Drafting video game loot box regulation for dummies: a Chinese lesson

ABSTRACT Loot boxes are virtual items in video games that players purchase to obtain randomised rewards of varying value. Such randomised monetisation methods are prevalently implemented globally. Loot boxes are conceptually and structurally akin to gambling, and their purchase is positively correlated with problem gambling in Western countries. Given the potential harms loot boxes may cause, particularly to vulnerable consumers, e.g. children, regulators and policymakers are paying increasing attention. Some countries, e.g. Belgium, have actively enforced existing gambling laws to ban certain loot box implementations. However, less restrictive regulatory approaches, e.g. requiring probability disclosures, are also being considered. Amendments to existing law and new laws dedicated to regulating loot boxes are likely forthcoming in many countries. Companies’ discretionary and suboptimal compliance with loot box probability disclosure law in the People’s Republic of China reveals how future loot box laws and industry self-regulations should be better drafted to ensure maximum consumer protection.


Introduction
Loot boxes are virtual items in video games that can be purchased to obtain randomised rewards. Generally, most of the randomised rewards that can potentially be obtained by the player are not valuable (and may even be effectively redundant), but a few rarer rewards are valuable. Players continuously spend money on such mechanics to try to obtain the valuable rewards, although they would most often only receive the not valuable rewards, because some rare prizes have a probability of as low as 0.0025% of being obtained, as shown in Figure 5. Loot boxes are arguably conceptually and structurally akin to gambling because players are paying for a random chance at potentially obtaining the valuable rewards that they want. 1 Loot box purchasing has been found to be positively laws, 16 e.g. in the UK, 17 France, 18 Belgium, 19 the Netherlands, 20 and Denmark. 21 Policymakers in countries where loot boxes cannot easily be regulated by existing law have argued that loot boxes should be regulated as gambling through future amendments of the law, e.g. in the US, 22 the UK, 23 and Australia. 24 Many countries are presently actively considering whether to regulate loot boxes and if so how, e.g. in Spain, 25 Brazil 26 and the UK. 27 It is important to recognise that this issue affects developed and developing countries, regardless of geography. Given that loot box regulation is likely forthcoming in many countries globally, it is pertinent that the drafting language of such future laws be as well-written as possible so as to ensure the maximum degree of consumer protection and avoid companies complying with the laws in suboptimal manners that may reduce their effectiveness.
The only country that has imposed specifically drafted regulation in relation to loot boxes is the PRC, 28 which requires video game companies to disclose the probabilities of obtaining randomised rewards from loot boxes to increase transparency and enhance consumer protection. However, an empirical assessment of the compliance actions taken by the companies operating the 100 highest-grossing iPhone games in the PRC revealed that most companies complied only in suboptimal ways that failed to maximise the law's consumer protection benefits: the probability disclosures are often difficult to find and access. 29 The use of inaccurate drafting language and the lack of specific enforcement powers to police compliance may explain the widespread suboptimal compliance. This paper seeks to identify the strengths and weaknesses of the drafting language of the PRC regulation, and of five Bills concerning loot boxes that never passed into law in the US, in order to provide insights as to how future loot box regulation should be drafted in other countries. However, before turning to the Chinese insights on how to draft new laws to regulate loot boxes, the current UK regulatory position on loot boxes (which is representative of many countries' positions around the world) is critiqued to demonstrate the inadequacy of existing law and the need for new regulation.

Inadequacy of existing UK law to ensure consumer protection
The UK is representative of many countries that have taken no regulatory actions against loot boxes, despite their gambling regulators and policymakers recognising that this issue is deserving of potential law reform. 30 Existing UK law is insufficient and inadequate at dealing effectively with the issue, which is why new regulation is needed.

Gambling Act 2005
The first port of call is the Gambling Act 2005 (GA), which established a regulatory regime for legal gambling in the UK. Section 6 of the GA defines regulated 'gaming' as 'playing a game of chance for a prize'. The 'prize' in this context is defined as 'money or money's worth'. 'Money's worth' has been constructed plainly by the court in relation to previous gambling legislation as meaning 'the equivalent of money;' 31 or that '[t]hey are worth money;' 32 or 'anything which is capable of being turned into money'. 33 Accordingly, the UK Gambling Commission has determined that only loot boxes that provide prizes that can be sold to other players for real-world money (a process known as 'cashingout') do constitute gambling under existing law. 34 The vast majority of loot boxes do not provide prizes that can be cashed-out. For this reason, purchasing most loot boxes do not constitute gambling and therefore cannot be regulated as licensable gambling activities in the UK, which would have restricted children's and young people's (under-18-year-olds) access to them. 35 However, crucially, empirical research has found that 29 Xiao and others, 'Gaming the system' (n 7). 30  purchasing loot boxes that cannot be cashed-out is still positively correlated with problem gambling severity. 36 Two UK parliamentary committees have separately recommended that loot boxes that cannot be cashed-out should be regulated as gambling through amendments to the GA, 37 or by immediate executive regulations as allegedly (but erroneously 38 ) permitted by Section 6(6) of said Act, 39 both of which the UK Government is currently considering adopting after closing its consultation and call for evidence specifically dedicated to loot boxes in late 2020. 40 Unfortunately, neither of these two proposed regulatory 'solutions' are ideal: one of them is not even legally possible; they are addressed in turn. Firstly, in relation to the proposal that paid loot boxes that cannot be cashed-out should be regulated as gambling, this regulatory position has been adopted by Belgium: all paid loot boxes, regardless of whether their prizes can be cashed-out, have been regulated as gambling. 41 This has not only caused loot boxes to be removed from certain games, 42 but it has also caused certain other games to be entirely removed from the Belgian market because it is no longer commercially viable to operate those games there. 43 Players' freedom to play those games in Belgium, and the companies' commercial interests have both been negatively affected. 44 This is arguably overregulation because most players are unlikely to be harmed by loot boxes: only the vulnerable consumers who may overspend beyond their means require protection. 45 Secondly, as to making executive regulations, i.e. secondary legislation, under Section 6(6) of the GA, this is legally unsound. As outlined above, within the definition of the Act, the two legal elements of gaming under Section 6 are: playing (i) 'a game of chance' for (ii) 'a prize'. The difficulty with the legal definition in relation to loot boxes that cannot be cashed out does not lie with the first element of 'a game of chance'. It is clear that all loot boxes plainly satisfy this element because of its randomisation process. The difficulty lies instead with the second 'prize' element: prizes of loot boxes that cannot be cashed out are not 'money or money's worth'. The Gambling Industry Committee of the House of Lords' recommended that: … Ministers should make regulations under section 6(6) of the Gambling Act 2005 specifying that loot boxes and any other similar games are games of chance, without waiting for the Government's wider review of the Gambling Act. 46 36 David Zendle and others, 'Paying for Loot Boxes Is Linked to Problem Gambling, Regardless of Specific Features like Cash-out and Pay-to-Win' (2019) 102 Computers in Human Behavior 181. 37 Digital, Culture, Media and Sport Committee of the House of Commons (UK) (n 23) para 98. 38 Secondary legislation cannot in fact be used to regulate on this point, see text to nn 47-48. 39  Section 6(6) of the GA states the following: The Secretary of State may by regulations provide that a specified activity, or an activity carried on in specified circumstances, is or is not to be treated for the purposes of this Act as-(a) a game; (b) a game of chance; (c) a sport.
Making executive regulations under Section 6(6) to deem loot boxes as games of chance achieves nothing, because they are already games of chance within the meaning of the Act and satisfy that element. The Gambling Industry Committee's ill-advised recommendation, if adopted, would fail to achieve anything under existing law, contrary to what the Committee believed ('The recommendation above will deal with the immediate issue of loot boxes … ' 47 ). This is because the inability of the Gambling Commission and the GA to regulate most loot boxes is due to the failure to satisfy the second 'prize' element, rather than the first 'game of chance' element. The deeming provision that is Section 6(6) applies only to the 'game of chance' element. 48 There is no analogous deeming provision for the 'prize' element. Therefore, loot box rewards that are not money or money's worth cannot presently be deemed to be prizes for the purposes of the Act by executive regulations. The making of any such secondary legislation on the 'prize' element would be the Government acting ultra vires. Loot boxes containing only rewards that cannot be cashed-out cannot be regulated under existing UK gambling law under either primary or (prospective) secondary legislation.

