Loot Boxes in 2026: Regulation Map for Game Studios

A loot box is a virtual container of randomized in-game items that a player buys with real money without knowing what they'll get. Think of a pack of trading cards: you might pull something rare, or you might pull what everyone already owns. That randomness is what separates a loot box from an ordinary microtransaction, where you pay for a specific item.

It's both a strong monetization model and a source of legal risk. By a 2020 estimate, loot boxes generate at least 15 billion dollars a year for the industry, and more recent projections run to 20 billion and beyond — which is exactly why they're hard to give up. But regulators around the world still haven't agreed on whether they count as gambling, and in 2026 the gap between countries is only widening. Below is the map by region, and what it means in practice.

The core question: game or gambling?

The legal debate turns on one question: is a loot box part of the game, or a form of gambling? Formally it's almost gambling, but not quite: there's a stake and a random outcome, but the reward usually can't be cashed out for real money. That grey zone is what produces the regulatory patchwork.

The regulatory focus is also shifting in 2026. The "game or gambling" argument is giving way to a narrower, more practical goal — protecting children. If an adult wants to spend money on loot boxes, that's their right. The problem starts when a child pays, with a parent's card attached to the account and no restrictions. That shift explains why more and more new rules hang on age verification and parental controls rather than gambling licences.

At a glance: the jurisdiction map

Here's what sits behind those rows.

Europe: from light-touch rules to bans for minors

The EU has no single regime yet, and member states read "gambling" differently:

• Belgium and the Netherlands — the strictest line: loot boxes are treated as gambling and effectively banned. The catch is that the ban barely works: research suggests loot boxes remain in the large majority of top iPhone games in Belgium.
• Austria: in December 2025 the country's Supreme Court (case 6 Ob 228/24h) held that FIFA Ultimate Team packs are not gambling, overturning earlier decisions of lower courts. A separate Styria court decision ordering a refund of 14,096 euros to a player for Counter-Strike cases came from a lower instance and now diverges from that top-court position. In other words, the precedent is unstable and can't be relied on as settled law.
• France does not treat loot boxes as gambling unless the dropped items can be converted into real money.
• Germany — in late 2025 the Bundesrat adopted a resolution urging significantly tighter rules. It's a non-binding call to the federal government, not a law: to examine whether loot boxes should count as gambling because of their gambling-like mechanics, up to a mandatory 18+ rating, and to require full transparency on odds and pricing. Germany also backs unified regulation through the Digital Fairness Act.
• Poland (draft law) is weighing a mandatory two-year licence, 18+ age verification, and spending limits.
• Spain — odds disclosure requirements.

The big one on the horizon is the Digital Fairness Act. In October 2025, EU lawmakers called for a unified approach, and the EU is preparing the act itself for around the end of 2026. Even if it passes on that timeline, it wouldn't start to apply before 2029. It could ban loot boxes in games accessible to minors, or require parental consent, across all EU countries at once.

Age ratings are changing in parallel. Under the updated PEGI rules from June 2026, monetization and social features raise the age rating on their own: loot boxes and paid random items mean no lower than 16, while NFTs/blockchain and unrestricted player-to-player chat mean 18. A telling example: EA Sports FC loses its usual PEGI 3 rating because of Ultimate Team packs.

United Kingdom: self-regulation plus the Online Safety Act

Britain went the route of industry guidance from Ukie (UK Interactive Entertainment) — 11 voluntary principles: children shouldn't get access to loot boxes without parental consent, players should have control over spending, and drop odds should be disclosed (say, a 1% chance at the ultra-rare item).

Self-regulation's weak spot is the lack of enforcement. The data confirms it: in a study of the 100 top-grossing UK iPhone games (Leon Xiao, PLOS One), only 6.7% of games with loot boxes implemented prominent disclosure (2021 data), with overall compliance with the principles around 64%. By contrast, in China under a legal mandate disclosure reaches ~95.6%.

Non-compliant games face no consequences. There are targeted exceptions: in November 2025 the advertising regulator ASA ruled against Hutch Games (the game F1 Clash) precisely for failing to disclose loot box odds.

On top of this sits the Online Safety Act: it introduces platform liability, especially where there's user-generated content and player-to-player communication. On 25 July 2025 its child-protection part came into force — age verification, including via document upload or facial recognition. Non-compliance means heavy fines. Separately, a regime against dark patterns (fake discounts, manufactured urgency) operates in consumer law.

United States: no federal rule, but pressure is building

At the federal level, loot boxes aren't regulated as gambling, and states act inconsistently. But the quiet is deceptive: the US pressures loot box practices through consumer protection and children's data law.

The telling case here is US v. Cognosphere (studio HoYoverse, the game Genshin Impact): in January 2025 the company paid a 20 million dollar penalty and agreed not to sell loot boxes to children under 16 without verifiable parental consent, to disclose odds, and to delete data of children under 13. The regulator's tools here are the FTC Act (Section 5, on unfair practices) and COPPA (children's data protection).

For studios the takeaway is simple: the absence of a direct ban on loot boxes does not equal the absence of risk. It just arrives from a different direction.

