2.1 Loot boxes may abuse irrational biases

In addition to loot boxes’ link with problem gambling and their potential abuse of the variable-ratio schedule of reinforcement, loot boxes may also be predatory because they present and abuse experimentally demonstrable decision-making cognitive biases and fallacies of the player,⁴¹ and thereby cause players to make irrational, ‘maladaptive purchasing decisions’.⁴² It is arguable that, when influenced and misled by decision-making biases, the player's ‘choice’ to purchase and open loot boxes is no longer free, voluntary and informed. This is synonymous with how gamblers are influenced by fallacies and decision-making heuristics,⁴³ which simplify judgement but may lead to ‘severe and systematic errors’.⁴⁴ For example, ignoring any house rules, the popular game of 38-pocket American roulette has an expected value of − 5.26%, thus a bet of $1 is expected to, in the long-term, on average, lose $0.0526.⁴⁵ Playing roulette in these circumstances is irrational. Nonetheless, gamblers continue willingly to make the decision of betting on roulette and participating in other gambling games, and losing their money because they are influenced by decision-making fallacies which cause them to make irrational decisions.⁴⁶

Irrational biases, previously identified to arise in relation to gambling, may also be abused by game companies to cause players to purchase more loot boxes than they otherwise would have. One such bias has been identified as ‘entrapment’, whereby ‘a decision-maker continues to expend resources at least in part to justify previous, hitherto unfulfilled, expenditures’.⁴⁷ For example, ‘when the gambler wishes to recoup losses he has already incurred and therefore decides to roll the dice “just one more time”’.⁴⁸ Similarly, the loot box-purchasing player may wish to justify the losses they have incurred in their previous failed loot box openings (when they did not obtain the rewards they wanted) by buying even more loot boxes in the hope of finally obtaining their desired valuable rewards; therefore, entrapment may deceptively cause the player to make ‘maladaptive’ loot box purchasing decisions.⁴⁹

Another such bias is the ‘gambler's fallacy’.⁵⁰ For example, ‘[a]fter observing a long run of red on the roulette wheel, most people erroneously believe that black is now due …’.⁵¹ Such gamblers are failing to rationally recognize independent random events as independent,⁵² and are instead irrationally and erroneously interrelating them.⁵³ The gambler's fallacy could apply to the purchasing and opening of loot boxes because players may erroneously interrelate each independent loot box openings and believe that they would gain a better chance of ‘winning’ and opening valuable content after successively ‘losing’ and failing to obtain rare items. Accordingly, the gambler's fallacy is capable of misleading the player into purchasing more loot boxes immediately after they had just failed to obtain rare items from a prior batch of loot box purchases, which would result in the player spending more money on loot boxes than they had previously intended to or budgeted for. It is particularly concerning that some games manipulate the probabilities of obtaining rarer rewards according to the player's spending behaviour: ‘pity-timer’ mechanics increase the probabilities of acquiring rarer rewards, or guarantee their acquisition, after the player has failed to obtain the rarer rewards in prior attempts.⁵⁴ These pity-timers arguably reinforce the gambler's fallacy by literally making it true with regards to certain, but not all, loot boxes: players may erroneously assume that all loot boxes have an in-built pity-timer mechanic.

Pity-timers must record the player's purchasing behaviour (e.g., what rewards they received on previous occasions) and use this data in order to automatically determine when to increase probabilities. A review of patents granted to video game companies revealed that the industry has at least considered, if not already implemented, using players’ behavioural tracking data that they have collected and analysed (e.g., what types of items a particular player likes to purchase; how much remaining in-game balance they have; and what items they already possess) to automatically adjust aspects of the in-game product offerings (e.g., pricing and availability of certain types of items).⁵⁵ The player's data are being used by the video game companies to maximize commercial gain, which arguably means that the player's data are being processed in a way that is not in their best interest, and may potentially be ‘exploitative’.⁵⁶ Video game companies may be required by data protection legislation to obtain consent from the player before using their data in such manners. However, it remains arguable whether the data collected would be ‘personal data’. The use of children's data for such purposes without consent (e.g., providing ‘birthday offers’ by misusing children's personal data collected for age verification purposes⁵⁷) would not be in the children's best interests and may be a contravention of data protection legislation and codes of practice, such as the UK Information Commissioner's Office's Age Appropriate Design Code.⁵⁸

The third irrational bias that loot boxes may abuse is the ‘near-miss effect’.⁵⁹ A ‘near-miss’ occurs when ‘an unsuccessful outcome is proximal to the designated win, such as when a chosen horse finishes in second place or when two cherries are displayed on the slot machine payline’.⁶⁰ The near-miss effect refers to how the presentation of a losing situation as a near-miss encourages players to make further attempts.⁶¹ Clark et al. argued that ‘the recruitment of win-related regions [of the brain] during near-miss outcomes underlies their ability to promote gambling behavior’.⁶² Loot box openings are often presented with explosive visual animation and celebratory audio effects regardless of the value of the rewards obtained. Arguably, loot boxes are designed to build anticipation in the player similar to gambling,⁶³ and to disappoint that player in order to expose them to a near-miss so as to encourage further purchases.

