Where the odds have to be published

Disclosure mandates turned loot-box probability from a trade secret into a posted number — and the geography of that obligation now shapes how games are designed for different markets.

The regulation arrives in sequence

The first mandatory disclosure rules came not from Western consumer-protection agencies but from regulators in East Asia. China moved first in a structured way: in May 2017 China's Ministry of Culture put into effect rules requiring that online games publish the drop rates for randomised virtual items. The obligation was specific — probabilities had to appear before the player committed to a purchase, not buried in a terms-of-service document — and it applied to all titles distributed in the Chinese market regardless of where the developer was headquartered. Foreign studios wanting access to China's player base had to comply or stay out.

South Korea followed with its own framework. The Game Industry Promotion Act had already been amended in 2015 to require that probability information be disclosed for random-item boxes, and enforcement tightened over subsequent years as the regulator, the Korea Creative Content Agency, developed clearer standards for what adequate disclosure looked like. The South Korean rules matter disproportionately because the country's games industry is both a large exporter and a major importer, meaning studios building for a global audience cannot afford to treat Seoul as a peripheral market. The practical effect was that any studio already complying with Korean law had the infrastructure to comply elsewhere when other jurisdictions followed.

Japan did not mandate disclosure by statute in the same period, but the Japan Online Game Association — an industry body — established self-regulatory guidelines in 2012 requiring probability disclosure for what it called kompura (a contraction of complete gacha, a particularly aggressive randomised-collection mechanic). Self-regulation backed by the threat of statutory intervention produced, in practice, near-universal compliance among major Japanese publishers — and since several of those publishers operate globally, the norms exported themselves.

The guidelines expanded over time into a broader code covering randomised items generally.

The European and American response

Western regulators moved more slowly and less uniformly. Belgium concluded in 2018, after a formal investigation by the Belgian Gaming Commission, that certain loot-box implementations constituted gambling under the Belgian Gambling Act of 1999. That finding did not directly mandate probability disclosure — it effectively banned the mechanic in paid-to-open form — but it forced publishers to make a binary choice: remove the paid randomised box from Belgian storefronts or restructure it as a free-to-open cosmetic. Electronic Arts removed FIFA Ultimate Team card packs from sale in Belgium. The Netherlands reached a similar, though more contested, conclusion through the Kansspelautoriteit, its gambling authority, applying existing gambling law rather than creating new games-specific regulation.

Neither Belgium nor the Netherlands produced a disclosure mandate in the Chinese or Korean mould. What they produced instead was legal uncertainty, which is a different kind of pressure. Studios began publishing probability tables voluntarily in European markets to reduce the risk that silence would be read as concealment — a regulatory grey area they had no interest in testing in court.

The United Kingdom debated the question at length. A 2019 House of Lords Select Committee on the Social and Economic Impact of the Gambling Industry called loot boxes a gateway to gambling-like behaviour and recommended they be regulated under the Gambling Act 2005. The government's formal response, published in 2022 after a public call for evidence, stopped short of reclassifying loot boxes as gambling but did require that age-assurance measures be applied and that industry bodies implement "robust" disclosure standards — leaving the precise form of disclosure to the industry to negotiate.

The United States produced no federal disclosure mandate in this period. The Federal Trade Commission held a workshop on loot boxes in August 2019 that examined the consumer-protection dimensions thoroughly, and several bills were introduced in the Senate, including the Protecting Children from Abusive Games Act in 2019, but none became law. State-level action remained limited. The practical result is that American players generally see probability information only when a publisher has decided — for global compliance reasons or reputational ones — to show it.

Design consequences and the table as architecture

Probability disclosure is not a neutral act. When a studio is required to publish the odds, those odds become legible — and legibility creates accountability in a way that opacity does not. The gacha mechanic, which structures randomised rewards as a pull on a weighted table, relies partly on the player's imprecise intuition about scarcity. Publish the table and the rarest item becomes quantifiably rare: a 0.3% drop rate is a precise object that critics, journalists and regulators can discuss in concrete terms.

This has pushed some studios toward a design adjustment called a pity system — a hard ceiling on consecutive unsuccessful draws, guaranteeing the highest-tier item by a fixed attempt count. Pity systems serve dual purposes: they soften the worst-case outcome for players and they allow the studio to publish a worst-case cost rather than an open-ended expected value. A 0.3% drop rate with a ninety-draw pity is marketable in a way that a bare 0.3% is not. The pity mechanic is, in this sense, a compliance-shaped design choice as much as a player-facing one.

Platforms have also become a disclosure vector. Apple updated its App Store guidelines in December 2017 to require that apps offering loot boxes disclose item probabilities, and Google followed with equivalent Play Store policies. Because both platforms are gatekeepers to the largest mobile markets globally, their requirements function as de facto law in markets where no statute exists.

A developer building for iOS and Android must write the probability tables whether or not the jurisdiction the player is sitting in requires it.

The aggregate picture is of a disclosure regime built from overlapping layers: Chinese and South Korean statute, Japanese self-regulation, Belgian and Dutch gambling-law precedent, App Store and Play Store policy, and a scatter of voluntary commitments made by publishers anticipating tighter rules. No single international standard governs the field. The PEGI age-rating system, used across most of Europe, added an "includes random items" label in 2020 that flags the presence of randomised elements — another layer, though not a probability mandate. What the player in Berlin or Chicago or Seoul sees when they open a game's monetisation screen now depends on which of these layers apply to that title in that market, and studios building for a global audience must maintain disclosure documentation that satisfies all of them simultaneously. The probability table, once an internal spreadsheet, is now a regulated artefact.