Consumer Protection from Unfair Trading Regulations 2008
The (1) failure to disclose the probabilities of obtaining randomised rewards from loot boxes may be a misleading omission, 55 whilst disclosing false or inaccurate probabilities may be a misleading action; 56 (2) implementation of mechanics that change the probabilities of obtaining randomised rewards (i.e. 'pity-timer' mechanics 57 ) may be a misleading action and failure to disclose doing so may be a misleading omission; (3) falsely advertising certain loot boxes as being available for sale or at a particular discount only for a limited amount of time, but then offering the same loot boxes for sale or at the same (or an even better) discount at a later time, may be an automatically unfair commercial practice; 58 (4) Creating the false impression that selling loot boxes whose rewards can be cashedout, which is illegal without a licence under the GA, 59 is legal may constitute another automatically unfair commercial practice; 60 and (5) paying for content creators (e.g. YouTubers) to create advertorials showing loot box openings (which may be doctored to only show 'lucky' openings in which the content creator won valuable rewards) without denoting such content as sponsored may be yet another automatically unfair commercial practice. 61 Potential contraventions of the CPUTR by loot box implementations are easily identifiable. However, despite there being such instances of CPUTR breaches that are known to have been committed by video game companies, there has been no report that the relevant enforcers of the CPUTR (e.g. Trading Standards) have brought any actions against obvious contraventions. Indeed, proving causation under the CPUTR may be difficult: in relation to misleading actions and misleading omissions, to establish criminal liability under CPUTR, it must be proved that 'but for the relevant misleading action or omission of the trader, the average consumer would have made a different transactional decision from that which he did make'. 62 The relevant misleading action or omission does not have to be the 'sole cause' of the average consumer's decisions; however, the CPUTR are not infringed if 'but for the misleading act or omission, the average consumer would nonetheless have [made the transactional decision] as he did'. 63 This means that the relevant misleading action or omission must play a role, however small, in changing the player's decision-making as to whether to purchase the loot boxes. Indeed, for example, if the court determines that the average consumer (being reasonably circumspect and therefore appreciating that loot boxes involve random chance 64  the loot box even if given the probability disclosure (which was not in fact provided), then causation and therefore contravention of the CPUTR are not proved. 65 Further, the fatal weakness of applying the CPUTR to 'solve' the problem of loot box regulation is that, similar to the GA, 66 it cannot be extended to stop the implementation of loot boxes whose rewards cannot be cashed out generally. The CPUTR can only ensure that implementations of such loot boxes are not particularly unfair to the consumer by stopping the implementation of specific loot boxes. The fact that the loot box as a product, regardless of any subsidiary aspects of its implementation or sale being unfair, may by itself be inherently 'unfair' is not the sort of matter that was intended to be dealt with by the CPUTR.
Other legal provisions, such as the Consumer Rights Act 2015, which regulates the underlaying contract of sale between the player and the video game company offering the loot box, also cannot be transplanted to regulate loot boxes because they were never intended to achieve such a purpose. In conclusion, the existing law of many countries (both in terms of gambling law and consumer protection law) is unsatisfactory when responding to novel issues involving new technology, such as loot boxes, which the original drafters could never have predicted or accounted for. This is why amendments to existing law or new regulation, both of which would require new legal provisions to be drafted, has been deemed necessary to respond to the potential harms of loot boxes. 67 What can be learned from loot box law in the PRC and the loot box Bills that failed to pass into law in the US can inform such future regulations in other countries across the world and ensure that such prospective laws are effective at maximising their consumer protection benefits.