Asia: the toughest enforcement

Asia doesn't ban loot boxes, but it demands transparency and, unlike the UK, actually punishes non-compliance.

• South Korea introduced a mandatory odds-disclosure law in March 2024. In January 2024 Nexon was fined 11.6 billion won (about 8.9 million dollars) for deliberately misstated odds in Maple Story. A tightening is now under discussion — fines of up to 3% of revenue (capped at 1 billion won).
• China has required publishers to disclose exact drop odds since 2017. That norm de facto set the standard for the industry worldwide.
• Japan allows standard loot boxes but bans "kompu gacha" (a combo mechanic where the prize is awarded only for collecting a complete set) — it falls under consumer protection law.

Australia and Brazil: age ratings

• Australia, since 22 September 2024, assigns games with paid chance-based mechanics (including loot boxes) a rating no lower than M (15+, advisory rather than a ban).
• Brazil passed a law on children's online safety: from March 2026, selling loot boxes to minors under 18 is banned.

MENA and the UAE

There's no dedicated loot box regulation in the UAE, or in MENA more broadly, in the public domain yet. But it doesn't follow that the zone is free. The region traditionally takes a strict view of gambling, and any mechanic with a stake and a random reward will most likely be assessed through that lens rather than through a bespoke gaming regime.

Our practical takeaway for studios entering MENA: don't rely on "no specific law means it's allowed." What decides here is the general prohibitive context around gambling, and the assessment has to be made against the specific game and monetization model. This is exactly the kind of case where asking early is cheaper than reworking a release.

An example from our practice: a studio with an f2p game was preparing a launch in the region. The studio rebuilt monetization to remove the element of the bet itself: the direct sale of random content for real money was excluded entirely, and bundles came with disclosed contents and published drop probabilities. Every decision was made after a legal assessment of the specific market — this is a reduction of legal risk, not a way to get around a ban: where the mechanic is prohibited, it is switched off by geography entirely.
— Gennady Kurdiumov, Co-Founder FUTURA Digital

Why fragmentation is its own problem

The most expensive thing about loot boxes is that the rules differ everywhere. A game that's legal in one country can break the law in another. A studio is forced either to maintain several versions, or to cut the mechanic for specific markets (as in Belgium), or to leave a jurisdiction entirely. And players route around geo-restrictions with VPNs.

There's also a less obvious point that practitioners themselves flag: the grey zone often suits the state. While the status of loot boxes stays blurry, many studios prefer not to risk it and cut the mechanic themselves: the state gets the result it wanted without writing a single new norm, and leaves the contested cases to the courts.

There's also a consumer-law nuance that often gets missed: with instant delivery of a digital good, the player agrees right at checkout to waive the 14-day cooling-off period — that is, gives explicit consent to immediate provision of the service. Without that consent the right to a refund survives, but in practice it's baked into the purchase flow. So getting your money back for an impulse purchase of game currency, the way you would for an ordinary online order, is usually no longer possible.

What this means for your studio

• Build regulation into the monetization design. Age verification, spending limits, and odds disclosure are cheaper to build in early.
• Map it to your launch markets.
• Separate loot boxes from microtransactions. Randomness is the main regulatory trigger; selling an item outright carries less risk.
• Child protection is the red line. Parental controls and clear communication cut both legal and reputational risk.

Even a game that complies with every rule still has to find its player: compliance doesn't replace a product, but the lack of it can close entire markets to you.

FAQ

Are loot boxes gambling? In most jurisdictions, not yet: formally, they lack the cash-out of a prize into real money. But Belgium and the Netherlands treat them as gambling, and Germany and the EU are moving toward tighter rules. There's no single answer: it depends on the country and the specific mechanic.

Do I have to disclose drop odds? In China (since 2017) and South Korea (since 2024) — yes, by law, with real fines. In the UK — under industry guidance. The trend clearly points toward mandatory disclosure, so build it in early.

How is a loot box different from a microtransaction? Randomness. A microtransaction buys a specific item; a loot box is a random set for a fixed price. That randomness is the main regulatory trigger.

What about loot boxes in the UAE and MENA? There's no dedicated law, but the region takes a strict view of gambling, and a stake plus a random prize will very likely fall under that frame. Assess it against your specific game before launch.

What age rating does a game with loot boxes get? In the EU under PEGI from June 2026 — no lower than 16; in Australia — M (15+); Germany is discussing 18+. The rating rises because of the monetization mechanic itself.

Can players get a refund on a loot box? Usually not: with instant digital delivery, the player consents at checkout to waive the 14-day cooling-off period. Without that consent the right survives, but it's typically baked into the purchase.

What should a studio do for a global launch? Map the rules across your launch markets and build regulation into the monetization design (age verification, limits, odds disclosure) before release, not after.

Prepared by the Futura Digital team, drawing on a public discussion by Collyer Bristow lawyers (Rob Watson, Nikhil Vyas) on the Skadi podcast and open regulatory sources. This is an informational overview, not legal advice: the rules change fast and vary by jurisdiction, so a specific project needs its own review.