases by minors, and in some cases, classifying certain lootbox mechanics as gambling. The FTC has also held workshops on lootboxes and has signaled continued interest in the consumer protection implications of randomized monetization mechanics.

For game studios, the US state-level landscape creates a compliance challenge that is familiar to anyone who has navigated state privacy law patchworks: you may need to comply with different disclosure requirements, age-gating mechanisms, and purchase restrictions depending on which states your players reside in. Unlike the EU, where a single regulatory framework (once finalized) can create uniformity, the US system means you must track and comply with each state's requirements individually.

The practical approach: design your monetization system to meet the most stringent state requirements you are likely to encounter. If you build disclosure of odds, parental consent for minors, and spending controls from the start, you will be positioned to comply with most state-level bills as they are enacted — without needing to retrofit your game each time a new state passes legislation.

Platform-Level Requirements: Apple, Google, Steam, and Consoles

Even absent specific legislation, the platforms through which you distribute your game impose their own lootbox and in-game purchase requirements. These platform policies function as de facto regulation — if you do not comply, your game cannot ship.

Apple requires that apps offering lootboxes or other mechanisms providing randomized virtual items for purchase must disclose the odds of receiving each type of item to customers prior to purchase. This requirement, codified in section 3.1.1 of Apple's App Store Review Guidelines, applies globally — not just in jurisdictions with local legal requirements. Apple adopted this policy in December 2017, making it one of the earliest platform-level lootbox disclosure requirements. (GamesBeat, "Apple now requires app developers to disclose loot box odds," Dec. 2017)

Google Play has similar requirements for apps distributed through its store. Developers must disclose the odds of receiving items from lootboxes and other randomized purchase mechanics.

Console platforms — Sony PlayStation, Microsoft Xbox, and Nintendo — have committed to requiring paid lootbox odds disclosure for games on their platforms. This commitment was announced in 2019 through the Entertainment Software Association (ESA), with the console makers targeting 2020 for implementation. In addition, major ESA publisher members — including Activision Blizzard, Electronic Arts, Epic, Microsoft, Nintendo, Sony, Take-Two, Ubisoft, and Warner Bros. Interactive — agreed to disclose the relative rarity or probability of obtaining in-game virtual items from purchased lootboxes. The ESRB also expanded its ratings disclosures to include an "In-Game Purchases" label on packaging for games that offer additional in-game content. (ESA, "Video Game Industry Commitments to Further Inform Consumer Purchases," 2019)

Steam (Valve) has faced its own regulatory scrutiny. The company has been the subject of lawsuits alleging that its lootbox-like mechanics (including CS:GO skin cases) constitute unlawful gambling. While Valve has not adopted the same universal odds disclosure requirements as Apple and Google, the regulatory and litigation pressure on Steam-based monetization is increasing.

For game studios, the platform-level requirements mean that odds disclosure is no longer optional — it is a condition of distribution. If you ship on Apple, Google, or console platforms, you must disclose lootbox odds. The question is not whether to disclose, but how to design the disclosure so it is clear, accessible, and compliant with both platform requirements and emerging legal requirements.

Building a Compliance Checklist for Your Monetization Design

Based on the regulatory landscape above, here is the compliance checklist we recommend game studios work through before shipping a title with randomized monetization in 2026. This checklist is organized by the regulatory domains that most directly affect monetization design decisions.

EU Compliance

• Display real-world prices alongside virtual currency prices for all in-game purchases, including lootboxes. If an item costs 200 gems, show the euro equivalent.
• Avoid multi-layer currency systems that obscure the real cost of purchases. If you use a virtual currency, make the conversion rate to real money transparent and easily accessible.
• Sell exact currency amounts needed for specific items, or at minimum, avoid deliberately forcing players to purchase more currency than they need.
• Provide pre-purchase information that includes product features, pricing, and withdrawal rights before the transaction is completed.
• Build withdrawal rights into your virtual currency purchase flow for unused currency, consistent with EU consumer law.
• Implement minor protections including parental controls, purchase limits, and prohibitions on marketing that encourages children to make purchases.
• Design for the Digital Fairness Act by building a monetization system that can be modified or disabled in specific EU jurisdictions if the Act includes lootbox restrictions.

