Let’s meet in the middle

Download the PDF

Abstract

The lack of regulation around loot boxes opens the door to exploitation of minors, but history shows that total bans on the technology have either none or negative effect on the matter. Adding loot boxes to the list of age-restricted products, just like alcohol and tobacco, is a comfortable middleground between the game developer’s right to profit and the protection of minors. Incentives for compliant companies should be created in order to stimulate participation from top-50 game developers. In contrast, games containing the mechanic should be legally required to restrict their audience’s access to loot boxes and verify the gamer’s identity before they are allowed to consume such a product. The technology for that already exists; apps like DoorDash and Uber use facial recognition to verify their driver's identity for safety purposes, since all the interactions in these platforms are in-person. Blanket bans are to online gambling what prohibition was to alcohol, an utopian idea that banning a vice will make it disappear. Virtual Carding, on the other hand, reaches a middle ground between developers and the public concern with the wellbeing of minors. Companies can still implement their super-profitable mechanics but, just as manufacturers of other vices like alcohol and cigarettes, they must sell to adults.

Introduction

Justifying the introduction of microtransactions in online gaming is an easy task, as they are a continuous stream of revenue that keep multiplayer servers online after developers have burned through the initial cash injection of the release. Loot boxes are a kind of microtransaction with mechanics closely related to a casino roulette game, in which the consumer does not know what the prize will be for their financial investment. The playerbase of games that contain these mechanisms are frequently composed by minors that buy these boxes in the hopes of hitting a jackpot. Although it is illegal for a minor to gamble, video-game developers argue that this is a separate part of the entertainment software they sell so, because the items have no theoretical value, loot box mechanics do not constitute gambling (Lee 2018). Belgian and Japanese legislators attempted to mitigate this problem with severe bans that had no adherence from the industry and no real enforcement from the government (Xiao 2023)(Monolith 2023)(S). The proposal of this paper involves reaching a middle ground between video game developers and the government’s ideal of public protection. Just as it has been done in the past with other vices like alcohol and tobacco, loot boxes should be classified as restricted products; only legal adults should be able to consume them. Consequently, video game companies should have the right to develop and sell loot boxes and gambling-like mechanics as long as they get a “loot box license” and embed an identity verification protocol into their game. Unlike a blanket ban, where any loot box feature would be considered gambling, this middle ground approach would allow for companies to keep making profits. Temporary tax incentives should increase the chances of top companies in the industry to adhere to the regulation, an important factor for the success of the policy. Popular service apps like DoorDash and Uber already proved that periodic identity verification via facial recognition is a reliable method to keep most, if not all, users in line with the law. Adapting the technology to the gaming industry should be a smooth transition as long as companies are incentivized to do so.

The Problems

One of the difficulties for legislators is how to classify loot boxes due to different implementations of the technology depending on the developer. For example, some of them give prizes that can be exchanged for money while others do not. Some can only be bought with in-game currency while others take cash or some sort of walk-around like fake in-game currency that can also be bought for cash. This last case is important to note because loot boxes that can only be bought with in-game currency and only contain prizes of the same category have previously been ruled as NOT gambling (Smizer & Council 2023). The ruling was the same for two similar cases in 2022 – Coffee v. Google LLC and Taylor V. Apple, Inc. – the tech giants were not liable for gambling-like mechanics in their respective app stores because the prizes and the boxes were only commercialized via in-game currency, they could not be cashed out, so they had no real monetary value. Differently, games in which the player can sell their items for actual dollars have had rulings against them. For example, although this happened in Austria and not in the United States, Counter-Strike’s developer Valve was ordered to pay over $15000 to a gamer because Austrian law classified loot boxes as a form of gambling (Gibbs 2023). The contrast in decisions blurs the line differentiating loot boxes from gambling (not that there is one) and further extends the inability of governmental action.

