Loot box sales to minors: the FTC just set the line

For years, loot boxes were treated as a disclosure problem. Publish the drop rates, add a line to the store screen, and most studios considered the obligation met. In 2026 that assumption stopped holding. The question regulators now ask is not "did you disclose the odds" but "who did you sell to, and did a parent agree first."

The settlement that set the precedent

The clearest signal came from the United States. The FTC's 2025 settlement with the studio behind Genshin Impact carried a $20 million penalty, but the number is not the important part. The order bars the company from selling loot boxes — paid items whose contents are randomised — to players under 16 without verifiable parental consent.

That reframes the whole category. A loot box is no longer just a thing you have to describe accurately. It is a thing you may not sell at all to a particular audience unless a parent has signed off. Accurate odds disclosure is still necessary. It is no longer sufficient.

The distinction matters because the two obligations live in completely different parts of your game. Disclosure is a display concern — text on a screen. Gated access is a logic concern — a decision your game makes before it ever shows the offer. A studio that solved the first has not touched the second.

Why this is an architecture problem, not a copy edit

If the rule were only about wording, you could fix it in an afternoon. It is not. To comply, your game has to know something before the sale happens: roughly how old this player is, and whether a parent has consented.

That means the age signal has to reach the exact place a randomised purchase can occur. It is not enough to collect an age once on a sign-up screen and forget it. Every surface that can sell a chance-based item — the store, an event reward track, a limited-time bundle, a first-session starter deal — needs to respect that signal at the moment of sale. If any single one of them slips through, the game is selling a loot box to a minor, and the fact that four other surfaces got it right does not help you.

Most studios discover this the hard way. The age is captured somewhere, but the offer logic three screens away never checks it, because that offer was built by a different person at a different time for a different reason. Closing that gap is a systems job, not a legal-copy job, and it is the part that takes real engineering time.

The rules stacking behind it

The FTC action is not an outlier. Several regimes are moving the same direction at once, which matters because you cannot practically ship one hand-tuned version of your game per country.

• The amended COPPA rule came into force in 2025, with compliance expected by April 2026. It tightens how services likely used by children handle data.
• PEGI changed its approach for 2026: any newly submitted game that contains paid random items receives a minimum PEGI 16 rating, regardless of the rest of its content.
• Brazil is moving to bar loot boxes for minors in 2026, and Australia rates chance-based purchases at least 15+.

The common thread is that "we disclosed the odds" is a 2023 answer to a 2026 question. The obligation has shifted from transparency toward gated access, and it is shifting in more than one jurisdiction on more than one timeline.

What to actually do

You do not need a legal team to get the structure right. You need four things.

Know the age band before the sale. Capture a reliable age signal and carry it with the player through the whole session, not just on the screen where it was entered.

Gate, do not merely disclose. If a player is under the threshold, a chance-based purchase should not be offered at all — not offered with a warning, not offered with a bigger warning, not offered. Disclosure is the floor, not the ceiling.

Design consent as a flow, not a checkbox. Verifiable parental consent is a specific, auditable step with its own failure modes. Treat it like any other important flow in your game: build it deliberately and test it, rather than bolting a tick box onto a form.

Make minor-safe behaviour something you can change centrally. New thresholds and new jurisdictions will keep arriving. If turning a chance-based offer off for a particular age band means shipping a new app version and waiting for players to update, you will always be behind the rule, because most players never update promptly. Being able to change that behaviour remotely from your dashboard turns a compliance deadline into a configuration change you make the same afternoon.

The measurement point

The obligation does not end at "we built a gate." At some point you may need to show that the gate actually worked — that under-16 players never saw a chance-based offer, across every surface, over a real window of time. That is only possible if every offer decision is recorded with enough context to answer the question after the fact: which player, which age band, which offer, and when.

A studio that can produce that record has a defensible position. A studio that cannot is trusting that nothing slipped through, which is exactly the assumption the FTC just penalised. If you want to see how offer decisions can be gated and logged at the point of sale rather than reconstructed afterwards, here is how it works →.

The line moved this year. Disclosure was the old bar. Permission — the right audience, with a parent's consent, provable after the fact — is the new one. The studios that treat it as a systems problem now will not be rebuilding under deadline when the next jurisdiction joins the list.