How should the UK video game industry self-regulate loot boxes?

The UK Government recently weighed the question of whether to regulate loot boxes in games, and decided that the video game industry should first be allowed an opportunity to self-regulate and mitigate the potential harms of loot boxes. Legislation will only be brought if industry self-regulation fails to provide tangible improvements to consumer protection.

A technical working group of industry members convened by the Department for Digital, Culture, Media and Sport has already begun work. I, alongside other academic researchers, have been invited to provide our input (which may or may not be taken onboard).

For transparency, I share my current views and my advice on loot box regulation based on my interpretation of the existing academic literature and my empirical research results in this guest post.

I invite everyone in the industry to contribute to the efforts of the technical working group aimed at reducing harm and better protecting players, including children. I believe that coming up with a 'solution' is going to be a group effort. Whether or not you are directly involved in the technical working group, this should be treated as a creative process that you can contribute to. If you have an idea, you should reach out to your industry representative (UKIE, for example) and let them know so that your input can reach the technical working group.

The regulation of video game loot boxes that are bought with real-world money (or premium currency purchasable using real-world money) and offer randomised rewards has been controversial since the Star Wars Battlefront II debacle in 2017. When I mention loot boxes below, I mean these paid loot boxes.

The gambling laws of most countries (e.g., the UK and Denmark) are incapable of regulating most paid loot boxes because their rewards cannot be transferred to other players and do not possess real-world monetary value.

What then does effective industry self-regulation look like in a loot box context? The short answer is that we do not know, yet. We do not know what measures will reduce overspending and prevent potential harms, and we do not know whether any self-regulatory requirements will even be effectively complied with.

We do, however, have some helpful insights from empirical assessments of previous attempts at loot box regulation either using law or industry efforts. All of these have their shortcomings that we can improve upon in this forthcoming UK attempt.

I will briefly summarise our empirical findings on and the takeaways from:

1. China's loot box probability disclosure legal requirements;
2. PEGI's and the ESRB's respective 'Includes Paid Random Items' and 'Contain Random Items' labels;
3. The UK's (and many other countries') current self-regulatory probability disclosure requirements; and
4. Belgium's attempt to ban loot boxes.

Case Study 1: China

China has required companies to disclose the probabilities of obtaining randomised items from loot boxes since 2017. However, although nearly all companies have complied and disclosed probabilities, we found that the vast majority of disclosures were not sufficiently prominent nor easily accessible. This was likely because the Chinese regulation failed to require a specific, prominent, and uniform disclosure format and instead allowed companies discretion to comply sub-optimally.

Recommendation: Any forthcoming self-regulation in the UK should set non-discretionary industry-wide minimal standards that all companies must meet, although willing companies should, of course, be encouraged to go above and beyond.

Case Study 2: PEGI ratings

One self-regulatory measure that has been uniformly applied is PEGI's 'Includes Paid Random Items' label. PEGI would attach this to any games containing loot boxes to 'provide … additional information' to players and parents. However, we do not know whether this measure actually reduces harm. Its adoption was not supported by empirical studies and its potential benefits have never been assessed following implementation.

This very short label is unlikely to provide a sufficient amount of information as it does not inform players and parents as to exactly how the loot box mechanic can be identified so as to allow players and children to avoid engaging with it. It is possible that this measure achieves very little and is incurring unnecessary compliance costs.

An improvement might be to specifically describe the loot box mechanic and provide a choice in the options menu to turn the ability to purchase loot boxes on or off (potentially even with the default option set to off).

Recommendation: Any adopted self-regulatory proposal should ideally be supported by empirical evidence of its potential benefit. Measures can be pre-emptively adopted but their impact should be continually assessed and monitored following implementation.

Ineffective measures should be removed, rather than retained to give the false impression of taking (perfunctory) action. Companies should readily be prepared to be required to make improvements upon any existing measures.

Case Study 3: Probability Disclosures

China is the only country in the world to require loot box probability disclosures by law. In other countries, this measure is instead required by industry self-regulation, e.g., Apple's App Store Review Guidelines. We found that only 64% of games containing loot boxes disclosed probabilities on the UK Apple App Store as compared to 95.6% on the Chinese Store.

Apple did not appear to have been actively enforcing the self-regulatory probability disclosure requirement. Non-compliance was not sufficiently disincentivised: for example, failing to disclose probabilities did not seem to cause games to be removed from the store.

Case Study 4: Belgium's loot box ban

Similarly, even though Belgium technically 'banned' loot boxes using gambling law back in 2018, 82% of the highest-grossing iPhone games on the Belgian Apple App Store continued to monetise using loot boxes in 2022. This was because the regulator has not actively enforced the law due to a lack of resources, thus again highlighting the importance for self-regulation to have enforcement powers and for the enforcer to have sufficient resources.

Recommendation: Any self-regulatory framework should be supported by effective enforcement mechanisms. An independent body should be set up to review compliance actions by companies and punish any non-compliance (e.g., with a financial penalty). This enforcement task could also be given to a new or existing governmental body, who might be more neutral and more proactive with enforcement. Funding for this could be obtained through a mandatory levy on the industry (although that is likely beyond the ambit of the current UK self-regulatory efforts).

In addition, I suggest that the forthcoming UK loot box self-regulation explicitly state that it is a 'code of conduct' within the meaning of Regulation 2(1) of the Consumer Protection from Unfair Trading Regulations 2008. This would mean that any failure to comply with verifiable self-regulatory commitments by a signatory company can be subject to criminal prosecution. This combination of the flexibility and industry knowledge of self-regulation with the enforcement powers of the law is ideal.

In summary, I recommend that the self-regulatory framework should:

As to exactly how loot boxes should be regulated more broadly, I personally advocate for a more middle-ground approach to loot box regulation. Doing nothing fails to adequately recognise and address the potential harms, but banning the mechanic is likely going too far and removing the economic benefits of loot boxes (for both companies and players).

Doing nothing fails to address the potential harms, but banning the mechanic is likely going too far and removing the economic benefits of loot boxes

We have suggested that loot boxes can be retained and designed more 'ethically' such that they are less likely to harm: for example, at least guaranteeing that players will receive the rarest 'chase' content after a reasonable, predetermined amount of money has been spent (so-called 'pity mechanics'). The industry may have better ideas and would know whether any such proposals are workable.

Finally, I must emphasise the importance of data sharing. A common complaint against existing loot box research is data quality. I agree, but to do better research, we need industry data to be shared with independent researchers. If the industry does not help with producing more reliable research, surely it would be inequitable for it to criticise the existing research and undermine regulatory efforts.

What I have written here are my current thoughts. My opinion might change and, indeed, it should change as new research developments better inform us. I welcome your views. You can reach me on Twitter @LeonXiaoY (preferably, as the discussion would be public and benefit all) and by email: lexi@itu.dk.