Reid suggested that people inexperienced with gambling may be more prone to the near-miss effect.⁶⁴ This is particularly worrying and relevant to the potential regulation of loot boxes because many players engaging with loot boxes do not necessarily realize that they are gambling when they play video games. Indeed, 16 regional gambling regulators⁶⁵ have expressed their concerns with the risks posed by ‘the blurring of lines between gambling and … video gaming’.⁶⁶ Loot boxes are randomized, not ‘innocent’ and may represent ‘games of chance’, but they are presented (or, if viewed more cynically, hidden) within video games which are generally perceived as ‘games of skill’.⁶⁷ The conflation of these two activities, referred to as the gaming-gambling convergence,⁶⁸ is socially worrying and a ‘clear public concern’ because consumers may be unable to differentiate between the video game itself and (quasi-)gambling elements incorporated into it (e.g., loot boxes), such that, for example, children may end up gambling unknowingly with ‘money intended for computer game products’ given to them to spend by their similarly unknowing parents.⁶⁹

2.2 Call for game companies to release loot box spending data

Actual loot box purchasing data collected and possessed by game companies⁷⁰ are required to conduct comprehensive, empirical investigations on the relationship between loot boxes and gambling; to confirm if the additional introduction of any irrational biases outlined above induces maladaptive loot box purchases; and to assess the potential harms of loot boxes in general. However, currently, such crucial data have not been made available by game companies for independent research. Although this failure to release data can be appreciated from a commercial standpoint, this position does not treat consumers fairly, and is socially irresponsible and arguably unethical. Although such data may be commercially sensitive as they may reveal the amount of total sales and active user numbers, game companies should proactively collaborate with researchers to find appropriate ways to desensitize and anonymize the data released.⁷¹ For example, the limited release of the anonymized spending data of 1000 random users would reveal a very limited amount of business sensitive information, but would still assist empirical research significantly. The release of such data may also give rise to data protection concerns; however, an update to the privacy policy and appropriate anonymization of data should resolve any such issues. Most players would likely welcome such research even knowing that their data would be used.

The applicability and effectiveness of industry data to research were demonstrated by Zendle who took advantage of the removal of paid loot boxes from Heroes of the Storm in March 2019⁷² and conducted a survey which demonstrated that ‘When loot boxes were removed from Heroes of the Storm, problem gamblers spent significantly less money in-game’.⁷³ However, Zendle's conclusion was only tentative due to a lack of verifiable datasets: Zendle was only able to rely on unverifiable, self-reported data from players. Only with the release of industry data by game companies for further independent empirical research could the many questions surrounding the potential harms of loot boxes be fully assessed and answered.⁷⁴ Currently, there is an ‘information asymmetry’ between elements of the video game industry that implement paid loot boxes and the public: these companies are in possession of data (if not also the results) as to the potential harms of loot boxes, but the public and regulators are forced by these companies to have access to little, if any, information. This information asymmetry renders the current relationship between these companies and the public arguably inequitable, and renders the current relationship between these companies and regulators ‘evasive’ and disingenuous.⁷⁵

2.3 The industry is divided on the ethics of implementing loot boxes

It ought to be recognized that different video game companies hold divergent perspectives on the continued implementation of loot boxes and the ethical implications of doing so, in light of potential harms to players. When giving evidence to the Digital, Culture, Media and Sport Committee of the UK House of Commons (DCMS Committee), Kerry Hopkins, Vice President for Legal at Electronics Arts, refused to recognize paid loot boxes implemented in FIFA Ultimate Team as paid ‘loot boxes’ and characterized them as ‘quite ethical and quite fun’.⁷⁶ In contrast, Epic Games has changed the design of paid loot boxes in Fortnite by implementing ‘X-Ray Llamas’, whose rewards are revealed to the player prior to purchase: the player will know exactly what they will receive before they spend money and thus are allowed to make a more informed purchasing decision.⁷⁷ These X-Ray Llamas’ content is still randomized automatically on a daily basis before being shown to the player, so if the player does not like the randomized content on a particular day, they can wait a number of days for the content to be eventually changed to rewards they do like before purchasing. This effectively removed randomization from the X-Ray Llamas’ purchasing process, but not from the mechanic itself. This arguably ensures that they are still ‘quite fun’ as the content that the player can choose to purchase (or not) is still randomized on a daily basis and may be a nice, unexpected surprise for the player to look forward to, but also more ‘ethical’ because the change avoids requiring players to blindly pay for randomized content that they do not want. This change effectively rendered the product no longer a ‘loot box’ per se and more akin to purchasable additional game content, i.e., ‘DLCs’, because the player knows exactly what they are buying. In contrast, Blizzard Entertainment appears indecisive on the issue as it has removed paid loot boxes from Heroes of the Storm,⁷⁸ but continues to sell them in Hearthstone (2014, Blizzard Entertainment). Other game companies never implemented loot boxes in their games in the first place and have no plans to do so in the future: Metronomik, an indie developer, has recognized the ethical issues relating to the implementation of paid loot boxes and refused to implement them despite potential commercial loss.⁷⁹ Given the current notoriety of and aversion to paid loot boxes amongst video game players, it is arguable whether the decision not to implement loot boxes by a particular game company could be seen as an ‘ethical’ decision that is capable of being appreciated by players and may be promoted by the media,⁸⁰ and would in turn drive up sales of the game and be a better commercial decision in the long-term than implementing paid loot boxes.

