How Regulators Approach Loot Boxes and Gambling-Like Mechanics
Loot boxes look a lot like the fruit machines I serviced in the 1980s. Regulators took a while to notice. Here is the timeline of how the rules caught up, or did not.
When I first saw a loot box animation in a video game, it reminded me of an old AWP I used to maintain: spinning reels, a teaser hold, a payout that might or might not come. Same dopamine circuit, different packaging. Regulators have spent the last decade trying to decide whether it is the same thing legally. This is the chronology.
Mid-2000s: The mechanic arrives quietly
Microtransactions and probabilistic reward boxes grew out of Asian free-to-play markets in the early 2000s. MapleStory ran Gachapon tickets. Japan had kompu gacha. The mechanic crossed into Western games around 2004 to 2007 through Valve's early Team Fortress 2 crate drops and FIFA Ultimate Team packs, which EA introduced in 2009. At this stage, regulators were focused on online poker liquidity and UIGEA enforcement in the United States. Nobody in a gaming commission was looking at crate drops in a shooter.
2012: Japan acts on kompu gacha
The first real regulatory shot came from Japan's Consumer Affairs Agency in May 2012. Kompu gacha was a specific mechanic in which players collected a set of rare items, each drawn from a randomized pool, to unlock a grand prize. The CAA ruled it illegal under the Act Against Unjustifiable Premiums and Misleading Representations. Japanese publishers killed the mechanic within weeks. Simple gacha, where you just pull for one item, remained legal. This drew a line that regulators elsewhere would revisit: a random draw for an item, by itself, was not enough to trigger gambling law. Adding a secondary combination requirement tipped it over.
2016 to 2017: The Counter-Strike skin gambling wave
The first Western regulatory attention came not from the crates themselves but from the secondary market. CS:GO allowed players to trade weapon skins, some of which had high real-world value. Third-party sites used the Steam API to let users wager skins on match outcomes and casino-style games. The Washington State Gambling Commission opened inquiries in 2016, the Valve legal team sent cease-and-desists to about 40 such sites, and the YouTube CSGOLotto scandal involving Trevor Martin and Tom Cassell broke in July 2016. The skin market had built a shadow gambling economy that nobody had licensed.
November 2017: Star Wars Battlefront II
This was the moment that broke public patience. EA launched Star Wars Battlefront II with a progression system tied to loot box purchases. Belgian and Dutch authorities opened investigations within days. The Hawaii state legislature introduced a bill. The ESRB issued a statement that loot boxes were not gambling because players always received an item of value. That statement did not age well.
2018: Belgium and the Netherlands rule
In April 2018, the Belgian Gaming Commission declared that paid loot boxes in FIFA 18, Overwatch, and CS:GO met the legal definition of games of chance and therefore required a gambling licence. No licences would be issued for such products. Publishers had to remove the mechanic or pull the games from Belgium. Overwatch and CS:GO complied by disabling paid boxes for Belgian accounts. FIFA eventually removed real-money pack purchases for Belgian users in 2019.
The Dutch Kansspelautoriteit reached a narrower conclusion: loot boxes were gambling only when the items could be traded or cashed out on secondary markets. That made FIFA's packs illegal in the Netherlands, but not Overwatch's. The distinction between in-game-only rewards and tradeable items mattered.
2019: The UK House of Lords Select Committee
In July 2019, the UK House of Commons Digital, Culture, Media and Sport Committee recommended loot boxes be regulated under the Gambling Act 2005. The UK Gambling Commission's position at the time was that because loot box items had no cash-out mechanism inside the game, they did not meet the statutory definition of gambling. The committee disagreed. The government launched a formal consultation that ran from 2020 to 2022.
2020: France opens, Germany tightens youth ratings
France's ARJEL, soon renamed ANJ, concluded that loot boxes did not meet French gambling law thresholds unless there was a cash-out path. Germany went a different direction: the USK, the German age rating body, began applying stricter age ratings to games with paid loot boxes, which under a 2021 youth protection law amendment meant games with such mechanics could no longer be rated for under-16s without additional review.
2022: The UK response
In July 2022, the UK government published the response to its consultation. The conclusion: loot boxes would not be classified as gambling under existing law. Instead, the government asked the industry to self-regulate and improve transparency. UKIE, the trade body, launched a voluntary code in 2023 requiring odds disclosure, parental controls, and clear labelling.
2023: Australia's classification change
The Australian Classification Board announced that from September 2024, any game with simulated gambling or paid loot boxes would receive a minimum R18+ or M rating, significantly restricting distribution to younger players. This mirrored the German approach.
2024 to the present
The FTC held a workshop in August 2019 on in-game purchases and published a report in 2020, but has not taken formal action. A US class action against EA's FIFA packs was dismissed in 2023 on the basis that pack odds were disclosed. The EU Parliament passed a non-binding resolution in January 2023 calling for harmonised rules, but no directive has followed. Publishers now routinely publish pull rates for paid random items, a practice that began with Apple App Store rules in 2017 and spread to Google Play and console storefronts.
The current settled position across most jurisdictions is this: a loot box that produces only items usable inside the game, with disclosed odds, is not gambling. A loot box whose items can be cashed out or traded for real value is. The line is narrow, and every publisher knows exactly where it runs. The mechanic I first recognised from my workshop is now legal almost everywhere, so long as it stays inside the walled garden.