Loot box odds disclosure: what compliance actually requires

For years, loot box regulation was something studios watched from a distance — a debate happening in legislatures that hadn't yet produced rules with teeth. That period is over. Disclosure requirements are now active law in several major markets, enforcement is happening, and the penalties are real. South Korea has already fined a major publisher for hidden odds in a top-grossing game.

If your game sells random rewards and reaches players in regulated markets, "we'll deal with it later" is no longer a viable position. The rules exist now, the enforcement is current, and the technical work to comply is more involved than publishing a number on a webpage.

What the laws require

The core requirement across the markets that have acted is straightforward to state: disclose the probability of receiving each item from a random-reward purchase, and show it to the player before they buy.

South Korea's disclosure law took effect in March 2024 and requires companies to publish the odds for items in randomised purchases. China and Taiwan have parallel requirements, with Taiwan additionally requiring that chance-based products be clearly labelled as such. The common thread is that the odds must be real, specific, and accessible — not a vague "rare items have a lower chance" statement, but the actual probability of each outcome.

This is a higher bar than it first appears. It's not enough for the odds to exist in your design spreadsheet. They have to be surfaced to the player, in the purchase flow, in a form they can actually read and understand before committing money.

Where studios fall short

The gap between technically disclosing and meaningfully disclosing is where most compliance failures live.

When researchers examined the highest-grossing games in the Korean market after the disclosure law took effect, they found that most games with paid random rewards did disclose probabilities — but a meaningful share still did not, and among those that did, the accessibility and visual prominence of the disclosures frequently fell short of what the law intends. The odds were technically present but buried: several taps deep, in small text, or on a separate screen a player would never see in the normal purchase flow.

This is the trap. A studio implements disclosure to satisfy the letter of the requirement, places it where it minimally interferes with conversion, and considers the job done. But regulators are increasingly looking at whether the disclosure is genuinely visible at the decision point — not whether it exists somewhere in the app. A disclosure the player can't reasonably find is treated, more and more, as no disclosure at all.

The publisher fine in Korea was not for having no odds. It was for the odds being wrong or hidden. That distinction — between disclosure that informs and disclosure that technically exists — is exactly where enforcement is focusing.

The escalation from disclosure to restriction

Disclosure is the floor, not the ceiling. The newer wave of regulation goes further, and Brazil is the clearest example.

Brazil's digital protection law, effective in 2026, doesn't just require odds to be shown. It bans paid loot boxes outright in games that reach minors, mandates strong age verification and parental controls, and gives regulators the power to fine companies up to 10% of revenue or suspend the service entirely. It also restricts personalised advertising and algorithmic targeting aimed at minors.

This is a categorical shift. Disclosure laws assume the mechanic is permitted as long as players are informed. Restriction laws decide the mechanic itself is not acceptable for certain players regardless of disclosure. A studio that built its compliance posture around "we show the odds" is unprepared for a market that says "you may not sell this to this player at all."

The two approaches are spreading in parallel. A studio shipping globally now has to handle markets that require disclosure, markets that require age-gated restriction, and markets with no specific rules yet — often within the same build.

What disclosure needs technically

Meeting these requirements properly is an engineering problem, not just a legal one.

The odds have to be accurate and kept in sync with the actual drop tables. If your random-reward rates change — a seasonal event boosts a drop rate, a balance patch adjusts the pool — the disclosed odds have to change with them. A disclosure that was accurate at launch and drifted out of sync with a later update is a compliance failure waiting to be found.

The disclosure has to be surfaced at the purchase decision point, in the player's language, in a form that's prominent rather than buried. That means it's part of the offer presentation layer, not a static legal page. The offer a player sees and the odds attached to it have to travel together.

And the whole thing has to be jurisdiction-aware. A player in a market that bans the mechanic for minors should not be shown it at all if they're underage; a player in a disclosure market should see the odds inline; a player in an unregulated market sees the offer under your own standards. Driving that from the player's market and age, at the moment the offer is built, is what keeps a single global build compliant across very different legal regimes.

See how we apply jurisdiction-based rules to what each player is shown →

What to do now

Start with an inventory: every mechanic in your game where money buys a chance, and every market you ship to. Map which of those markets require disclosure, which require restriction, and which have nothing specific yet but sit in regions where regulation is clearly coming.

Then check the two failure modes that catch studios most often. First, are your disclosed odds actually accurate and synced to your live drop tables — or are they a launch-day snapshot that updates have since invalidated? Second, is the disclosure genuinely visible at the point of purchase, or is it buried where a player would never encounter it in normal use?

The studios that treat this as ongoing compliance infrastructure — built into how offers are presented and governed per market — will adapt to the next market that acts with a configuration change. The studios that treat each law as a one-off patch will be reworking their purchase flow every time a new jurisdiction moves. Given how fast these rules are spreading, that's a recurring cost worth designing out now.

Talk to us about market-aware compliance for your offers →