Although the industry does not hold a uniform position on whether paid loot boxes are ethical,⁸¹ the industry's failure to release data for independent research has been universal. For companies that are continuing to implement paid loot boxes in video games, their failure to cooperate with regulators and researchers by providing loot box spending data is socially irresponsible and arguably unethical, but may be excused for commercial reasons, given that the area remains unregulated in most countries. However, companies that have already stopped implementing paid loot boxes (perhaps in recognition of the ethical implications), but are still in possession of players’ past loot box spending data from when the companies did sell loot boxes, would not necessarily be negatively affected by the prospective regulation of loot boxes and may be in a better position to release these data for independent research. In fact, the release of this data may benefit socially responsible companies immediately through positive publicity, and also long-term if prospective regulation of loot boxes would divert spending on loot boxes to other more ethical video gaming monetization methods. However, no such release has been forthcoming. Socially responsible game companies that are in a position to gain (or at least in a position not to lose) from the release of loot box spending data should publish it and support independent research.⁸²

2.4 Pre-emptive regulation justified by the precautionary principle?

The DCMS Committee, in its recent inquiry report, argued that the ‘precautionary principle’ (that ‘the lack of scientific certainty cannot justify [regulatory] inactivity in cases of high risk’⁸³) should apply to justify the pre-emptive regulation of loot boxes, because game companies cannot prove that the monetization schemes which they have designed and implemented, such as loot boxes, are not harmful.⁸⁴ The Committee went above and beyond only calling for game companies to release industry data for research into the extent of the potential harm of loot boxes in order to better inform potential regulation: the Committee argued that it is no longer necessary for academics or regulators to prove that loot boxes represent a predatory monetization method and are harmful in order to justify regulation, and that it is now instead the responsibility of the game companies implementing these monetization methods to prove that loot boxes are not predatory and harmful in order to justify the continued lack of regulation. The DCMS Committee's assertion is worrying in that negative proof of loot boxes not being harmful is impossible to obtain from a scientific perspective: it is literally asking the industry to provide the impossible.⁸⁵ A more reasonable approach would be to ask for evidence that harm is unlikely or minimal.

The DCMS Committee recommended that UK gambling law should be amended in due course after consultation to regulate paid loot boxes,⁸⁶ whilst, only a few months later, the Gambling Industry Committee of the UK House of Lords recommended the immediate regulation of paid loot boxes as gambling by executive regulations without waiting for further consultation.⁸⁷ These recommendations teeter on the edge of overregulation and mirror the position taken by the Belgian gambling regulator (that all paid loot boxes constitute gambling regardless of whether their rewards are worth real-world money, and that consumers’ access to all loot boxes would be prohibited, unless they are appropriately licensed as regulated gambling⁸⁸), which has led to the complete removal of certain games from the Belgian market because operating them in that country was no longer commercially viable, e.g., Animal Crossing: Pocket Camp (2017, Nintendo & NDcube),⁸⁹ and therefore deprived consumers of the opportunity to play certain games. An overly paternalistic outright ban of loot boxes also unduly restricts the industry's creative output and economic potential⁹⁰ (although forcing game companies to stop defaulting to monetizing with loot boxes and instead invent and experiment with other more ethical monetization methods may revitalize creativity). Both game companies and players lose out when loot boxes are overregulated. These comparatively drastic regulatory positions that have been recommended (a version of which has been adopted in Belgium⁹¹) suggest that, if the video game industry continues to be uncooperative when working with independent researchers and regulators, overregulation negatively affecting the industry creatively and commercially may be the inevitable result. The industry should be well-advised to act responsibly now to avoid this undesirable yet potentially imminent outcome of overregulation.

In the Author's opinion, certain implementations of loot boxes are defensible. The most prominent problem with paid loot boxes is potential overspending.⁹² A loot box implementation released monthly whose rewards are all guaranteed to be obtained if the maximum capped spending of £30 is reached by the player is defensible because the player cannot overspend. Similarly, a paid loot box mechanic that can simultaneously be relatively easily accessed by performing non-paid in-game actions, such as logging-in to the game or defeating enemies, would also make the implementation more defensible. Indeed, if the rewards of the loot box do not influence the player's in-game powers (and perhaps only make cosmetic changes), and would not advantage the player when compared to other players or a hypothetical version of themself who did not purchase loot boxes, then this implementation also becomes more defensible. These changes in loot box implementation which try to prevent overspending and avoid placing undue pressures on the consumer to spend money (such as when a loot box is made available for purchase only for a limited time) can be referred to as ‘ethical game design’.⁹³ Therefore, in the Author's opinion, the consumer protection issue relating to loot boxes needs not necessarily be solved by the outright ban of loot boxes, which may negatively affect game companies financially and deny players access to certain video game content, and which may not be the best solution to the problem for all parties involved. Accordingly, the prohibitive gambling law approach to regulating loot boxes should be critiqued.

3.1 The need for a universal, international standard of loot box regulation

Cerulli-Harms et al. have argued that the European Single Market is being ‘fragmented’ and negatively impacted by various European national gambling regulators taking divergent regulatory approaches to loot boxes because certain games can no longer be marketed in countries like Belgium and the Netherlands.¹¹² This would likely lead to increased compliance costs, as different versions of the same video game may need to be produced to comply with the laws of various countries. Cerulli-Harms et al. suggested that a common European Union regulatory approach would be able to ensure consumer protection across the Single Market.¹¹³

The potential harms of paid loot boxes do not appear to be related to whether their prizes are worth real-world money; paid loot boxes whose rewards are not transferable and are not worth real-world money appear to be just as potentially harmful.¹¹⁴ When a certain implementation of loot boxes constitutes gambling in a certain jurisdiction, then it should be regulated as gambling in that jurisdiction. Unfortunately, not all implementations of paid loot boxes fall under the definitions of gambling in all jurisdictions. This means that consumers are protected only if they happen to live in a country whose existing gambling law covers both paid loot box types. Presently, a universal, international standard of consumer protection in relation to loot boxes is lacking. Indeed, currently, only Belgian consumers are fully protected, as all paid loot boxes have been removed. In the Netherlands, game companies complied by only removing paid loot box reward transfer features (thus ensuring that loot box rewards are not worth real-world money), without removing paid loot boxes themselves.¹¹⁵ Dutch consumers remain exposed to the potential harms of paid loot boxes whose rewards are not worth real-world money. The contrast in compliance by 2K Games in the Netherlands and Belgium is particularly telling of the difference in national regulatory positions.¹¹⁶ Players in other countries, such as the UK, are exposed to even more potential harms because of non-enforcement of the law. Consumer protection is not ensured universally as it should be.