What we can learn from PRC loot box probability disclosure law
Instead of regulating loot boxes as gambling and potentially banning their sale (which negatively impacts consumer freedom and companies' commercial interests), requiring the disclosure of loot box probabilities that reveal how likely a player is to obtain randomised rewards has been proposed as an alternative consumer protection measure. 68 This non-restrictive approach seeks to achieve a balance between preserving consumer freedom (to buy loot boxes) and providing consumer protection (from potential gambling-related loot box harms). 69 Such a measure may be a more considered and holistic solution than simply extending gambling law. Probability disclosures may be required through industry self-regulation 70 or by law. The PRC is presently the only country in the world to adopt this measure as law by imposing a legal obligation on video gaming service providers to publish the probabilities of obtaining randomised rewards from loot boxes. 71 This requirement is set out in the Notice on Regulating the Operation of Online Games and Strengthening Concurrent and Ex-Post Supervisions (hereinafter, the 'Notice') published on 1 December 2016, and effective since 1 May 2017. 72 A closer examination of the drafting language of the PRC law and the consequent compliance actions taken by companies reveals that the drafting language of the law can, and should, be improved before it is considered for adoption or transplantation by another country. Indeed, what can be learned from PRC loot box probability disclosure law is not only applicable to prospective loot box probability disclosure law in other countries, but also applicable to loot box regulation in general, e.g. a law seeking to ban their sales.
3.1. Why terms like 'loot boxes' are misleading and should not be used The drafting language of the Notice did not use the term 'loot boxes' or a more generic term for randomised monetisation methods. Instead, the law referred to '随机抽取机制 [randomised 'pull' mechanics]' in all relevant paragraphs of the Notice (Paragraphs 6-8) and additionally to '合成,' which is an abbreviation for '随机合成机制 [randomised 'fusion' mechanics]' in Paragraph 6. The concept of paid 'loot boxes' is understood in the literature as broadly referring to in-game monetisation methods that provide randomised rewards to the purchasing player. 73 The term 'randomised "pull" mechanics' used by the PRC law is conceptually equivalent to how the English literature appreciates the term paid 'loot boxes'. However, neither term is ideal for the purposes of being drafted into legislation.
In relation to the term 'loot boxes,' randomised monetisation methods do not necessarily have to be visually represented as 'boxes' to be recognised as 'loot boxes' by the literature. Indeed, the UK Gambling Commission, when it surveyed UK children, referred to 'loot boxes/crates/packs' 74 rather than simply 'loot boxes' in order to avoid potentially confusing respondents given that randomised monetisation methods may be implemented in various forms. 75 For example, Figure 1 shows a screenshot of the 'loot box' in 灌篮高手 [Slam Dunk] (2018, DeNA). This implementation does not take the form of a box, a crate or a pack, and instead is represented as a prize wheel: when the player engages with the mechanic, the selection cursor moves from one reward to the next in a circular motion until it stops; the player then obtains whichever reward the cursor stops on. Nonetheless, the literature would recognise this mechanic as constituting a 'loot box,' as it is a randomised monetisation method. This conceptual jump of calling a mechanic that shares no structural similarities with a 'box' and visually does not look like a 'box' a 'loot box' might be difficult for people unfamiliar with video games to understand (e.g. parents whose children play video games but who themselves do not play video games). The overuse of the term 'loot boxes' to refer to a wide variety of randomised monetisation methods that do not take the form of boxes is therefore potentially misleading and incorrect, and arguably should be refrained from in the academic literature 76 and in any drafting language of the law. This is because, if the term 'loot boxes' is used in legislation, a company may seek to argue that the term should be restrictively interpreted to mean only randomised monetisation methods that are visually represented as a 'box,' and not to mean other randomised monetisation methods, e.g. that the implementation shown in Figure 1 would not be covered by the regulation. Companies may then simply change the visual representation of their loot box to be, e.g. a loot 'bag' and seek to dodge regulation.
Similarly, in relation to the term 'randomised "pull" mechanic' used by the Notice, although many loot box implementations do involve the player character physically 'pulling' rewards out of treasures chests and packs of cards, the process of the player obtaining the reward in other games is not necessarily visually represented as physically 'pulling' the reward out of a container. Therefore, the term 'randomised "pull" mechanic' is also potentially misleading and should not be used for legal drafting, because its use implies a definition that is conceptually more restrictive than the drafters' intentions: a company can argue that its randomised monetisation method is indeed a randomised monetisation method generally, but is not a 'randomised "pull" mechanic' specifically, and therefore the law does not apply. Indeed, the difficulties with defining 'randomised "pull" mechanics' might be why the term is not statutorily defined by PRC law, within the Notice or elsewhere: companies have had to interpret the meaning of this terminology themselves. Finally, the term 'randomised "fusion" mechanic,' used by the Notice in Paragraph 6, refers to randomised monetisation methods that, rather than providing tangible 'object' rewards (such as an additional weapon that the player can use), instead provide in-game services, such as upgrading a weapon that the player already owns to do more damage, on a randomised basis: after the player has paid, the in-game service will always be attempted; however, whether or not the attempt would be successful is randomised. For example, artefact upgrade in Raid: Shadow Legends (Plarium Games, 2018) is such a mechanic: the player can pay for a random chance at potentially improving the strength of weapons that are already in their possession. 77 'Randomised "fusion" mechanics' are not as widely implemented as 'randomised "pull" mechanics'. Therefore, to understand the term 'randomised "fusion" mechanic' requires substantial familiarity with video game mechanics in general or with the specific game implementing the mechanic, which is why this term is also unsuitable for inclusion in the drafting language of any legislation: interested parties who do not themselves play video games (e.g. many parents and policymakers) may be unable to understand the term's meaning.
Further, the use of the terms 'randomised "pull" mechanics' and 'randomised "fusion" mechanics' in conjunction in the same paragraph of the Notice implies that the drafters of the PRC law thought that the two mechanics are separate, i.e. that 'randomised "fusion" mechanics' do not constitute a type of 'randomised "pull" mechanics'. This suggests that the term 'randomised "pull" mechanics' is less inclusive than the term 'randomised monetisation methods'. Indeed, no work in the English academic literature has yet to specifically identify and recognise 'randomised "fusion" mechanics' as a type of 'loot boxes'. However, such paid fusion mechanics possess the requisite structural characteristic for them to constitute randomised monetisation methods: specifically, they are either 'embedded-embedded' or 'embedded-isolated' random reward mechanisms (RRMs) as defined by Nielsen & Grabarczyk: 'any RRM consists of three components: Eligibility condition → Random procedure → Reward'. 78 The 'eligibility condition' is the 'cost' that the player must pay to 'trigger the random procedure'. The 'random procedure' determines whether or not the player will obtain a reward, and what kind of reward the player will obtain. The 'reward' is 'any element in the game that can be awarded to the player' and which possesses 'value' either in-game or also additionally in the real-world. 79 Embedded-embedded RRMs cost real-world money to engage with and its rewards possess real-world value, in addition to in-game value. Embedded-isolated RRMs also cost real-world money to engage with, but its rewards do not possess real-world value. 80 'Randomised "fusion" mechanics' therefore plainly constitute a type of 'randomised monetisation methods'.
A more generic term that does not refer to any specific aspects of loot box design that are not implemented in all loot boxes (i.e. no references to 'box' or 'pull') would be a better alternative than the terms used in the Notice. The term 'random reward mechanisms' ('RRMs') have been proposed as a neutral and technical term to refer to all types of 77  loot boxes, including those that do not require the player to pay real-world money to engage with. 81 However, when referring specifically to paid loot boxes, the term 'randomised monetisation methods' is preferable. This is because, if the term 'random reward mechanisms' is adopted instead to describe paid loot boxes, references would have to be made to both 'embedded-embedded random reward mechanisms' and 'embeddedisolated random reward mechanisms' to emphasise that both types require payment of real-world money to engage: 82 these two terms represent language that is too technical and complex for an average consumer to understand. In contrast, the term 'randomised monetisation methods' is inclusive of both terms and references neutrally that such mechanics involve randomisation and are mechanics used by video game companies to monetise (and therefore require payment from the player to engage), and therefore is preferable.
Neither the term 'randomised "pull" mechanics' nor the term 'randomised "fusion" mechanics' is statutorily defined by PRC law, within the Notice or elsewhere. Companies seeking to comply with the Notice must therefore attempt to interpret the terms themselves. This lack of a clear definition for randomised monetisation methods may have meant that certain companies decided that certain 'loot boxes' within their games satisfy the definition, whilst others do not. A survey of the 100 highest-grossing iPhone games in the PRC was able to find probability disclosures for 96% of games containing 'loot boxes'. 83 The 4% of games containing 'loot boxes' whose probability disclosures could not been found (after considerable efforts were expended to find them) most likely did not publish probability disclosures. 84 This is not necessarily because these companies were not aware of the law or were actively trying to break the law (given the substantial potential negative consequences), and may instead be because the companies operating these games did not believe that the randomised monetisation methods they implemented in their games constituted either a 'randomised "pull" mechanic' or a 'randomised "fusion" mechanic,' as set out in the Notice. Further support for this explanation can be identified amongst a portion of the 96% of games whose probability disclosures were found: multiple randomised monetisation methods were implemented within some of these games; however, probability disclosures were found to have been published only in relation to some, but not all, of the identified randomised monetisation methods. 85 The companies' decision to disclose the probabilities for some randomised monetisation methods indicates that they were aware of and were seeking to comply with the law. A hypothetical unscrupulous company would have either not disclosed any probabilities or disclosed inaccurate probabilities to maximise profit. 86 Partial compliance incurs costs on the company but remains non-compliant and liable for enforcement action. Partial compliance is therefore irrational. Assuming that partial non-disclosure did not result from mistake, one explanation for this phenomenon may be that the PRC law's failure to explicitly define randomised monetisation methods led game companies to erroneously believe that certain implementations did not fall within the ambit of regulation, and therefore they were not obliged to disclose the relevant probabilities.
The Chinese experience demonstrates that if and when loot box regulation is to be adopted in another country, the drafting language should refer to a neutral terminology, such as 'randomised monetisation methods,' rather than to terms such as 'loot boxes' or 'randomised "pull" mechanics,' which imply specific aspects of implementation that are not applicable to all randomised monetisation methods and may therefore be misleading. Use of a neutral and simple-to-understand terminology would ensure both that consumers and interested parties (e.g. parents of child video game players who do not themselves play video games and therefore have little to no video gaming knowledge) can understand when they can expect to see probability disclosures published, and that video game companies are able to understand the full extent of their legal obligations and comply effectively with the regulation. It is encouraging to see that the Spanish Ministry of Consumer Affairs recently adopted the neutral terminology 'Los mecanismos aleatorios de recompensa (cajas botín) [Random reward mechanisms (loot boxes)]' in its recent consultation paper: 87 the continued additional use of 'loot boxes' in brackets may be useful during a transitional period, especially when communicating to consumers, because this has hitherto been the widely accepted terminology and because many players continue to use the phrase 'loot boxes' colloquially to refer to randomised monetisation methods; however, this phrase should not be used in isolation in future regulation.
3.1.1. Some insights from the US Five Bills in the United States and in the State of Hawaiʻi drafted in 2018 and 2019 should also be consulted for potential pitfalls in their drafting language that should be avoided by any future loot box regulation, even though none of these Bills passed into law. Section 1 of Senate Bill S. 1629 sought to ban the publication and distribution of video games containing 'pay-to-win microtransactions' and 'loot boxes,' which are marketed at children or which may be played by children under 18. 88 The Bill explicitly referred to and defined 'loot boxes' as follows in Section 2(8): LOOT BOX.-The term "loot box" means an add-on transaction to an interactive digital entertainment product that-(A) in a randomized or partially randomized fashion- (ii) the content of which is unknown to the user until after the user has made the first add-on transaction.
The term "add-on transaction," used in Section 2(8) is further defined in Section 2(6) as follows: The term "add-on transaction" means, with respect to an interactive digital entertainment product, a payment to the game publisher of an interactive digital entertainment product, an affiliate of the publisher, or any other person who accepts such payment for the benefit of the publisher, of either money or an in-game proxy for money, such as a virtual currency, that can be purchased with money, that-(i) unlocks a feature of the product; or (ii) adds to or enhances the entertainment value of the product.
(B) EXCLUSION.-Such a term shall not include a payment (including a payment of a regular subscription fee) which is made only to allow a user to access the content of an interactive digital entertainment product, provided that users do not have the option to pay different amounts to access the same content in order to unlock a feature of the product or to enhance the entertainment value of the product.
The combination of Sections 2(6) and 2(8) managed to define the two crucial components of a randomised monetisation method: those being (i) that it must be additionally paid for with real-world money and (ii) that it involves some manner of randomisation. The further definition provided in Section 2(8) was correctly drafted to expand on the literal meaning of 'loot boxes' and therefore avoided the problem that non-'box'-like implementations would not be covered by the law. However, the Bill does suffer from the flaw of misleadingly using a word ('box') that is not applicable to all randomised monetisation methods to refer to all randomised monetisation methods. In summary, Senate Bill S. 1629 appears reasonably satisfactory. However, following the recommendations made above in this paper, the one improvement that can be made in the drafting language is to either not use the term 'loot boxes' at all and instead only use the term 'randomised monetisation method,' or, alternatively, to use the combined term of 'randomised monetisation method (loot boxes)'.
In (a) It shall be unlawful for any retailer to sell to any person under twenty-one years of age a video game that contains a system of further purchasing that includes: (1) A randomized reward; or (2) A virtual item that can be redeemed to directly or indirectly receive a randomized reward.
(b) For purposes of this section: "Randomized reward" means a reward in a video game that is based on a variable ratio schedule, wherein a player receives a reward after a random number of actions.
… 93 H.B. 2727 and S.B. 3025, as originally drafted, 94 were effectively the same and sought to require loot box probability disclosures and a health warning (referring to potential harms and addiction) to be displayed on video game packaging. These Hawaiian Bills avoided the issue of misleadingly using the term 'loot boxes' to mean randomised monetisation methods, and instead used the term 'a system of further purchasing that includes a randomised reward' and did not use 'loot boxes' at all in their drafting language. This neutral phrasing is lengthy but is not incorrect. However, by referring to 'variable ratio schedule' when defining 'randomised reward,' the Bills inappropriately used overly technical language that neither a player nor a video game company would likely be able to understand without extensive research. The '"variable ratio schedule" of reinforcement' is a concept in behavioural psychology that refers to when a subject is being rewarded after an unpredictable number of responses. 95 Gambling games are generally seen as adopting the variable ratio schedule because the player never knows on which attempt they might win: for example, the player cannot predict when they would win at roulette by placing single number bets because on which number the ball lands on is always random. 96 In the randomised monetisation method context, a loot box adopts the variable ratio schedule if, for example, it contains ten rewards with nine rewards having a probability of 11% of being obtained and one (rarer and more valuable) reward having a probability of 1% of being obtained, because the player cannot predict when the more valuable reward with a 1% chance of being obtained will in fact be obtained. On the surface, most implementations of randomised monetisation methods appear to be based on a variable ratio schedule; however, implementations can also be based on a fixed ratio schedule. If the loot box in the previous example instead contains ten rewards each with a probability 93 H.B. 2686 s 2; S.B. 3024 s 2. 94 S.B. 3025, later during its legislative process, had all of its loot box-relevant sections deleted, and was amended to concern an unrelated matter. of 10% of being obtained, and assuming that all rewards are always subjectively of equal value to the player and that no duplicate rewards can be obtained, then this loot box implementation is operating on a fixed ratio schedule and not a variable ratio schedule. 97 This is because the player is guaranteed to obtain all ten rewards after ten tries and therefore they can predict that they will 'win' after ten tries because the process is not always random. This latter example is arguably fairer and more ethically designed than the first example; however, this latter implementation still represents a randomised monetisation method that poses the same potential harms (albeit potentially arguably less) as the first example. The Hawaiian Bills, however, would fail to capture this later example within its regulatory ambit because this hypothetical implementation is not using a 'variable ratio schedule' as defined, even though it is a loot box: this surely cannot have been the drafters' intentions.
Additionally, 66% of highest-grossing iPhone games in the PRC containing loot boxes implemented a submechanic known as a 'pity-timer,' which increases the probabilities of obtaining certain rarer rewards as the player purchases more loot boxes without obtaining a rarer reward. 98 Most implementations of pity-timers eventually guarantee that the player will obtain a rarer reward after a predetermined number of failed attempts: for example, the player is 'guaranteed' to obtain at least one rare 'S-rank battlesuit' within 100 loot box purchases in Honkai Impact 3rd (2016, miHoYo), as shown in Figure 2. The player may get 'lucky' and obtain an 'S-rank battlesuit' before buying and opening the 100th loot box; however, importantly, the player is guaranteed to obtain an 'S-rank battlesuit' when they buy and open the 100th loot box, if all previous 99 loot boxes did not provide an 'S-rank battlesuit'. By including a pity-timer submechanic, the randomised monetisation method arguably no longer employs a variable ratio schedule and instead adopts a fixed ratio schedule because, eventually, there will be no randomisation and the player is guaranteed to win. Therefore, the player can predict the results, albeit only the worst-case scenario. Accordingly, any randomised monetisation method implementing a pity-timer that guarantees specific rewards are arguably adopting a fixed ratio schedule of reinforcement and not a variable ratio schedule, and therefore may not necessarily be caught by the regulatory ambit of the Hawaiian Bills. Pity-timers are potentially capable of causing financial harms because they are designed to incentivise additional purchases and they complicate the decision-making environment for the player. 99 Allowing loot boxes implementing pity-timers to be immune from regulation is again undoubtedly contrary to the drafters' intentions, which would have been to minimise and prevent harm.
Due to the example loot boxes presented above being able to potentially dodge the law, any reference to 'variable ratio schedule' should be refrained from in any future loot box legislation. Indeed, it was entirely unnecessary to include this technical term as part of the definition in the Hawaiian Bills.