Electronic Arts, Activision-Blizzard, Epic Games, all members of the Entertainment Software Association (ESA), are just a few examples of game developers interested in keeping their legal definitions and restrictions as soft as possible. The Association’s CEO, Stanley Pierre-Louis, claims that the ESA and the video game industry have done their part in keeping the public informed of the dangers of overspending in video games and creating robust mechanisms to prevent overuse of loot boxes (Gonzalez 2019). However, because they have no legal obligation to do prevention work, it is hard to believe anything other than the bare minimum has been done at all. In fact, data shows that loot box consumption, especially among children aged 13-14, has risen from around 25% to 31.2% of 8th graders since Pierre-Louis’ statement. (DeCamp & Daly 2023). Clearly, leaving the producers of a vice responsible for limiting their users intake is not effective. On the other hand, creating legislation that is too harsh has also proven to be ineffective. Japan issued a ban on "complete gacha" games in 2012 after the country's Consumer Affairs Agency concluded the practice constituted gambling, falling under "Card Matching" and thus, shouldn't be allowed for minors (Monolith 2023). Gacha is a game genre in which the player will need to buy randomized prizes to make any progress in the game. After the ban, Japan saw frail results that would be imitated by Belgium about six years later (Schwiddessen 2018). It seems like the way around loot boxes is not to absolutely allow or disallow them but to regulate with care, like demanding companies' best efforts in implementing technology to prevent minors from accessing gambling features.

Introducing the Response

Classifying loot boxes not as gambling but instead as “adult-only” consumables, like alcohol and cigarettes, is a middle ground between consumer safety and the companies’ right to profit. This way, companies should be able to implement gambling-like mechanisms in their games as long as they can keep minors away from them. Just like in order to get an alcohol license a bar is required to keep minors away from it under penalty of license revocation and/or prison. The proposal is then to require companies to verify their consumer’s identity, sort of a virtual carding, before letting them access content that was legally considered adult-only. This would mean that implementing age-verification systems would become a legal requirement for any video game company that wanted to use this business model. From the point of view of the user, the solution would require a verification process for the first time they log into the new system. The user would then be required to upload their government identification in order to play the game. Users of legal age would be allowed access to the full game while minors would be able to access a “capped” version that does not have elements prominent from gambling mechanics.

Discussion

Adding loot boxes to the list of adult-only consumables, along with regular day-to-day items like WD-40 cans or flammable items, would be the first step to mitigating the access of minors to this content. It gives the government legal precedent to require game development companies to follow rules similar to producers and sellers of other legal vices like tobacco and alcohol. For example, the government of California reserves the right to deny an alcohol license for anyone that does not meet the legal requirements of their Alcoholic Beverage Control Act. Similarly, the government could limit “loot box licenses” to games that have a proper identity verification feature. Compliant companies should be offered tax incentives in the first years of the initiative because recent studies demonstrate that tax policy change effectively influences change in behavior in private businesses (Sun 2022). Again, it is important to highlight the upsides for the gaming industry because, much like previous attempts involving technology and access to information, the success of this resolution depends on the willingness of the industry’s big-time players, such as the members of the ESA, to adapt to these regulations. If the restrictions on loot boxes are too strict, history shows that the adherence to the law is low and efforts are nullified (Xiao 2023)(Schwiddessen 2018).

Mandating game developers to constantly verify their consumers before they are allowed to access adult-only parts of the game has the benefit of not needing new technology to be developed. Facial recognition and document verification are widespread features in modern cybersecurity, usually present in apps in which the user must be older than 18 years old to enter, such as DoorDash, Tinder and most banking apps. Adding such a feature into a game would require some effort from the developer if they were to develop one in-house, but it’s common practice for companies like DoorDash to use third-party services such as Persona to mitigate this problem. Figure 3 illustrates the conditions of the DoorDash verification process. The user is required to do their verification to be able to work for the platform but important areas of the app remain active so that the user can manage their account. Translating this concept to the area of games would mean having two versions of a game in which only the “adult” one is able to access loot boxes. Players would keep the ability to play against each other just as they do nowadays, overall gameplay unaffected, but minors would play a version of the game that does not require verification but skins and other attractive “embellishment” items are not available. Meanwhile, the “adult” version has access to the full game but requires verification every predetermined period of time, like 24 hours, or whenever the player wants to make a financial transaction to the game. Of course, no system is perfect and fraudulent activities may still occur, like children using their parent’s documents and a fake video to trespass the verification process. Because this is an online system and not physical inspection of the identification card, virtual carding is exposed to this type of fraud but measures can be taken to diminish the chance. To determine if a picture is legitimate, Persona and DoorDash, for example, take metadata (data that is not visible for the common user) from the input picture like the time and place it was taken, which device it was taken on, and if key data from the user matches any other account on the platform. After the picture is proven to be factual, it is then compared to the account owner’s ID card. If a picture is found to be fraudulent or the user and ID do not match, DoorDash has a harsh policy of permanent platform bans to prevent these situations from happening

