The Great Loot Box Crackdown: Where Paid Random Rewards Are Banned, Rated or Next

In November 2017, an EA community manager tried to explain on Reddit why some Star Wars Battlefront II heroes were locked behind long grinds and paid loot crates. The reply became the most downvoted comment in Reddit history, with around 667,000 downvotes. Governments noticed the anger, and the loot box has been in regulators' sights ever since.

Nine years later, the rules are finally getting serious. Brazil now bars paid loot boxes for anyone under 18. PEGI, Europe's age-rating body, has made paid random items an automatic PEGI 16 from June 2026. And this week, a leaked draft of the EU's Digital Fairness Act showed Brussels planning a ban on paid random rewards for minors across all 27 member states.

Here is where things stand, country by country.

What counts as a loot box?

A loot box is any paid item in a game whose contents are random: card packs in EA Sports FC, weapon cases in Counter-Strike 2, character banners in gacha games like Genshin Impact. You pay real money, directly or through a virtual currency, and you do not know what you will get.

The legal question is whether that is gambling. Classic gambling law usually needs three things: you pay, the result depends on chance, and you can win a prize of money's worth. The fight has always been about the third part. Publishers argue that a digital skin you cannot cash out is not a prize. Regulators increasingly say that does not matter, especially for children.

Belgium and the Netherlands: the first to act

Belgium went first. In 2018, its Gaming Commission concluded that paid loot boxes in several major games counted as illegal gambling under Belgian law. Publishers changed their games for the Belgian market: EA stopped selling FIFA points for packs there, and Nintendo withdrew two mobile games from the country rather than redesign them.

The Netherlands took a similar position the same year, and its gambling authority later fined EA €10 million over FIFA packs. That case shows how hard the law can be: in 2022, the Dutch Council of State, the country's highest administrative court, overturned the penalty, finding that packs were part of a larger game of skill rather than a standalone game of chance.

The lesson from both countries was that old gambling laws can catch loot boxes, but only awkwardly, and enforcement has been patchy. That is why the next wave of rules has come through ratings and consumer law instead.

Ratings boards step in

The quietest change may end up the most powerful, because ratings decide where games can be sold and who can buy them.

• Australia went first with hard rules. Since September 22, 2024, games with paid loot boxes are classified at least M (not recommended for under-15s), and games with simulated gambling are R18+, restricted to adults.
• PEGI, used in most of Europe, made a bigger move in 2026. For games submitted from June 2026, paid random items get PEGI 16 by default. Social casino games get PEGI 18, as do games with NFT or blockchain trading. Time-limited offers and battle passes can push a game to PEGI 12. Existing games are not re-rated, so the effect will build slowly.
• Germany's USK added similar risk criteria in 2023, and PEGI's new rules line up with them.
• In North America, the ESRB has only labels, not age changes: an "In-Game Purchases" notice since 2018, and "In-Game Purchases (Includes Random Items)" since April 2020.

Brazil: the hardest line

Brazil has gone further than anyone. Its Digital Statute of Children and Adolescents (often called the ECA Digital), Law 15.211, was signed by President Lula da Silva on September 17, 2025, and came into force in March 2026. Among many child-safety rules, it treats paid loot boxes as a form of gambling and bars them for minors.

The effects were immediate and visible. Riot Games restricted under-18 players in Brazil and moved to age verification for logins, using a tax ID, facial scanning or a card or document. Its games are now rated 18+ in the country. Other big multiplayer games with paid random items face the same choice: redesign for Brazilian minors, verify ages, or keep children out.

The United States: no ban, but big settlements

There is no federal loot box law in the US. Instead, the Federal Trade Commission has used consumer protection and children's privacy law, with large settlements.

In January 2025, Genshin Impact publisher HoYoverse agreed to pay $20 million and to stop selling loot boxes to under-16s without parental consent. The FTC accused it of misleading players about the odds and real cost of its prizes. Two years earlier, Epic Games agreed to pay $520 million over Fortnite, including $245 million in refunds for so-called dark patterns; we cover that case in our FTC and Fortnite explainer.

Europe's big move: the Digital Fairness Act

The biggest change may come from Brussels. In March 2025, the EU's network of consumer protection authorities (the CPC Network) published key principles on in-game virtual currencies, saying prices should be shown clearly in real money. On October 15, 2026, the network launched an action involving nine video game companies, looking at loot boxes, dark patterns and marketing to children, plus a separate investigation into one company's virtual currency sales and parental controls. The companies were not named.

Then came the Digital Fairness Act. A leaked draft reported on November 10, 2026, the day before the European Commission's planned presentation, included:

• a ban on offering paid-for variable reward systems (loot boxes) to minors,
• the same ban for pay-to-win and pay-to-progress mechanics aimed at minors,
• a requirement to show the real-money price of anything bought with virtual currency,
• paid virtual currency switched off by default in games aimed at minors, unless a parent turns it on,
• odds disclosure and an off switch for loot boxes for adults.

The draft treats a game as aimed at minors in certain cases, for example when its PEGI rating suits under-18s or minors make up at least 25% of its audience. Video Games Europe and the European Game Developers Federation already dispute how the consumer network classifies in-game currencies. The final law still has to be negotiated with EU governments and the European Parliament, which usually takes years.

By the numbers

• 2018: Belgium's Gaming Commission rules paid loot boxes are illegal gambling
• September 22, 2024: Australia's M and R18+ rules take effect
• $20 million: HoYoverse's FTC settlement, January 2025
• March 2026: Brazil's ECA Digital comes into force
• June 2026: PEGI 16 becomes the default for paid random items
• 9: game companies in the EU consumer network's October 2026 action
• 25%: share of minors in a game's audience that could trigger the draft EU rules

What to watch

The direction is clear even if the details are not. Rules are moving away from asking "is this gambling?" and towards asking "is this fair to children?". That shift helps regulators, because consumer and child-safety law is easier to apply than gambling law.

For players, expect more age gates, more parental controls, more games that show prices in real money, and possibly different versions of the same game in different countries. For publishers, the cost is in redesign and verification, and in some cases in the revenue that loot boxes bring in.

WGC's take: the strongest rules so far focus on protecting minors rather than banning randomness for adults. That seems like the right balance. The hard part will be enforcing it without forcing every player to scan their face to open a game.

Watch for the official Digital Fairness Act text, how quickly PEGI 16 labels appear on new releases, and whether other countries copy Brazil.