How a technical 'ban' was interpreted away: the need for enforcement powers
Having discussed the importance of using a neutral terminology to refer to randomised monetisation methods in future loot box regulation, and the pitfalls of unnecessarily using irrelevant technical terms, this paper turns to other aspects of the PRC loot box probability disclosure law that were unclear and allowed for discretionary interpretation by video game companies for their own benefits. Paragraph 6 of the Notice requires that video gaming service providers 'must not require' users to spend either legal tender (i.e. Chinese Renminbi Yuan) or 'online video gaming virtual currency,' defined in PRC law as 'in-game virtual currency which can be directly or indirectly bought at a certain conversion rate from the video gaming service provider using legal tender' 100 (colloquially known as 'premium' in-game currency), to purchase and engage with 'randomised "pull" mechanics'.
A strict literal interpretation of this Paragraph, specifically of the term 'must not require,' would conclude that all 'randomised "pull" mechanics' that require the player to spend real-world money to buy and engage with (e.g. paid loot boxes, rather than 'free' loot boxes bought using non-premium virtual currency which can only be obtained through gameplay or obtained by completing in-game tasks, such as defeating enemies) are effectively banned in the PRC as game companies are prohibited from providing them in return for either legal tender or premium virtual currency. This strict interpretation has been adopted by, for example, Blizzard Entertainment, a leading US game developer and publisher. Blizzard announced in June 2017 that it will change the method by which loot boxes in Overwatch (2016, Blizzard Entertainment) and card packs in Hearthstone (2014, Blizzard Entertainment), both 'randomised "pull" mechanics,' can be bought by players in the PRC 'in order to comply with new law and regulations'. 101 The timing of these announcements (June 2017) allows the inference to be drawn that the 'new law and regulations' (a phrase used in both announcements) that Blizzard was seeking to comply with must have been the Notice which became effective on 1 May 2017 and which was the only contemporaneous randomised monetisation methods-related regulation. Blizzard decided that, instead of directly selling loot boxes in exchange for either legal tender or premium virtual currency (which it must have believed to contravene the Notice), it will sell premium virtual currency for legal tender and additionally 'gift' the purchasing player loot boxes 'for free'. The premium virtual currency sold has minimum practical value, 102 and the number of loot boxes 'gifted' to the player for their purchase of premium virtual currency under the new system was the same as the number of loot boxes that the player would have received had they spent the same amount of money to directly buy loot boxes prior to the change under the old system. Blizzard's compliance was therefore duplicitous and has been referred to as a 'sham,' 103 because it took advantage of a loophole in the drafting language and obeyed only the letter of the law but not the spirit of the strict interpretation of the law. Nonetheless, Blizzard did adopt a strict interpretation of Paragraph 6; believed that the sale of loot boxes for legal tender and premium virtual currency is legally prohibited; and sought to comply with the law. A less strict interpretation of Paragraph 6 that is more convenient for the video gaming service providers is also tenable due to the imprecise drafting language of the Notice: specifically, the term 'must not require,' could instead be interpreted as meaning that 'randomised "pull" mechanics' can be offered in exchange for legal tender or premium virtual currency, but only if the player is also allowed the opportunity to engage with these same 'randomised "pull" mechanics' without spending either legal tender or premium virtual currency. Under this interpretation, video gaming service providers are not prohibited from providing paid 'randomised "pull" mechanics' as long as, for example, the player is allowed one free attempt every month or if the player can also purchase the same 'randomised "pull" mechanics' with non-premium virtual currency earned exclusively through gameplay. This less strict interpretation of Paragraph 6 appears to have been adopted by nearly all video game companies: 91% of the 100 highest-grossing iPhone games in the PRC were found to have contained such a mechanic, 104 and only one game surveyed (部 落冲突：皇室战争 [Clash Royale] (2016, Supercell)) adopted the strict interpretation and attempted to offer only virtual currency for sale and additionally '赠 [gift]' the player with loot boxes, as shown in Figure 3.
The widespread implementation of randomised monetisation methods in the PRC and the lack of any enforcement actions taken against their implementation indicate that the Figure 5. Screenshot of the in-game loot box probability disclosure of Ode to Heroes (2020, DH-Games), which is an Individual Reward-Based Disclosure. Note that the probabilities of obtaining different rewards in the same 5-star heroes category are different (0.0025% for some and 0.0053% for others). © 2020-2021 DH-Games. correct interpretation of the Notice is the second, more lenient interpretation. Supercell, the company operating the game shown in Figure 3, which attempted to 'gift' players with loot boxes rather than to sell them directly, has in its more recently published game, 荒野乱斗 [Brawl Stars] (Supercell, 2020 105 ), simply sold loot boxes directly, as shown in Figure 4. This suggests that even game companies that adopted the strict interpretation in the past has now transitioned to the more lenient interpretation upon appreciating that the more lenient interpretation is the version that is enforced. The Chinese experience suggests that if a country is to decide to ban certain implementations of randomised monetisation methods, then it ought to use clear wording when legislating on this point.
Further, for the ban to be effective, a regulator must be appointed to enforce the law by identifying both non-compliant companies and companies that may be trying to abuse loopholes in the law, e.g. Blizzard's questionable 'compliance' with the strict interpretation of the Notice in the PRC described above. By enforcing existing gambling law, Belgium has effectively banned all implementations of randomised monetisation methods, whilst the Netherlands has effectively banned certain implementations where the obtained rewards can be sold to other players for real-world money. 106 The Belgian and Dutch loot box regulations appear to have been effective at forcing video game companies to comply by changing the designs of their games because the respective gambling regulators of both countries have sought to actively enforce the law, 107 e.g. the Dutch gambling regulator fining Electronic Arts for implementing illegal loot boxes in its FIFA games (a decision which has since been upheld by the court, but which continues to be under appeal). 108 In contrast, in the UK, although the gambling regulator has opined that certain implementations of randomised monetisation methods where the obtained rewards can be sold to other players for real-world money contravene existing gambling law (identical to the Dutch position), 109 the regulator has taken no regulatory actions against plainly obvious contraventions, e.g. Electronic Arts's FIFA games remain unregulated. 110 This has meant that potential loot box harms persist in the UK, despite the fact that existing law should have been able to provide a degree of protection, albeit limited. Any future loot box regulation should designate a regulator that will enforce the law, and that regulator should actively enforce the law, to ensure that consumers would in fact be protected from potential harms as intended. Any future regulation should also ensure that the regulator is empowered to impose appropriate sanctions against non-compliant companies, e.g. fines and injunctions. 111 On this enforcement point, it is encouraging to see that Section 3 of Senate Bill S. 1629 had provided for enforcement powers by both the Federal Trade Commission to impose civil penalties for any violation, and by state attorneys general to apply to the court to seek, inter alia, an enjoinment and restitution.