Opposition

Ending video-game-related gambling seems to be an easy task: finally take a stance classifying loot boxes as gambling and ban them, definitely, from being sold in your country, but this nearsighted approach could have unexpected, sometimes devastating, consequences for all parties involved in this matter. One example of a failed attempt to mitigate the problem is the Belgian ban on loot boxes that ended up not being enforceable and had, in actuality, effects opposite of its intended purposes. Leon Y. Xiao, PhD fellow at the IT University of Copenhagen, Denmark, specialist in loot box legislation, writes about this case in his recent academic article, "Breaking Ban: Belgium’s Ineffective Gambling Law Regulation of Video Game Loot Boxes", a study on the failure and consequences of such a broad – thus unenforceable – ban. Xiao goes into detail on how Belgium classified loot boxes as gambling and established a nation-wide ban on the game mechanics, only to have a few companies actually follow the measure and being subsequently substituted by sub-law businesses that took on the risk of being prosecuted. Additionally, companies have no interest in making a blocking software that is fool-proof so players, specifically the ones that spend the most and thus are more endangered, find ways around the blocking mechanisms. To back up his findings, Xiao brought up the following data that roughly 82% of the top 100 apps in the Belgian AppStore had randomized monetization methods (loot-boxes), compared to 80% of top 100 12+ rated apps. Furthermore, Xiao claims that such an ineffective ban can have two consequences: (1) it creates a false sense of security to consumers and law-makers, and (2) law-abiding companies are consequently replaced by companies with a lower moral ground because the profit is worth the risk. Leon Xiao claims for Belgium’s model not to be repeated: the risk of having a bad policy outweighs the downsides of having no policy at all.

Lastly, facial recognition is also a topic that raises some questions due to privacy concerns, especially when it comes to companies that are not based in the United States (Ahmed 2022)(Mineo 2023). How could we trust them to properly handle our data? Not only storing but also protecting facial recognition data from outsiders. Having scans of our faces in servers across the country that could be breached at any moment is a crucial point barring this resolution from becoming more accepted. Consumers and policy makers are not interested in giving such data to companies that have ties to the Chinese Communist Party like Tencent or Riot. Respectively, owners of Call of Duty Mobile and League of Legends, two of the most popular games in the United States. The counterpoint to that idea is that they have already done it, companies and corporations already have much more data about us, consumers, than we think they do. Unless one is not connected to social media, their entire lives can be pulled from tiny bits of information that they unconsciously leave behind on the internet. Privacy concerns regarding facial recognition are not unfounded but they should not stand in the way of the protection of minors because these submissions would not be compulsory. Not every American must do it, just the people that want to play a game that contains gambling-like mechanics. This is an important answer to those concerns because it uses the same argument as the ESA to justify the existence of loot boxes. They claim that loot boxes are an optional mechanic, the player is not required to buy them to enjoy the game, and the prizes are not worth real money, thus making it not gambling (Lee 2018). Well, since they are an optional mechanic, players that wish NOT to have their information disclosed to unknown parties, just opt-out of having access to gambling-like features. This way, minors are protected from having their data leaked or their pockets swiped clean, while theoretically rational adults are free to make their choice.

Conclusion

Legislation involving loot boxes is complicated and, for them to be enforceable, they require collaboration from key players of the industry, like Electronic Arts and Activision-Blizzard. Previous attempts of mitigating this problem, like outright banning any predatory practice to be present in games, proved to be unsuccessful, even in developed countries like Belgium and Japan. The way to a healthier scenario in which gaming and gambling are intertwined seems to be reaching the middle ground between the companies’ rights to make profit and the governmental and social role of protection of children and minors. The proposed idea required the regulation of loot boxes as something prohibited for minors, just like alcohol and cigarettes, then mandating a “virtual carding” for companies that want to have such features in their games. This way, companies are allowed to profit off their successful mechanics as long as their consumers are legally allowed to play. Compliant companies have the benefit of freedom of business while establishing their reliability.

