Search for:
The Global Patchwork of Loot Box Regulation

The legal status of loot boxes—virtual containers that award random in-game items for real money—remains one of the most contested issues in global gaming regulation. In Belgium, paid loot boxes have been confirmed as illegal gambling under the country’s gaming law, yet enforcement remains weak. A notable 2025 Belgian case, LS v Apple, confirmed that paid loot boxes constitute illegal gambling, but the question of platform liability for hosting games with illegal loot boxes was referred to the Court of Justice of the European Union. The parties settled before the CJEU could rule, leaving the liability question unresolved and the door open for future claims against app store operators like Apple and Google .

The regulatory landscape varies dramatically across jurisdictions. Australia took a classification-based approach, requiring from September 22, 2024, that games with paid loot boxes be rated at least M (not recommended for under-15s). However, the Australian government failed to inform the industry promptly, and research found that many popular mobile games failed to update their age ratings despite substantively changing their loot box offerings—constituting a criminal offense under federal and state law . In the European Union, the Consumer Protection Cooperation Network published “Key principles on in-game virtual currencies” in March 2025, requiring that an equivalent price in euros be shown for all in-game purchases and prohibiting multiple-currency exchange chains. The European Commission’s July 2025 guidelines on protecting minors under the Digital Services Act effectively demand an under-18 loot box ban by stating minors should not be exposed to loot boxes to avoid “excessive or unwanted spending” .

The practical effect of this fragmented regulation is widespread non-compliance. A University of Bristol study analyzing 2,358 advertisements in the UK and South Korea found that only 8.4% of UK and 7.6% of South Korean ads disclosed loot box presence, and after accounting for visual prominence requirements, true compliance rates were just 2.4% and 4.2% respectively. The researchers concluded that governments should not rely on “toothless industry self-regulation or unenforced laws” to address public health concerns when evidence indicates widespread non-compliance . For game developers, the only safe strategy across jurisdictions is to implement in-flow probability disclosure, avoid set-completion schemes, display fiat prices on purchase buttons, and enforce strict minor spending caps 

Age Verification and Playtime Restrictions in Asia

Asia has become the global laboratory for aggressive regulation of minors’ access to online games, with China, South Korea, and Vietnam implementing some of the world’s most restrictive playtime and verification regimes. China’s measures are the most stringent: since 2021, minors under 18 are only allowed to play video games for one hour on Fridays, Saturdays, Sundays, and public holidays. Enforcement relies on real-name verification, identification documents, and even facial recognition, with devices and applications integrating a “minor mode” that automatically restricts access when time limits are reached. By the end of 2022, approximately 75% of Chinese teenagers reportedly spent less than three hours per week gaming .

South Korea’s approach has evolved significantly. The country once enforced a “Shutdown Law” prohibiting children under 16 from playing online games between midnight and 6 AM, but repealed it in 2021 due to the proliferation of mobile devices that rendered the regulation obsolete. Instead, South Korea shifted to a parental control mechanism that allows parents or guardians to choose and register their children’s playtime. Japan has taken a softer approach, relying on industry self-regulation and warnings during gameplay; the Kagawa Prefecture once suggested that people under 20 should only play for 60 minutes on weekdays and 90 minutes on weekends, though there is no enforcement mechanism. Vietnam is now considering limiting children under 16 to 60 minutes of gaming per day across all games from a single company, down from the current 180 minutes, alongside requirements that social media accounts of under-16s be registered and managed by parents or guardians using a verified Vietnamese mobile phone number .

These restrictions have profound implications for game developers and platform operators. Real-name verification systems require significant technical infrastructure and data collection, raising privacy concerns under laws like the GDPR and Indonesia’s Personal Data Protection Law (PDPL) . The effectiveness of such measures remains debated; Australia’s social media ban for under-16s, implemented in December 2025, saw over 85% of children still using social media three months later, prompting the government to propose doubling maximum fines for non-compliant companies to AUD 99 million . The UK is considering similar restrictions on online games and live streaming services, including limiting app usage time and implementing online curfews. For the gaming industry, the trend is unmistakable: age verification and playtime controls are becoming mandatory compliance requirements, not optional safeguards

Indonesia’s Digital Gambling Crackdown and Its Implications

Indonesia has taken an aggressive stance against online gambling, a category that increasingly intersects with online gaming platforms and prediction markets. In May 2026, the Ministry of Communication and Digital Affairs blocked access to Polymarket, a blockchain-based prediction market, after it facilitated betting on whether President Prabowo Subianto would leave office before the end of his term. Alexander Sabar, the ministry’s director general of digital space supervision, stated unequivocally: “The government will not provide space for any form of online gambling in Indonesia.” Polymarket’s activities were classified as containing “betting and speculation over events that are inconclusive,” thereby violating Indonesian law .

The legal consequences extend far beyond platform blocking. Under Indonesia’s National Criminal Code (KUHP), which took effect in 2026, Article 426 governs those who facilitate gambling—including operators and promoters—with penalties of up to nine years in prison or fines up to Rp2 billion (approximately USD 125,000). Article 427 addresses players themselves, threatening up to four years imprisonment or fines up to Rp50 million. Additionally, Article 45(3) of the ITE Law (Law No. 1 of 2024) targets those who distribute, transmit, or make accessible electronic information containing gambling content, with penalties reaching 10 years imprisonment or fines up to Rp10 billion .

For the online gaming industry, Indonesia’s crackdown creates a critical compliance consideration: the line between gaming and gambling is being actively policed. Game mechanics that involve monetary betting on uncertain outcomes, even within a “game” framework, risk classification as illegal gambling. The government has also emphasized child protection obligations, with Commission I of the House of Representatives reminding online game developers of their duties under ITE Law Article 16A to protect children from negative content, and under Ministry of Communication and Informatics Regulation No. 2 of 2024 on Game Classification, which mandates age-based classification at ages 3, 7, 13, 15, and 18, with particular attention to violent content . The message is clear: game developers operating in Indonesia must ensure that monetization mechanics do not cross into gambling territory, and must implement robust age-gating and content moderation systems.