All paid loot boxes should be regulated regardless of whether their rewards are worth real-world money, but not necessarily as gambling per se. Multiple papers in the legal literature and gambling regulators have attempted to fit the regulation of loot boxes into the existing gambling law framework of various jurisdictions¹¹⁷ (e.g., arguing that certain implementations should constitute illegal lottery gambling under Californian law¹¹⁸). Such assessments often fail in relation to paid loot boxes whose rewards are not worth real-world money because the ‘prize’ element cannot be satisfied. However, in the Author's opinion, the inability of existing gambling law in many jurisdictions to include paid loot boxes whose rewards are not worth real-world money should be accepted. Hasty amendments to gambling law that extends existing definitions of gambling to cover such implementations of loot boxes, as for example recommended by the DCMS Committee in the UK,¹¹⁹ are not necessarily well-advised: expanding the legal concept of what may constitute ‘prizes,’ specifically the meaning of ‘money's worth’ in the UK to include perceived non-monetary value, ostensibly only for the purpose of regulating loot boxes, may potentially unfairly render other harmless activities, and other activities which are unlikely to be harmful, ‘gambling’ in the eyes of the law and unduly restrict people's ability to engage with them. Additionally, regulating loot boxes as gambling would face the same difficulties encountered by the regulation of online gambling in general, including complications with enforcement when consumers gamble with overseas service providers.¹²⁰

The regulate-loot-boxes-as-gambling approach was an expedient first step to quickly address potential loot boxes harms. However, the regulation of loot boxes should also be approached from a more holistic consumer protection perspective, in addition to applying existing gambling law, in order to provide more comprehensive consumer protection.¹²¹ Ethical game design measures that seek to minimize harms include, amongst others: disclosing the probabilities of obtaining potential rewards; establishing maximum spending limits; and disabling ‘cash-out’ features.¹²² These three measures have been partially implemented in certain countries and as self-regulation by the industry in other jurisdictions. The practicality of regulating through and enforcing these measures is critiqued, and recommendations as to how to improve their implementation in the future are made.

4.1 Disclosure of the probabilities of obtaining potential rewards

The PRC did not approach the regulation of loot boxes from a gambling perspective: instead, video gaming service providers in the PRC are required to disclose the probabilities of obtaining potential rewards.¹²³ The video game industry has also generally been accepting of this measure as a self-regulation solution in other jurisdictions.¹²⁴ For example, the Entertainment Software Association (ESA) announced that the video game industry is ‘committing’ to ‘further inform[ing] consumer purchases’: the three leading hardware providers, Sony; Microsoft and Nintendo, ‘will require paid loot boxes in games developed for their platforms to disclose information on the relative rarity or probability of obtaining randomized virtual items’.¹²⁵ The ESA's proposal would have a global reach and will likely better protect many consumers across the world. The ESA also identified that several major game publishers already disclose such information in their games.¹²⁶ Apple and Google both also require probability disclosures for games published on their respective app stores which contain paid loot boxes.¹²⁷

Probability disclosures do not restrict consumer choice, but only seek to better inform it. Similar disclosure requirements are imposed in regards to gambling in other jurisdictions ‘to enable the customer to make an informed decision about his or her chances of winning’.¹²⁸ However, when discretion is given to gambling operators as to the amount; format and location of how such information is to be presented to consumers, gambling operators have arguably chosen suboptimal methods in order to misguide consumers.¹²⁹ In the PRC, significant discretion is allowed to game companies as to where the probabilities should be disclosed:¹³⁰ disclosures made either in-game on the loot box purchase page or the game's official website are both compliant with the law.¹³¹ However, arguably, a disclosure made in-game on the loot box's purchase page would appear more prominently to the consumer than a disclosure made on an official website, whose existence the player may not even be aware of. A disclosure made in-game would accordingly arguably be more likely to be read, and therefore be more effective at informing consumers and preventing overspending.

The PRC law also did not set out requirements as to how accessible the disclosures ought to be. For example, the disclosure in certain games can only be accessed if the player interacts with a tiny question mark hidden away in a corner of the loot box purchase screen; for other games, the disclosure can only be accessed after the player follows multiple hyperlinks on the official website.¹³² The disclosure could readily be provided more prominently and be more easily accessible, but many game companies have chosen not to provide this information in the most effective way. Indeed, the probability disclosure could be an automatic pop-up (with audio effects, such as an alarm sound) that interrupts purchase when the player attempts to buy loot boxes. Such an intrusive disclosure may be more effective at alerting the consumers as to the probabilities of obtaining rewards and preventing overspending. Apple, Google and the ESA have similarly not specified where the probabilities should be disclosed and how accessible the disclosure should be. The PRC law, and existing and prospective self-regulation, can be improved: specific requirements as to how, when and where probability disclosures should be made may ensure that disclosures are easy to access and understand, and are made at similar locations in all games, thus ensuring players playing multiple games and players playing a new game would readily be able to find the disclosures, and therefore be more effective at informing consumer choice and preventing overspending.