Locations of probability disclosures
Paragraph 6 of the Notice specified that loot box probability disclosures made either in-game on the loot box's purchase page or on the game's official website are compliant with the law. This gave unnecessary discretion to video game companies as to where probability disclosures should be published: (a) only in-game; (b) only on the official website; or (c) at both locations. In a survey of the highest-grossing iPhone games containing loot boxes in the PRC, probability disclosures were found at both locations for 34% of games and at only one of either location for 62% of games. 112 This means that only a minority of games chose to disclose at both possible locations even though doing so would have maximised the potential consumer protection effects of the law by providing consumers with two alternative channels of obtaining the relevant information. When given discretion as to how to comply with the law, companies did not choose to exercise it in the way that would have most benefitted consumers. This discretion allowed by PRC law was therefore unnecessary and unsatisfactory.
Further, when given the choice (as was done through the Notice), video game companies prefer making website disclosures rather than in-game disclosures, even though website disclosures are predominantly inferior to in-game disclosures in terms of visual prominence and ease of access. 113 Generally, most website disclosures require players to expend more effort than most in-game disclosures to find because players need to exit the game app, open their internet browser, and search for the disclosures either through a search engine or by browsing the game's official website. Many players may not even realise that website-only disclosures are available, as there is almost always no indication of their existence when they purchase loot boxes in-game. In contrast, most in-game disclosures can be accessed through the loot box's purchase page, although some in-game disclosures would require more additional steps than others. 114 Accordingly, website disclosures are in theory less easily accessible than most in-game disclosures to players of the game. Further support for this proposition was found in a survey of more than 800 PRC video game players. Of participants who purchased loot boxes in the past year, more participants reported seeing probability disclosures in-game on the loot box purchase page (72%) than on the official website (43%). 115 This is despite the fact that more of the highest-grossing iPhone games in the PRC disclosed probabilities on the official website (73%) than in-game on the loot box purchase page (57%). 116 These empirical results demonstrate that in-game disclosures are indeed more readily accessible than official website disclosures in practice, despite being less widely implemented. However, many video game companies did not choose to make the more accessible in-game disclosures, and instead chose to make only official website disclosures: of the games containing loot boxes that disclosed probabilities at only one of either location in Xiao et al.'s survey, 37.5% disclosed probabilities only ingame on the loot box's purchase page and 62.5% disclosed probabilities only on the 112 Xiao and others, 'Gaming the system' (n 7). 113 ibid. 114 See ibid. 115 Leon Y Xiao, Tullia C Fraser and Philip WS Newall, 'Opening Pandora's Loot Box: Novel Links with Gambling, and Player Opinions on Probability Disclosures and Pity-Timers in China' <https://psyarxiv.com/837dv/> accessed 28 May 2021. 116 Xiao and others, 'Gaming the system' (n 7). game's official website. 117 Through such suboptimal compliance, by choosing website disclosures over in-game disclosures, companies exercised their discretion (unnecessarily allowed by PRC law) to the detriment of the consumer by causing the probability disclosures to be more difficult to access and therefore rendered players less likely to benefit from the measure's consumer protection benefits.
Indeed, providing in-game disclosures only is also inadequate at providing sufficient consumer protection because of two reasons. Firstly, even though in-game disclosures may be more prominent, official website disclosures are not redundant because Xiao et al.'s survey of PRC video game players found that 9% of loot box purchasers reported only seeing disclosures on the official website and not seeing them in-game, and were therefore solely relying on official website disclosure for access to this information. 118 Accordingly, if official website disclosures are not published, then a substantial minority of players may potentially never have access to probability disclosures. Secondly, players are not the only people interested in the relevant probability disclosures. For example, when children are playing video games and considering buying loot boxes, their parents may be the actual 'consumers' because the parents may be ultimately paying for the loot boxes. Additionally, parents have an interest in being made aware that their children are engaging with a mechanic that has been linked to gambling. Even parents who play video games and are familiar with the concept of loot boxes do not necessarily play the same game as their children, and so would not necessarily be familiar with every loot box mechanic that their children may encounter. Similarly, the regulators assigned to monitor compliance with loot box probability disclosure requirements would need to examine thousands of games, and it would be particularly inefficient if such regulators can only, and therefore must, access the disclosures after significant periods of irrelevant gameplay. Therefore, parents and other similarly interested parties (including regulators) should also be provided with easy access to the probability disclosures. However, accessing an in-game-only disclosure requires a person to invest time and play the game for an extended period of time up until the loot box feature is introduced (on average, this takes 20-30 min, but it may potentially take significantly longer to encounter a specific loot box that appears late in the game). Parents and other interested parties may not want to, or be able to afford to, spend such a length of time, and they may even find it too difficult to progress that far through the game, and therefore they would not be able to easily access in-game-only disclosures. For this reason, probability disclosures should also be provided at other locations, such as on the game's official website, to facilitate ready access by non-players, e.g. parents, who are nonetheless interested in this information.
Website-only and in-game-only disclosures both fail to maximise consumer protection: disclosing at both locations is evidently better than disclosing only at one of either locations. However, a majority of video game companies (62%) in the PRC have not sought to provide maximum consumer protection to their players and other interested parties such as parents by disclosing at both locations, and have instead sought to comply only minimally with the law by disclosing probabilities at only one location. 119 117 ibid. 118 Xiao and others, 'Opening Pandora's Loot Box' (n 115). 119 Xiao and others, 'Gaming the system' (n 7).
The potential consumer protection benefits of the PRC law can be improved by explicitly requiring video game companies to disclose loot box probabilities both in-game and on the official website. Video game companies are likely to incur minimal additional compliance costs, but players and other interested parties alike will be better informed and benefit from the increased transparency. Indeed, there are other additional locations where disclosures can be made: for example, pinned to the top of the game's social media posts, and included in video trailers and other advertisements of the game. It might be suggested that policymakers, especially advertising regulators, should consider additionally explicitly requiring disclosure at such other locations. However, empirical data suggest that only 2% of loot box purchasers reported only seeing probability disclosures at locations other than on the in-game loot box purchase page or the official website, and were therefore solely relying on disclosures at these other locations. 120 This suggests that disclosures at other locations, such as on social media accounts and game forums, are likely to be only of minor assistance to most players and may be redundant even to this very small minority of players, if probability disclosures are already prominently published in-game and on the official website. Disclosures at other locations are potentially helpful for a very small minority of players, and the costs incurred by companies to publish them there (in addition to in-game and official website disclosures) are likely minimal. Disclosure at various locations should be encouraged to assist that very small minority of players, but empirical data suggest that regulation should focus on requiring prominent in-game and official website disclosure.
Therefore, PRC loot box probability disclosure regulation can be improved: Paragraph 6 of the Notice should be amended to explicitly require disclosure both in-game and on the official website by switching the conjunction of '或者 [or]' used in the drafting language to '以及 [and]' or '和 [and]'. It was not necessary in this context to have given companies discretion as to where they should publish probability disclosures: allowing them this discretion only led to suboptimal compliance with the law that failed to maximise the measure's consumer protection benefits. If loot box probability disclosure is to be required by law in other countries, the drafting language of the relevant regulation should explicitly require disclosure both in-game on the loot box's purchase page and on the official website of the game. Hawaiian Bills H.B. 2727 and S.B. 3025, which sought to require probability disclosures, failed to explicitly delineate exactly where probability disclosures should be made and instead stated only that: Video game publishers … shall prominently disclose and publish to the consumer the probability rates of receiving each type of randomized reward or rewards at the time of purchase and at the time any mechanism to receive a randomized reward or rewards is activated so as to meaningfully inform the consumer's decision prior to the purchase or activation of any mechanism to receive a randomized reward or rewards. 121 The wording of 'disclose … at the time of purchase and at the time any mechanism … is activated' can be interpreted to mean the in-game purchase page where the randomised monetisation method can be bought, as that would be when the purchase would be made and when the mechanism would be activated. However, if the in-game loot box purchase page was the drafters' intended location for where disclosures were to be made, then this should have been explicitly stated. Further, the Hawaiian Bills cannot be interpretated as having required official website disclosures, which as evidenced above, is of potential benefit to a substantial minority of players who only access official website disclosures, and is of significant and irreplaceable potential benefit to interested nonplayers who do not want to, or cannot, play the game to find the relevant disclosure, e.g. parents of child players and regulators seeking to monitor compliance across thousands of games. The Hawaiian Bills could have been improved to emulate the Notice by explicitly stating the locations at which the disclosures should be made.

