Game Over for Loot Boxes?

The most recent report (the "Report") published by the Norwegian Consumer Council ("NCC") criticises the use of loot boxes in video games (which are basically "mystery packages" containing digital content to be used in the game) which they consider amount to "predatory practices" designed to "exploit cognitive biases".

The Report advocates for significantly tighter regulation or indeed an outright ban on paid loot boxes, and has gathered considerable support across Europe (the NCC's website lists 20 participating organisations from 18 European countries who back their proposals). This latest development reinvigorates efforts by consumer associations to increase regulation in this area following the European Parliament's Committee on Internal Market and Consumer Protection (IMCO) report in 2020 (see our note on this here).

What is the current EU position on loot boxes?

According to the Report, loot boxes have so far managed to largely avoid any significant regulatory scrutiny. In Europe, what regulation does currently exist can broadly be divided into two categories: (1) consumer protection laws, and (2) gambling laws.
 
(1) Consumer Protection Laws
Consumer protection law at the EU level consists of a number of key pieces of legislation including: the Unfair Contract Terms Directive (UCTD), the Unfair Commercial Practices Directive (UCPD) and the Consumer Rights Directive (CRD).
 
The UCTD (as the name would suggest) focuses on the balance of negotiating power between businesses and consumers and prohibits terms which unfairly take advantage of consumers (as the NCC suggests may occur when video game companies grant themselves unilateral powers to modify or cancel loot box features, for example). The UCPD focuses on marketing, but again (as one would expect) covers any commercial practice likely to distort the economic behaviour of the average consumer (for example, offering loot boxes only during limited time frames and/or during critical game moments). Finally, the CRD regulates what kinds of information need to be provided to a consumer prior to purchasing digital goods (including information on price and the "main characteristics of the product", which the NCC says is not always obvious in the case of loot boxes).
 
However, as yet, there have been few, if any, attempts by regulators to enforce these consumer protection laws in the context of loot boxes.  Whether this position changes following the recent introduction of further EU consumer legislation in the form of the Enforcement and Modernisation Directive (which boosts fines for non-compliance to GDPR levels) and the Supply of Digital Content and Digital Services Directive remains to be seen.
 
(2) Gambling Laws
What regulatory initiatives there have been instead focus on gambling regulations, and in particular on the risks created for children of the gambling-esque systems involved in loot boxes. For example, in 2018, both the Belgian Gaming Commission and the Netherlands Gaming Authority declared certain loot boxes to be a form of gambling under their relevant national gambling legislation. In Belgium, it was apparently sufficient that there was (i) a game element, (ii) a bet, (iii) leading to a win or loss, and (iv) that chance had a role in the outcome, to satisfy the relevant local definition of 'gambling'. By contrast, in the Netherlands, what seemed to be critical was whether the prizes which were "won" could be traded outside the context of the game, e.g. on a marketplace or other platform. In 2020, the UK House of Lords similarly recommended bringing loot boxes within the remit of gambling legislation and regulation (see our note on this here) and a white paper detailing the government's proposals on this is expected within the coming weeks.
 
However, as gambling laws in Europe are governed at the national level (rather than at the EU level as in the case of consumer protection laws), these individual national variations have not led to a consistent European approach. This fragmentation of the legislation is highlighted by the NCC – particularly when considering the decidedly cross-border nature of video game digital content. 

What does the Report recommend? 

The Report makes six recommendations:

1. A ban on the use of "deceptive design" to exploit consumers.
2. A requirement for all in-game purchases to be denominated in real-world currency at all times (or at least require real-world currency values alongside virtual currencies, where the latter continue to be used).
3. A ban on loot boxes, "other randomized content in exchange for real money" and “pay-to-win" mechanisms" in all games likely to be accessed by minors.
4. An obligation that algorithms and datasets involved in the loot boxes be made accessible for independent research; and for the consumer to be explicitly informed if algorithmic decision-making is employed to influence their behaviour.
5. Improved resourcing for consumer protection authorities to take enforcement action.
6. An outright ban on paid loot boxes altogether, if the above fail to address the most pernicious issues these create. 

For those following regulatory initiatives like the UK's Online Safety Bill (see our note on this here), the Age Appropriate Design Code (see our webinar on this here) and the Netherland's guidelines on the protection of the online consumer, there are many parallels -  the focus on transparency and design requirements, the importance of protecting minors and the emphasis placed on improving enforcement by regulators are all common features. 

What can we expect to change?

Potentially, this most recent spotlight could see the Norwegian authorities review their analysis of loot boxes under local gambling legislation, as we saw in the Netherlands and Belgium.  
 
However, regulators will be conscious that although in some cases those changes have led to major game developers altering their offerings to satisfy local requirements[1], many others have simply chosen to withdraw their games from these smaller markets altogether. We saw this in 2018 when, for example, Square Enix pulled various of their Final Fantasy and Kingdom Hearts games from mobile app stores in Belgium, and just last month, when Blizzard announced it would be doing something similar with its latest Diablo Immortal game. Regulators will therefore have to question whether they can justify potential damage to consumer choice in their local markets – and the fact that certain gamers in those countries may still be tempted to obtain the game from other sources.
 
The Report clearly aims at something broader than this national approach – seeking to capitalise on the European Commission's ongoing "fitness check" of European consumer protection law; and the draft European AI Act to secure EU-wide legislative change which would require developers to change their practices across the board. However, historically (and despite the amount of public criticism loot boxes have already received) these initiatives have never made it to the top of EU regulators' agendas, and cross-border efforts towards industry self-regulation have been similarly anaemic. It therefore remains to be seen whether the growing revenues these practices now generate[2] will be enough to catch legislators' attention this time, or if the risks of public backlash have mounted sufficiently to shake developers out of inaction.
 
For now, studios and publishers releasing games with loot boxes should keep a watching brief.  Gambling legislation and regulatory guidance at a local level means that currently a one-size-fits-all approach across the UK and EU will not work, and businesses will instead need to assess the regulatory framework in each country where they wish to launch.  Whether an EU-wide approach is adopted remains to be seen but, for now, things are still very much "all to play for".
 
With special thanks to trainee, James Russell, co-author of this article.