Disclosure rate of loot box probabilities has been assessed to be high in the PRC: 95.6% of the highest-grossing iPhone games containing loot boxes disclosed probabilities.¹³³ However, the probabilities were not disclosed in the most prominent and accessible locations, and failed to communicate to consumers in the most effective ways.¹³⁴ Further, a number of the disclosures made failed to provide sufficient detail as required by the PRC law, and some of the probabilities disclosed were evidently inaccurate (e.g., probabilities not summing to 100%).¹³⁵ The compliance rate of the PRC legal obligation is therefore lower than the disclosure rate. The compliance rate of Apple's and Google's existing self-regulations, and the discretionary methods of compliance that game companies have chosen to adopt in relation to these self-regulations have not been assessed empirically in a comparative manner. This comparison between the PRC and another country, where only the self-regulations apply, would provide insight as to whether legal intervention was necessary or self-regulation alone is sufficient. Future research should examine these aspects to better inform future legal regulation and/or self-regulation.

A flaw with probability disclosures is that players cannot verify and thus be confident that the probabilities disclosed by the game companies are accurate. This is especially true in relation to voluntary disclosures and disclosures which are not scrutinized through some form of enforcement. Enforcement of the legal and self-regulatory requirements is necessary to ensure consumer confidence. The PRC law specified that proceeds generated through contraventions of the probability disclosure requirements would be confiscated and that the video game company would be fined between ¥10,000 to ¥30,000 Renminbi (approximately £7,189 to £21,567).¹³⁶ However, this penalty may no longer be effective because the Interim Administrative Measures for Online Games have since been abolished in July 2019.¹³⁷ It is unclear how the PRC law is currently being enforced, if at all.¹³⁸ Compliance with Apple's and Google's existing self-regulations appears to be based purely on trust in the self-declarations made by video game companies that they have complied with the platform providers’ policies,¹³⁹ and the probabilities disclosed by game companies are not scrutinized by either platform provider. In contrast, the South Korean self-regulation system, organized by K-GAMES (Korea Association of Game Industry), which provides a certification system that ‘incentivizes’ disclosure, has an enforcement system as set out in the Enforcement Rules of Self-regulation Code for Healthy Game Culture.¹⁴⁰ Article 11 explains that the compliance of the most popular games on each platform will be monitored every month.¹⁴¹ Article 12 details that: for the first instance of identified non-compliance, the game company will be advised as to how it can comply; for the second offence, the company will be warned that it is non-compliant; and for the third offence, the company's violation will be identified and published to inform consumers and it will also be decertified.¹⁴² K-GAMES’ monthly ‘name and shame’ admirably does not collude with influential game companies and does not discriminate against smaller game companies by only targeting them: Dota 2 (2013, Valve Corporation), one of the most popular MOBA games developed and published by Valve, a leading international video game company that developed and operates Steam, is prominently published at the top of the ‘name and shame’ list for repeated non-compliance.¹⁴³

K-GAMES’ self-regulatory system is exemplary: Apple's and Google's existing self-regulations, and the ESA's prospective self-regulation should emulate K-GAMES’ enforcement system by ensuring that the probability disclosures made by companies are accurate and can be trusted by consumers. However, it must be noted that even with a robust self-regulatory system, such as K-GAMES’, some games remain non-compliant but continue to be popular with consumers. For example, Valve's Dota 2 has been declared non-compliant 19 times as of June 2020 by K-GAMES without inspiring any change to Dota 2's non-compliance and Valve's non-cooperation,¹⁴⁴ which means that consumers remain at risk of potential harm. Indeed, self-regulation may not ultimately be effective as measures remain voluntary and may be ignored. Legal sanctions, such as fines (as originally provided for by the PRC law) and injunctions against the continued non-compliant operation of such games, may be the only reliable solution in such cases to guarantee compliance and consumer protection. A combination of the binding force of law and a robust enforcement regime may be a satisfactory step towards ameliorating the potential harms of loot boxes by responsibly informing consumers of the (un)likelihood of obtaining specific rare rewards and the potential harms of paid loot boxes.

4.2 Maximum spending limits

As identified above, the most concerning issue with loot boxes is overspending.¹⁴⁵ More ethically designed implementations of loot boxes are defensible and need not necessarily be prohibited. The probability disclosure measure discussed above may assist players in making more informed decisions and therefore becoming less likely to overspend. However, it is possible to be more interventionist by literally preventing overspending by setting a maximum limit on the amount of money players are allowed to spend on loot boxes. In gambling contexts, ‘pre-commitment limit-setting involves users specifying (voluntarily or compulsorily), before engaging in gambling, the maximum they would like to spend. Once reached, this limit triggers a reminder message and a cooling-off period in which the player is unable to gamble further’.¹⁴⁶ Pre-commitment limit-setting is known to have a positive, if subtle, effect on reducing and controlling problem gambling:¹⁴⁷ although it may not necessarily be the monetary limit itself that curtails the gambling behaviour, but rather the ‘break in play’, i.e., that the gambler is forced to stop playing, cool off, step back and think rationally, which is effective.¹⁴⁸

The most difficult issue with setting a maximum spending limit is deciding how much this limit should be, as regulators would need to make an assessment as to what is a fair and equitable amount of money to be spent on a game for a specific period of time, and arguably arbitrarily impose this on all players regardless of their individual, personal circumstances.¹⁴⁹ Drummond, Sauer and Hall recommended a monthly cap of US$50 (approximately £36) on loot boxes to ensure the protection of players who would be classified as problem gamblers (i.e., those who would significantly overspend on loot boxes).¹⁵⁰ US$50 is not necessarily the most optimal amount of money to spend on loot boxes for every individual consumer: indeed, US$50 may be quite a lot more money than many players, especially children, would be willing or allowed to spend on a game per month, but US$50 may also be much less than what an affluent player may want to spend monthly to financially support their favourite game developer. However, a monthly limit of US$50 may be appropriate because it is close to how much a player would be expected to pay when purchasing a video game outright ‘as a product’¹⁵¹ (it is quite reasonable for such a game to be purchased, and for such an amount of money to be spent on video gaming, every month); and because monetizing with loot boxes, in a non-predatory manner, and selling game titles outright are equally valid monetization methods that game companies may adopt and therefore should be treated equally by the law. A relevant point to consider is that the law may be able to disincentivize the implementation of loot boxes by decreasing the maximum monthly spending limit on loot boxes to be lower than the average price of a game software to discourage game companies from monetizing with loot boxes, as they would be forced to only be able to generate less revenue per player if they choose to monetize with loot boxes, rather than otherwise.