Accessibility of disclosures
A second aspect where PRC loot box probability disclosure regulation gave game companies discretion as to how to comply with the law is with the prominence and accessibility of the published disclosures. In relation to in-game disclosures, the most prominent format found was automatically displaying the disclosure without requiring any additional input from the player; in contrast, the least prominent in-game format was requiring the player to contact the customer support bot and ask for the probabilities. 122 In relation to official website disclosures, the most prominent format found was directly linking the probabilities from the homepage of the website; in contrast, the least prominent official website format was not linking the webpage from the official website at all, and instead requiring players to search for the relevant webpage containing the probability disclosures through a search engine. 123 Other formats of both in-game and website disclosures which were middling in terms of accessibility were also identified. 124 It is obvious that more prominent and accessible disclosures would be of more benefit to the consumers because more players will easily see them and no player would be required to struggle for an extended period of time whilst trying to find the disclosure (some players may give up on trying to find the disclosure if they cannot easily find it after a short period of time and therefore derive no benefit from the measure). However, Xiao et al.'s survey of the highest-grossing iPhone games found that only 19% of games containing loot boxes used a reasonably prominent disclosure format at either location, and only 1% of games containing loot boxes used reasonably prominent disclosure formats at both locations. 125 These results reflect that the vast majority of video game companies have not sought to implement prominent and accessible disclosure formats when they were given discretion as to how to comply with the law. PRC law can be improved by requiring uniform and prominent disclosures at both locations. Similarly, future loot box probability disclosure regulation in other countries should set out specific requirements before being imposed. Hawaiian Bills H.B. 2727 and S.B. 3025, which sought to require probability disclosures, failed to do so: instead, these required only that the disclosures should be made 'prominently'. 126 Firstly, prominence is subjective, and it would be difficult for a standard to be identified and applied to assess whether a disclosure is compliant. Secondly, reference only to prominence fails to ensure that the disclosure made across different games would be uniform. It would be most useful to 122 Xiao and others, 'Gaming the system' (n 7). 123  players if they are able to find probability disclosures in different games using the same method, similar to uniform product warning labels on alcoholic beverages in the US, for example. 127 An industry standard method of disclosure should be required. 128

Level of detail that should be required
Another aspect to consider when drafting loot box probability disclosure regulation is the level of detail that the required disclosure should provide. Two different levels of detail can be identified in existing implementations: (1) 'Individual Reward-Based Disclosures' disclosed the probabilities of obtaining each potential reward, meaning that, if a loot box contains ten different rewards (Rewards 1-10) of three different rarity categories (Rarity levels A-C), the disclosure would show the probabilities of obtaining each of the ten different rewards (as shown in the left column of Table 1 and in Figure 5).
(2) 'Category-Based Disclosures' disclosed the probabilities of obtaining a reward in each rarity category, meaning that, if a loot box contains ten different rewards of three different rarities, the disclosure would show the probabilities of obtaining a reward from each of the three rarity categories (as shown in the right column of Table 1 and in Figure 6).
The exact level of detail required by PRC law is set out in Paragraph 6 of Notice: the 'names; properties; contents and quantities' of 'all' virtual rewards or 'value-adding services [i.e. randomised fusion mechanics]' must be disclosed alongside the relevant probabilities. This means that PRC law requires Individual Reward-Based Disclosures because a Category-Based Disclosure alone fails to disclose the names of all virtual rewards and their corresponding probabilities, as required. This particular issue has been reported in China Consumer News, the newspaper supervised by the State Administration for Market Regulation [国家市场监督管理总局] and sponsored by the quasi-governmental China Consumers Association [中国消费者协会]: an article published in January 2021 recognised that Category-Based Disclosures, as implemented in the game Shining Nikki [闪耀暖暖] (2019, Papergames), were non-compliant with the law and that only Individual Reward-Based Disclosures would have been compliant. 129 Both disclosure types have advantages and disadvantages. Individual Reward-Based Disclosures ensure that a consumer will be able to find specific, detailed information about any potential reward that they are looking for. However, a legally compliant Individual Reward-Based Disclosure can result in information overload that is detrimental to the consumer's interests. 130 As an example, the probability disclosure for one loot box type implemented in Game of Thrones: Winter Is Coming (Yoozoo Games, 2019) listed 80 different possible rewards, in addition to providing information on how its pity-timer mechanic 131 further influences the probabilities of 19 rewards on the tenth purchase of the loot box. 132 This culminated in a probability disclosure which was presented on a lengthy spreadsheet, which may be intimidating for a player to read and may simply be providing too much information for them to comfortably process, thus resulting in information overload that may actually reduce the effectiveness of the disclosure. Players (particularly those with limited numeracy skills) may conceivably decide not to attempt to read this complicated disclosure, and therefore derive no consumer protection benefit from the PRC law. This problem is further excecated by the fact that the abovementioned disclosure was made using a screenshot of the spreadsheet and not text, which means that the player cannot use their devices' search functions to quickly and easily find the specific information that they are looking for. 133 Certain loot boxes are known to contain more than 1000 different potential rewards: 134 when Individual Reward-Based Disclosures are required by law, video game companies may seek to Table 1. Hypothetical loot box probability disclosures illustrating the two different levels of detail.
Individual reward-based disclosure Category-based disclosure reduce the effectiveness of this consumer protection measure by complicating loot box design to contain more and more rewards and overload the probability disclosure with an extreme amount of information. 135 On the other hand, Category-Based Disclosures are technically non-compliant with PRC law because they fail to provide the consumer with the exact probabilities of obtaining every potential reward, meaning that the consumer would be unable to find out the relevant probabilities of obtaining any specific reward that they are hoping to obtain. Category-Based Disclosures imply that all rewards in the same categories have the same probabilities of being obtained, but as shown in Figure 5, the probabilities of obtaining different rewards belonging to the same category are sometimes actually different in certain games: providing a Category-Based Disclosure in such a game would have been misleading. However, there are also unique benefits to a Category-Based Disclosure: there are usually no more than five rarity categories, meaning that the length of a Category-Based Disclosure would usually be significantly shorter than an Individual Reward-Based Disclosure. From a consumer protection perspective, a substantial proportion of players would benefit simply by being informed of how unlikely it is to obtain a high rarity reward and thereby discouraged from making unreasonably large purchases: these players do not necessarily need to know, nor do they want to know, the probabilities of obtaining every individual reward. For these players, a concise, unintimidating and easy to understand Category-Based Disclosure listing no more than a handful of percentages (e.g. Figure 6) would not only be sufficient, but also likely to be the more helpful disclosure format when compared to Individual Reward-Based Disclosures.
A balance ought to be struck between providing consumers with all relevant information and avoiding subjecting them to information overload. Providing consumers with the option to access both formats of disclosure would achieve this goal: for example, initially automatically providing a simple Category-Based Disclosure to all players and then allowing interested players to access the more detailed Individual Reward-Based Disclosure by pressing a specific button, e.g. a button stating 'More disclosure details'. As argued above, future loot box probability disclosure law should seek to require prominent and uniform disclosures to best help inform consumers: such regulation should incorporate the following requirements: (i) both Category-Based Disclosures and Individual Reward-Based Disclosure should be shown; (ii) Category-Based Disclosures should be shown first; and (iii) Individual Reward-Based Disclosure should be easily accessible to those consumers who do want to see it.