Works Cited

• 2K. “Statement Belgium” 2K, https://www.2k.com/myteaminfo/be/
• Castro, Daniel. “Protecting Children Online Does Not Require ID Checks for Everyone” ITIF, 21 Nov. 2023, itif.org/publications/2023/11/21/protecting-children-online-does-not-require-id-checks-fo r-everyone/. Accessed 24 Feb. 2024.
• Coraggio, Giulio. “Navigating the regulatory maze: A global guide to loot boxes in video gaming” DLA Piper, 27 July 2023, www.dlapiper.com/en-us/insights/topics/loot-boxes. Accessed 23 Feb. 2024.
• DeCamp, Whitney, and Kevin Daly. “Loot box consumption by adolescents pre- and postpandemic lockdown.” PeerJ vol. 11 e15287. 1 May. 2023, doi:10.7717/peerj.15287
• DoorDash. “DoorDash Dasher Support” DoorDash FAQ, help.doordash.com/dashers/s/article/Dasher-Identification-Verification-FAQ?language=e n_US. Accessed 2 Mar. 2024
• Gibbs, Erik. “Loot Box Debate Continues as Valve Returns $15K to Austrian Gamer” Casino.org, 19 Dec. 2023, www.casino.org/news/loot-box-debate-continues-as-valve-ordered-to-return-15k-to-austri an-gamer/. Accessed 2 Mar. 2024.
• Mineo, Liz. “How facial-recognition app poses threat to privacy, civil liberties” Harvard Gazette, 26 Oct. 2023, news.harvard.edu/gazette/story/2023/10/how-facial-recognition-app-poses-threat-to-priva cy-civil-liberties/. Accessed 2 Mar. 2024.
• Monolith. “An In-depth Explanation of Why 'Kompu Gacha' is Illegal and its Relationship with the 'Japanese Prize Display Act'"” MONOLITH LAW OFFICE | Tokyo, Japan, 22 Sept. 2023, monolith.law/en/general-corporate/game-random-complete-illegal. Accessed 2 Mar. 2024.
• Lee, Julia. “FTC pledges loot crate investigation (update)” Polygon, 27 Nov. 2018, www.polygon.com/2018/11/27/18115365/ftc-loot-crate-investigation-senator-hassan. Accessed 24 Feb. 2024. The ESA.“Policy Positions: In-Game Purchases”
• The ESA, www.theesa.com/policy/in-game-purchases/. Accessed 23 Feb. 2024.
• Schwiddessen, Sebastian. “Loot Boxes in Japan: Legal Analysis and Kompu Gacha Explained.” Lexology, Baker McKenzie, 2 Aug. 2018, www.lexology.com/library/detail.aspx?g=9207df10-a8a2-4f67-81c3-6a148a6100e2.
• Smizer, Emma. “Loot Box Litigation Lessons For Game Developers” Lexology, 24 Jan. 2023, www.lexology.com/library/detail.aspx?g=b329d767-56e6-4c9a-8897-e5d3fc32a81f. Accessed 2 Mar. 2024.
• State of California Alcoholic Beverage Control. “Frequently Asked Questions.” Alcoholic Beverage Control, State of California Alcohol Beverage Control, www.abc.ca.gov/licensing/frequently-asked-questions/. Accessed 9 Mar. 2024.
• Sun, Ying. “Tax Incentives, Tax Enforcement, and Enterprise R&D Investment: Evidence From Chinese A-Share Listed.” Frontiers in psychology vol. 13 953313. 8 Jul. 2022, doi:10.3389/fpsyg.2022.953313
• Tattan-Birch, Harry, and Martin J Jarvis. “Children’s Exposure to Second-Hand Smoke 10 Years on from Smoke-Free ...” The Lancet Regional Health, 2 Feb. 2022, www.thelancet.com/journals/lanepe/article/PIIS2666-7762(22)00008-4/fulltext.
• Xiao, Leon Y. "Breaking Ban: Belgium’s Ineffective Gambling Law Regulation of Video Game Loot Boxes." Collabra: Psychology, vol. 9, no. 1, 2023, article 57641. https://doi.org/10.1525/collabra.57641