Monthly maximum spending limits on online video games generally (but not limits on loot box spending specifically) have been imposed in South Korea and the PRC against players. These laws provide comparative insights. The South Korean monthly limits were previously imposed on ‘juveniles’ under the age of 19 at ₩70,000 South Korean Won (approximately £44) and on adults at ₩500,000 South Korean Won (approximately £316). The adult limit was set arbitrarily high and would only have been capable of preventing particularly extreme overspending. Notably, both South Korean limits ‘have since been repealed citing unfair economic discrimination against the video game industry as compared to other creative industries’.¹⁵² The PRC had imposed an impractical and unreasonable monthly limit of ¥10 Renminbi (approximately £1.10) on minors under the age of 18 in March 2011.¹⁵³ This limit has been updated in November 2019: minors under the age of 8 are prohibited from spending any money at all; minors aged between 8 and 16 are allowed to spend up to ¥200 Renminbi (approximately £22); and minors aged between 16 and 18 are allowed to spend ¥400 Renminbi (approximately £44).¹⁵⁴ These updated limits are more realistic; however, their regulatory effects remain to be assessed.

Enforcement of maximum spending limits on video games may prove difficult. In the gambling context, pre-commitment maximum spending limits have proven difficult to impose compulsorily: gamblers may be able to switch to another service provider to evade the limit and gamble more (although this issue may be avoided if providers share information between each other).¹⁵⁵ Such enforcement difficulties are similarly present in the video gaming context. Both South Korea and the PRC are countries that have universal national identification card systems that advantageously allow for the verification of the real-life identity of all online players (i.e., all user accounts must belong to a verified real-life identity), which then allows for age verification and, potentially, the enforcement of maximum spending limits against those players across multiple user accounts; games; video gaming service providers; and hardware platforms. However, identity verification regulations have been documented to have been easily bypassed by minors in both South Korea and in the PRC through using the personal identification documents of others, such as the minor's parents’ or the internet café operators’.¹⁵⁶

In countries without universal identification systems, e.g., the UK,¹⁵⁷ these limits are even more difficult to impose against individuals.¹⁵⁸ The alternative imposition of these limits against only the player's user account, rather than the player's real-life identity, can be circumvented through the creation and use of multiple accounts for the same game, or by simply switching to playing another game. However, unlike in gambling contexts where the gambling game's game design cannot realistically be changed, the multiple account issue can be resolved through ethical game design by heavily disincentivizing the player for possessing multiple accounts, e.g., progression through the game requires virtual items that cannot be directly bought using real-world money or transferred between accounts, and must be earned through gameplay, thus effectively forcing players to only be able to invest time in and play on one account. Admittedly, this requires the unlikely voluntary commitment to this measure from the entire video game industry (because such game design would be commercially detrimental: such virtual items linked to progression would sell well), as otherwise the player would simply choose to switch to games with more unscrupulous operators.

What would be an ideal maximum spending limit on loot boxes, if it is to be imposed? In the Author's view, a universal monthly US$50 limit may be too low. Considering individual circumstances, a particular player spending US$100 (approximately £72) monthly on the only game that they play every day for many hours may not be unreasonable and should not be restricted. A higher monthly limit of US$200 (approximately £144) per game should be set universally as law to prevent extreme overspending on one particular video game. Game companies are welcome to set a lower limit for their games if they deem it more ethical to do so (for example, a game company may voluntarily set a lower monthly US$30 (approximately £22) limit for their child players). This overarching legal limit could then be complemented: individual players’ past spending behaviour would be examined in a socially responsible and benevolent manner (rather than malevolently and abusively to derive additional commercial gain¹⁵⁹) to identify potential problematic spenders, then such users are advised as to the potential harms of overspending on loot boxes; provided with resources to participate in support programmes; and, importantly, offered the option to set lower limits on their own future spending on loot boxes. Ideally, the spending limits of various video games would be organized into one centralized management system using which the player may be able to not only set individual spending limits on a particular game, but also a total spending limit on all games.

In terms of self-regulation, game companies do not necessarily need to implement their own maximum spending limit against user accounts as a hard cap on spending: instead, the loot box mechanic can be designed to be ‘exhaustible’, such that once a predetermined amount of money is spent (i.e., the intended maximum spending limit is reached), all rewards are guaranteed to be given to (or ‘won’ by) the player. It is also important to ensure that rewards do not expire or cannot be expended, such that players need not make repeat purchases to obtain the same rewards.¹⁶⁰ Game companies can also additionally provide an alternative (reasonably priced) option for the player to buy all possible rewards (or even specific rewards) from the loot box mechanic in a non-randomized manner for a predetermined amount of money. Combined with an exhaustible loot box design, this provides players with the choice to either engage with the loot box mechanic for a potential chance to win the most desirable rewards at a discount, or to directly purchase all desired items upfront.