Pity-timers and changing probabilities
One final aspect that loot box probability disclosure regulation should be mindful of is when the probabilities change. One widely implemented method by which the probabilities of obtaining potential rewards change is through pity-timers: 136 generally, these submechanics increase the probabilities of obtaining rarer rewards as the player buys more loot boxes without obtaining a rare reward. Pity-timers may be implemented in two ways: (1) 'Separate Probability Table Pity-Timers:' some games' loot boxes use a different probability table for specific numbered pulls, for example, in PES CARD COLLECTION (2017,  Konami), the 1st to 10th pulls use one the regular loot box probability table that allows for all potential rewards of all rarities to be obtained, whilst the 11th pull uses a different probability table that only allows for rewards of higher rarities to be obtained. The probabilities of obtaining any particular reward from either table never changes; the pity-timer improves the player's probabilities by literally applying a different probability table.
(2) 'Constantly Changing Probability Pity-Timers:' other games' loot boxes change the probabilities of obtaining various rewards after each individual pull: this generally means incrementally increasing the probabilities of obtaining rarer rewards every time the player purchases a loot box, e.g. the probability of obtaining a specific rare reward would change from 1% to 1.01% after one pull; 1.11% after ten pulls; 5% after 80 pulls; and 100% after 99 pulls, as implemented in Mario Kart Tour (2019, Nintendo).
Paragraph 6 of the Notice requires that the probabilities disclosed must be 'true and effective'. Future loot box probability disclosure regulation in other countries will undoubtedly similarly require accurate disclosures. Separate Probability Table Pity-Timers are comparatively easy to disclose. The company has to disclose: the fact that multiple tables are used; when these tables are used; and the probabilities of each reward on all the tables. If all of these elements are disclosed, then the company has complied with its probability disclosure obligations. In contrast, Constantly Changing Probability Pity-Timers are more difficult to disclose because the probability values constantly change. If a game implements pity-timers, but fails to disclose how exactly the relevant probabilities would change, then its disclosure would be non-compliant with the law, e.g. when only a single unchanging probability table is disclosed when the game also discloses that it implements a pity-timer, as is done in Langrisser (2018, Zlongames). When a pity-timer is implemented, the probabilities on the unchanging disclosed table will only be accurate when the player has purchased no loot boxes, and the table will inevitably and immediately become inaccurate when the probabilities change after the player purchases just one single loot box. Other companies that have sought to disclose how the probabilities would change have adopted two different methods of disclosure for Constantly Changing Probability Pity-Timers. The first method is to provide a constantly updated probability disclosure table, as is done in Mario Kart Tour, as shown in Figure 7. Calculations need to be made after every single loot box purchase to ensure that the disclosed probabilities remain accurate, but such a disclosure would be complaint with PRC law.
The second method is to disclose the original, lowest possible probability of obtaining the rarer rewards that would apply if the player bought no loot boxes, and also to disclose the probability calculated after including the pity-timer mechanic into the calculation ('the "consolidated" probability'), as is done in Genshin Impact (2020, miHoYo). For example, this means that if a player has a 0.6% chance of obtaining a rare reward and that a pity-timer mechanic guarantees that the player will obtain at least one rare reward in every 90 pulls, then the original probability of 0.6%, and the consolidated probability that accounts for the pity-timer of approximately 1.4%, should be disclosed. 137 The aforementioned 0.6% chance of obtaining a rare reward and the pitytimer mechanic guaranteeing at least one rare reward in every 90 pulls are implemented in Genshin Impact, according to its probability disclosure. However, the game did not disclose 1.4% as the probability accounting for the pity-timer, and instead disclosed 1.6%. This has led to players uncovering that the game failed to disclose the true extent of how its pity-timer mechanic works: the game appears to have implemented an additional secondary pity-timer mechanic which increases the probabilities of obtaining rare rewards after 75 pulls. 138 The second method of pity-timer probability disclosure fails to reveal how exactly the pity-timer mechanic works. Game companies are in a position to easily and cheaply provide a constantly updated probability disclosure table, as done in Mario Kart Tour, because the game itself relies on this very table to decide what random rewards to allocate whenever the player buys a loot box.
The inaccurate (or at least incomplete) way in which the pity-timer mechanic in Genshin Impact was disclosed reveals that constantly changing loot box probabilities make it mathematically complicated for a player to calculate how likely they are to obtain a specific reward and how much they should expect to spend to do so. Pity- Figure 7. Mario Kart Tour implements a Constantly Changing Probability Pity-Timer, and its probability disclosure is updated live as the player purchases more loot boxes, as demonstrated by the corresponding values in the differently coloured circles: the left screenshot was taken before any loot boxes were bought, whilst the right screenshot was taken after 10 loot boxes were bought. © 2019-2020 Nintendo.
timer mechanics significantly obfuscates the decision-making environment for loot box purchases. To counteract this, regulation should require a constantly updated probability disclosure table to ensure that the consumer is always provided with the correct probabilities that will apply to their next purchase. Indeed, regulation should also consider whether to require the disclosure of exactly how the pity-timer mechanic works, and even whether pity-timer mechanics should be banned outright considering the confusion and the potential ensuing harms that they cause to consumers. Players' widespread confusion is evident through the many forum posts of players asking for advice about the pity-timer mechanics in Genshin Impact because the game has failed to explain this transparently and effectively. 139

Probability disclosure requirements
The same flaws in the drafting language, which allows for multiple potential interpretations and suboptimal compliance, identified in relation to the PRC law is also relevant to industry self-regulatory requirements. For example, Apple, the hardware and software platform provider for the iOS system, requires on the Apple App Store worldwide that: Apps offering "loot boxes" or other mechanisms that provide randomized virtual items for purchase must disclose the odds of receiving each type of item to customers prior to purchase. 140 The use of the terminology of 'loot boxes' in combination with the neutral term of 'other mechanisms that provide randomized virtual items for purchase' renders the definition provided satisfactory. However, similar to PRC law, Apple's self-regulatory rule made no requirements as to the location or accessibility of the disclosure, and therefore can be improved upon in those aspects. Further, Apple's requirement that 'the odds of receiving each type of item' be disclosed is open to interpretation. 'Each type' could mean each type of individual item, or it could mean each type or category of item. It is therefore unclear whether Apple requires Individual Reward-Based Disclosures or Category-Based Disclosures. Google Play Store on the Android platform also imposes self-regulatory loot box probability disclosure requirements: Apps and games offering mechanisms to receive randomized virtual items from a purchase including, but not limited to, "loot boxes" must clearly disclose the odds of receiving those items in advance of, and in close and timely proximity to, that purchase. 141 By using ' … including, but not limited to, … ,' Google admirably recognised that 'loot boxes' is just one type of randomised monetisation method. Apple and Google being able to not overuse and rely solely on the terminology of 'loot boxes' reflect that, both being industry companies, they have a better understanding of the intricacies of loot box design, and what this video gaming term actually means, than the drafters of PRC law. 142 Google also appears to be making a requirement as to prominence and accessibility of disclosures by requiring that the odds must be clearly disclosed 'in close and timely proximity to [the] purchase'. An official website disclosure is arguably not sufficiently physically and temporally close to the purchase to satisfy the requirement. Similar to Apple's self-regulatory requirements, Google's self-regulation can also be improved using the recommendations made in this paper. In the wider video game industry, so too can TIGA's (The Independent Game Developers' Association's) Five Principles for Safeguarding Players 143 and the Entertainment Software Association's (ESA's) recent commitment to disclosing loot box probabilities be improved. 144

Disclosure of the presence of loot boxes
Apple additionally requires the general disclosure of the presence of 'In-App Purchases' (which is a broad term that would include, but would not be limited to, randomised monetisation methods 145 ) by video game companies with a corresponding text label on the relevant Apple App Store page, but does not provide companies with the ability to specifically disclose the presence of randomised monetisation methods with a dedicated label. In contrast, PEGI (Pan-European Game Information) 146 and the ESRB (Entertainment Software Rating Board), 147 the video game content age rating providers for Europe and North America, respectively, began in 2020 to require the explicit disclosure of loot box presence in video games, in addition to the general presence of in-game purchases, with the dedicated content descriptors of 'In-Game Purchases (Includes Random Items)' and '(Includes Paid Random Items),' respectively. The mere disclosure of the presence of randomised monetisation methods by itself, without reference to other aspects of their implementation, such as pricing and whether competitive advantages may be obtained, arguably does not provide sufficient information to consumers for them to make informed purchasing decisions. 148 Nonetheless, such a specific content descriptor does equip consumers with more information, and therefore Apple (and other software platforms) should adopt a similar self-regulatory approach by requiring video game companies to explicitly disclose the presence of loot boxes and similar randomised monetisation methods, particularly in relation to games rated suitable for children, in order to better inform consumers (and parents) as to the content of the games they (or their children) may choose to download and play. Indeed, legal regulation could also consider imposing this disclosure obligation, which video game companies can easily comply with at minimal cost, as a non-restrictive, protective measure, whilst evidence of the potential harms of loot boxes is being collected.