UK Compliance

• Disclose lootbox presence prominently in app store listings and all advertising targeting UK consumers. Use clear language like "Includes random-item purchases" or "Contains lootboxes."
• Do not rely on generic "In-App Purchases" labels — the ASA has ruled these are insufficient to disclose lootbox mechanics.
• Implement parental controls that prevent anyone under 18 from acquiring paid lootboxes without parental consent, including default £0 spending limits on child accounts.
• Improve age assurance to reduce reliance on self-declaration, consistent with government expectations.
• Provide spending controls that all players can access and understand, including clear information about cumulative spending.

Belgium and Netherlands Compliance

• Build region-specific monetization toggles that can disable lootbox purchases in Belgium, where certain lootbox mechanics are subject to gambling law enforcement.
• Design your progression economy so that disabling lootboxes does not break the game — include alternative acquisition paths for items that would otherwise be obtained through lootboxes.
• Monitor Dutch regulatory developments and be prepared to modify your monetization system if the Digital Fairness Act introduces EU-wide lootbox restrictions.

US State Compliance

• Disclose lootbox odds for all randomized purchase mechanics, regardless of whether a specific state requires it. This is already required by Apple, Google, and console platforms, so state-level requirements are additive, not new.
• Implement age-gating for lootbox purchases, with parental consent mechanisms for minors. Design to the most stringent state standard you are likely to encounter.
• Track state legislation in states where you have significant player populations. New York, Washington, California, and Minnesota have all shown legislative interest in lootbox regulation.
• Provide spending controls and purchase history that allow players (and parents) to monitor and limit in-game spending.

Platform Compliance

• Disclose odds for every randomized purchase mechanic — this is required by Apple, Google, and console platforms, and is increasingly expected by regulators globally.
• Ensure your disclosure is accessible — not buried in a terms of service document or behind multiple menus. The ASA has ruled that disclosures must be prominent and easily found.
• Design disclosures to be understandable — use clear language about what players are buying, what the odds are, and what the real-world cost is.
• Implement parental controls at the platform level where available, and at the game level where platform controls are insufficient.

Actionable Next Steps

1. Audit your current monetization system against this checklist. Map every randomized purchase mechanic in your game against the EU, UK, Belgium/Netherlands, US state, and platform requirements above. Identify the gaps — and prioritize them by the jurisdictions where you have the most players.
2. Design for the strictest jurisdiction you will ship in. If you build for Belgium (where lootboxes may need to be disabled) and the EU CPC guidelines (which require real-world price disclosure and withdrawal rights), your monetization system will be compliant in most other jurisdictions by default. Designing to the lowest common denominator means retrofits every time a new law passes.
3. Build region-specific toggles at the architecture level. Your monetization system should be able to enable or disable specific mechanics by jurisdiction without requiring a game update. This means your lootbox system, your virtual currency system, and your purchase flow should all be configurable by region — not hard-coded.
4. Implement odds disclosure everywhere, now. If you are shipping on Apple, Google, or console platforms, you are already required to disclose odds. Make this disclosure clear, accessible, and understandable. Do not treat it as a compliance checkbox — treat it as a player trust feature.
5. Design your progression economy to survive without lootboxes. If Belgium, the Netherlands, or a future EU Digital Fairness Act forces you to disable lootboxes in a jurisdiction, your game should still be playable and enjoyable. This means alternative paths to obtain items that would otherwise be locked behind randomized purchases.
6. Implement parental controls and age-gating before launch. Both the UK government and US state legislators expect parental consent mechanisms for minors. Build these into your purchase flow, not as a post-launch patch. The UK government has specifically called for default £0 spending limits on child accounts.
7. Monitor the Digital Fairness Act and US state legislative developments. The EU's Digital Fairness Act draft is expected by late 2025 or early 2026, and may include lootbox restrictions. US state bills are being reintroduced in 2025-2026 sessions. Your compliance posture should be reviewed quarterly against new developments.
8. Engage legal counsel before you ship — not after a regulatory action. The cost of a pre-launch monetization compliance review is a fraction of what a regulatory investigation, platform delisting, or forced game redesign will cost. If you are shipping a game with randomized monetization in 2026, bring counsel into your design process before the monetization system is finalized.

The studios that treat lootbox regulation as a design constraint — not a legal afterthought — will be the ones that ship on time, across all jurisdictions, without regulatory surprises. The ones that assume they can patch compliance after launch will find that the regulatory landscape has moved faster than their update cycle. In 2026, monetization compliance is a competitive advantage. Build it into your game from the start.