4.3 Maximum gameplay time limits and curfew laws

In addition to maximum spending limits, video gaming has also been regulated and restricted using the concept of time, rather than money. Such measures may not be directly applicable to loot box spending, but may provide certain insights from a regulatory perspective. Maximum gameplay time limits seek to limit the total amount of time that a player is allowed to play games. Curfew shutdown laws restrict players from playing games during certain times, e.g., late nights and early mornings to ensure adequate sleep time, or school hours to ensure attendance. Both measures are aimed towards reducing gameplay time rather than in-game spending; nonetheless, the implications of their imposition are insightful. Recently imposed rules in the PRC limit minors’ gameplay time to 3 hours on public holidays, including weekends, and 1.5 hours on other (regular) weekdays.¹⁶¹ In April 2020, the Kagawa Prefecture of Japan imposed regulations on minors under 20 years old by limiting their gameplay time to ‘no more than 60 minutes on school nights and an hour and a half on weekends’.¹⁶² The PRC further restricts minors under the age of 18 from online gaming services between 22:00 and 8:00.¹⁶³ Similar curfew laws on online games have been imposed ‘between 0:00 and 6:00 in South Korea on juveniles under the age of 16 by Article 26(1) of the Juvenile Protection Act’ since 2011.¹⁶⁴

Such measures are particularly paternalistic as they severely restrict the liberty of the individual, which is likely why they have thus far only been imposed against minors. This suggests that loot box regulation may potentially also need to be applied differently against child and adult players, and against children of different ages. Temporal restriction measures have been documented to cause economic harm against the game industry, and have been argued to even potentially infringe fundamental human rights, ‘such as the underage players’ right to pursue happiness and self-determination, their parents’ right to educate their children and the game companies’ freedom of expression’.¹⁶⁵ Indeed, the regulations imposed by the Kagawa Prefecture of Japan are presently under a constitutional challenge on the grounds that they ‘violate the constitutional rights to freedom of expression and limits on the government's authority’.¹⁶⁶ Stringent loot box (over)regulation may cause similar harms.

Measures restricting gameplay time have also proven difficult to enforce because they are easily circumvented using the personal identification documents of others.¹⁶⁷ Notably, psychology research has concluded that the South Korean curfew law has been ineffective from a regulatory perspective because it neither reduced adolescent internet usage nor increased adolescent sleeping hours, as were its legislative intent.¹⁶⁸ This is meaningful for loot box regulation and suggests that more interventionist regulatory ‘solutions’ (such as banning all paid loot boxes) may not be appropriate without empirical research evidence. Such overregulation fails to protect consumers and harms the industry economically, and therefore should be avoided. The call for video game companies to be socially responsible by releasing loot box purchase data and cooperating with independent researchers, in order to avoid imminent, harmful overregulation, is worth repeating.

4.4 Disabling cash-out features

‘Cash-out’ features refer to methods by which in-game items can be transferred between players and thus gain real-world value (e.g., inter-player trading and auction houses). In-game item transfer systems in multiplayer games being misused for money laundering has been well-documented by the media in the PRC.¹⁶⁹ In October 2019, the ability to cash-out was disabled globally for Counter-Strike: Global Offensive (CS:GO) (2012, Hidden Path Entertainment & Valve Corporation) by the Game's publisher because ‘worldwide fraud networks have recently shifted to using CS:GO keys to liquidate their gains, [such that] nearly all key purchases that end up being traded or sold on the marketplace are believed to be fraud-sourced’.¹⁷⁰ This may have been done in recognition of potential intermediary liability, as these video game features are facilitating criminality. Additionally, issues with the validity and legality of the transfer of ownership (potentially involving minors with no legal capacity) over decentralized virtual items and currency, whose value may be particularly volatile and subject to little, if any, regulatory oversight, also arise.¹⁷¹

Game companies have complied with the Dutch gambling regulator's requirement to disable cash-out features, albeit sometimes unwillingly and with much protestation.¹⁷² The UK and French regulators have also recognized the possible abuse of cash-out features, but have yet to act against demonstrable current cases (arguably a failure of their executive function).¹⁷³ Considering existing evidence of criminal abuse, there is a substantial public policy reason to subject cash-out features to additional regulatory scrutiny. Existing self-regulatory measures that discourage abusing in-game item transfer systems to cash-out, such as by telling players not to do so and punishing players caught doing so by banning or restricting their user accounts,¹⁷⁴ are insufficient, because abuse remains factually possible as these measures respond only after the abuses have occurred and after harm has already been caused. Some players would always be willing to risk account termination to cash-out, particularly when they are quitting the game. Only the blanket ban of cash-out features can completely prevent abuse. Until cash-out features can be technologically secured such that they could not be abused, they should not be implemented in new games and should be disabled in existing games.

This is the position that the Dutch regulator has enforced.¹⁷⁵ Therefore, game companies can be reasonably expected to understand how to comply with this regulatory position. The UK and French regulators are also theoretically aligned with this position, although they have not enforced it. Video game companies are in a better position than gambling regulators to understand when and how in-game item and virtual currency transfer systems they have implemented may be abused by players. Gambling regulators may not necessarily be able to identify each case easily and promptly. Certain currently non-compliant game companies should act now to disable cash-out features; voluntarily comply with UK and French law; and prevent potential harms to consumers, instead of waiting until the regulators decide to finally enforce the law against them. Similarly, if game companies are willing to comply with Dutch law to better protect consumers in the Netherlands, then they should also socially responsibly apply the same higher standard of consumer protection to all their consumers in every jurisdiction, rather than merely complying minimally with the law (or, in the case of UK and French law, be knowingly non-compliant with the law until it is enforced against them).

4.5 Ethical game design ‘tool box’: consumer protection measures applied simultaneously

Recognizing the practical difficulties with regulating using and enforcing ethical game design measures detailed above,¹⁷⁶ these measures are nonetheless likely to be effective at reducing overspending on loot boxes to an extent and should still be imposed where possible. Pre-commitment limit-setting in gambling contexts only reduces gambling to a limited extent,¹⁷⁷ and maximum spending limits in video games would be difficult to effectively impose compulsorily by regulators in all countries. Therefore, the imposition of any one measure (such as setting maximum spending limits) cannot be perceived as a singular, permanent solution to loot box harms.¹⁷⁸ Multiple measures should be imposed simultaneously. The ineffectiveness of the curfew law in South Korea at reducing internet usage or increasing sleeping hours, and its economic harms, demonstrate that the regulation of technology, particularly video gaming, requires a process of trial and error. The regulation of technology is difficult and its impact unpredictable. Therefore, regulators should experiment with multiple measures simultaneously with the aim of measuring their effects, after being sufficiently informed by empirical research. Additional ethical game design measures to consider include, amongst others: not offering limited-time-only loot boxes containing unique rewards, so as to not induce an unfair sense of artificial urgency in the player;¹⁷⁹ not adopting the pay-to-win model¹⁸⁰ by not offering loot box rewards that provide a competitive advantage;¹⁸¹ and ensuring that loot box rewards can also realistically be obtained either through gameplay without payment or through direct (rather than randomized) purchase.¹⁸²

For ethical game design to succeed, players and game companies must be accepting of the concept. Xiao and Henderson argued that players may be averse to these measures and perceive them as paternalistic.¹⁸³ However, on the contrary, it is especially encouraging that a survey of Norwegian gamblers has demonstrated that 80% of them have a positive attitude towards maximum spending limits, even though it was compulsorily imposed, and that very few actually sought alternative operators after they reached their limit.¹⁸⁴ Therefore, players can be reasonably expected to support these ethical game design measures once they appreciate that these measures are implemented for their protection.

Admittedly, there are practical difficulties with convincing video game companies to voluntarily adopt these measures as many of them are plainly not commercially beneficial as their adoption will negatively impact revenue.¹⁸⁵ A few established game companies have voluntarily implemented some of these principles to a certain degree:¹⁸⁶ for example, Path of Exile (2013, Grinding Gear Games) and Overwatch only sell loot boxes containing cosmetic items which do not confer competitive advantages, and Hearthstone allows the possibility for players to obtain all loot box rewards through gameplay and provides uses for duplicate rewards to ensure that they would still be somewhat useful.¹⁸⁷ There may be certain, albeit limited, potential PR (public relations) benefits to adopting ethical game design, i.e., the media and the public choosing to give recognition and custom to certain game companies for their demonstrated social responsibility. For example, video gaming media widely reported on Fortnite's implementation of X-Ray Llamas and Epic Game's commitment to ‘loot box transparency’.¹⁸⁸ Indeed, public and commercial pressures can encourage ethical game design practices from the industry and ensure their adoption: consumers should exert pressure by voting with their wallets and choosing to spend their money only on ethically designed video games, and governments should, through discretionary grants and tax relief, incentivize the cessation of the implementation of potentially abusive game mechanics and the adoption of ethical game design principles.¹⁸⁹

The adoption of ethical game design also has the long-term benefit of ensuring that game companies would not seek to invent other potentially abusive mechanics to replace loot boxes after loot boxes become regulated, and thereby force academics and regulators to again scramble to identify the potential harms of another newly invented monetization method and justify their regulation, whilst exposing consumers to potential harms in the meantime before regulation is finally again made. Some concerns have already been raised against the relatively newer ‘season pass’ mechanic, which allows players to spend money to gain access to the opportunity to collect points during a specific, limited period of time and receive substantial rewards: it has been suggested that video game companies have not all been transparent to players as to how much gameplay time, and how much more money (in addition to the initial purchase of the season pass, because players can pay to buy points directly), are still required to be spent, before enough points can be collected to receive all of the season pass's rewards.¹⁹⁰

4.6 Past instances of minimal compliance by game companies sowed distrust

Voluntary self-regulation is likely the best solution, if all elements of the video game industry can be trusted to comply and endeavour to ensure consumer protection to the best of their abilities. Unfortunately, self-regulation alone as a solution must be treated with scepticism because major game companies have often only acted when explicitly regulated against and have not sought to promote consumer protection to the fullest and uniformly across jurisdictions.¹⁹¹ Consumers in Belgium are now protected from the potential harms of all paid loot boxes only because of the regulatory action of the Belgian gambling regulator;¹⁹² consumers in the Netherlands are protected from cash-out features, but not from overspending on paid loot boxes that do not contain rewards that are worth real-world money, because of the comparatively more limited regulatory action of the Dutch gambling regulator;¹⁹³ and consumers in the UK and France and most other countries remain largely unprotected from cash-out features and overspending, because of a lack of substantive regulatory action (e.g., enforcement). The disclosure of the probabilities of obtaining rewards from loot boxes was initially published by major game companies only because of the imposition of PRC law and only in Simplified Chinese for the benefits of PRC players.¹⁹⁴ Although the disclosures were often immediately translated into English and published online by dedicated Chinese players for the benefits of international players, technically and officially, many of the disclosures have not yet been made available to players from non-PRC countries. Game companies have not endeavoured to provide this information as soon as possible to all players in manners most accessible to them, and instead they have only complied minimally by providing this information only to PRC players. Video game companies have not acted socially responsibly in relation to the potential harms of loot boxes over the past few years, and this casts significant doubt on whether the industry can be trusted to self-regulate effectively without legal intervention. The Author believes not.