Age rating of games containing loot boxes
One final aspect in relation to self-regulation that should be discussed is the age rating of video games containing randomised monetisation methods. The Apple App Store age rating for a game app is determined based on the video game company's self-declaration: the company must answer a series of questions about the game's content posed by Apple and is then automatically given an appropriate age rating. 149 This system is based on honesty and Apple does not have a self-regulatory enforcement system in place to punish companies for mis-rating games, the consequences of which, according to Apple, are external only: 'If your app is mis-rated, customers might be surprised by what they get, or it could trigger an inquiry from government regulators'. 150 According to Apple App Store's age rating system, a game containing 'Infrequent or mild simulated gambling' would be rated 12+, whilst a game containing 'Gambling or contests' and/or 'Frequent or intense simulated gambling' would be rated 17 + . 151 This means that games rated suitable for children aged 4 + and 9 + should not contain any simulated gambling or actual gambling. Loot boxes are conceptually either simulated gambling or actual gambling depending on their implementation, 152 even if they do not necessarily satisfy the legal definition for gambling in certain jurisdictions. 153 For this reason, if loot boxes are perceived as simulated gambling by video game companies, then games containing loot boxes should not be rated 4 + or 9 + . However, of highest-grossing iPhone games containing loot boxes, 34% in the PRC and 56% in the UK were rated either 4 + or 9 + . 154 It appears that many video game companies are not recognising and self-declaring loot boxes as simulated gambling. Further, loot boxes are often a core monetisation mechanic in the video games that contain them, and therefore, the appearance of loot boxes in most games containing them are 'frequent,' if not also 'intense'. For this reason, most if not all games containing loot boxes should be rated 17 + according to Apple's age rating system because of the inclusion of 'Frequent or intense simulated gambling'. However, it appears that many video game companies are also not recognising and self-declaring loot boxes as 'frequent' simulated gambling: of highest-grossing iPhone games containing loot boxes, only 37% in the PRC and 5% in the UK were rated 17 + . 155 This lack of recognition of loot boxes as simulated gambling (and by extension certain implementations as actual gambling which would satisfy the 'Gambling or contests' Apple age rating content descriptor and therefore mandate a 17 + rating) by Apple's age rating system mirrors the position taken by PEGI and the ESRB of not recognising loot boxes as simulated gambling or actual gambling when deciding on the appropriate 149 Apple, 'App Store Review Guidelines' (n 140) para 2.3.6. 150 ibid. 151 Apple, 'App Ratings -App Store Connect Help' (2021) <https://help.apple.com/app-store-connect/#/dev269f11291> accessed 10 July 2020. 152 Drummond and Sauer (n 1). 153 Xiao, 'Which Implementations of Loot Boxes Constitute Gambling?' (n 82). 154 Xiao and others, 'Gaming the system' (n 7); Zendle and others (n 6). 155 ibid. age rating to assign to a game. 156 PEGI has refused to label loot boxes with the 'Gambling' Content Descriptor (which indicates that 'The game contains elements that encourage or teach gambling. These simulations of gambling refer to games of chance that are normally carried out in casinos or gambling halls'. 157 158 Games with the PEGI 'Gambling' Content Descriptor must have an age rating of at least PEGI 12, meaning that such games would be appropriate only for those aged at least 12 and up. 159 Indeed, the Digital, Culture, Media and Sport Committee of the UK House of Commons, citing academics, has recognised that loot boxes satisfy PEGI's 'Gambling' Content Descriptor definition, 160 and has recommended that PEGI 'apply the existing "gambling" content labelling, and corresponding age limits, to games containing loot boxes that can be purchased for real-world money and do not reveal their contents before purchase'. 161 PEGI stated in October 2017 that: 'If a gambling commission would state that loot boxes are a form of gambling, then we would have to adjust our criteria to that'. 162 However, despite the Gambling Commission of the United Kingdom, 163 the Belgian Gaming Commission, 164 The Netherlands Gaming Authority 165 and the French Regulatory Authority for Online Games 166 all having concluded that certain types of loot box implementations constitute gambling under their national law, PEGI has continued to refuse to label games containing such loot boxes with the 'Gambling' Content Descriptor. Similarly, the ESRB has repeatedly denied that loot boxes constitute gambling. 167 If the ESRB identifies that 'Player can gamble without betting or wagering real cash or currency' in a video game, then it would be required to assign that game the Content Descriptor of 'Simulated Gambling' and at least the age rating of T: 'suitable for ages 13 and up'. 168 Further, if the ESRB identifies that 'Player can gamble, including betting or wagering real cash or currency' in a video game, then it would be required to assign that game the Content Descriptor of 'Real Gambling' and the age rating of AO: 'suitable only for adults ages 18 and up'. 169 The ESRB age rating system is exclusively self-regulatory and not legally enforceable in the United States, 170 but is legally enforceable in some Canadian provinces, e.g, Manitoba. 171 The PEGI age rating system has been recognised by the European Commission as 'a good example of self-regulation' 172 and does not have legal status in most European countries; however, it is legally enforceable in a few countries, e.g. the UK. 173 This is why had video games containing loot boxes been rated appropriately, a limited degree of consumer protection would have been provided to young children in some territories. However, similar to Apple's age rating system, the granting of both PEGI 174 and the ESRB 175 age ratings are based on self-declarations made by the relevant video game companies, and may then be amended by PEGI and the ESRB. It appears neither the video game companies nor the age rating boards are deeming loot boxes as simulated gambling or gambling.
The current Apple age ratings of many games do not appear to account for loot box presence, 176 and neither does PEGI's nor the ESRB's. The presence of loot boxes is not considered by many video game companies and video game content self-regulators as a relevant factor when determining the appropriate age rating for a game. This approach should be reconsidered given that previous research has established that loot boxes are structurally and psychological similar to gambling, and that loot box purchasing is related to problem gambling and may therefore be potentially harmful. 177 5. A few words of caution 5.1. Are probability disclosures even effective?
Loot box probability disclosure was recommended as a consumer protection measure 178 and adopted in the PRC without any empirical assessment as to their effectiveness having been conducted. A cross-sectional survey of PRC video game players suggests that this measure is unlikely to be effective at reducing loot box spending because only 16.4% of players who purchased loot boxes in the past year self-reported having spent less money on loot boxes because of seeing probability disclosure; 179 indeed, even if probability disclosures are required by well-enforced law to be prominent and accessible such that all players will see them, loot box probability disclosure would only have a theoretical maximum effectiveness of 19.3% at reducing spending. 180 Further study of the effectiveness of loot box probability disclosures as a consumer protection measure is required to make conclusions as to the potential long-term benefits of this measure. Regulators and policymakers should be cautious when considering imposing probability disclosure requirements because this measure is unlikely to 'solve' the problem of loot boxes and prevent all potential harms. Indeed, the short-term imposition of probability disclosure requirements, as an interim measure, to address the risks of potential loot box harms may be appropriate based on the precautionary principle of public health (that the lack of scientific certainty cannot justify regulatory inactivity in cases of high risk); however, long-term imposition should be informed by further empirical research as to the harm minimisation effectiveness of probability disclosures.

Limitations of existing 'international' policy recommendations
Prior legal research on loot boxes tended to focus on recommending regulatory solutions and law reform that seek harmonisation and are, allegedly, applicable internationally 181 or at least to multiple countries in a region, e.g. the European Single Market. 182 Three assumptions underlie these prior works: firstly, that loot boxes are implemented by video game companies in different countries in the same way; secondly, that consumers in different countries engage with loot boxes in the same way and to the same extent; and thirdly, that the same consumer protection measures would be equally effective across different countries. Recent empirical results with cross-cultural perspectives suggest that these three assumptions are not necessarily true, potentially because of social factors and differing legal contexts (e.g. whether gambling is regulated as a licensable activity or prohibited).
As to the first assumption, the prevalence of loot boxes in Western and non-Western video game markets is vastly different: 59% of the 100 highest-grossing iPhone games in the UK contained loot boxes in 2019, 183 whilst a significantly higher 91% did in the PRC in 2020. 184 Other countries could have significantly lower loot box prevalence. A regulatory measure on loot boxes, if imposed in the PRC, would require substantially more video games to change how they are designed in order to comply with the law, than if the same measure is imposed in the UK or another country with even lower loot box prevalence. As to the second assumption, the primary jurisprudential basis for regulating loot boxes that has been, and continues to be, relied upon by academics and policymakers is the positive correlation between loot box purchasing and problem gambling severity, 185 and that consumers, especially children, should be protected from potential harms, despite the current lack of scientific evidence of harm, due to the high level of risks involved, based on the precautionary principle of public health. 186 This means that the justification for regulation would be weaker in countries where this relationship between loot box purchasing and problem gambling severity is weaker, or even non-existent. Such national and cultural differences do exist: a cross-cultural study examining three countries found that the strength of this relationship in Aotearoa New Zealand is weaker than those in the US and in Australia. 187 Significant differences in the strength of this relationship in various countries may justify different jurisdictions to take divergent regulatory approaches to loot boxes, especially in light of the fact that this difference identified by Drummond et al. was amongst three countries in Western society that are relatively homogenous, and therefore more similar to each other than they are to non-Western countries. 188 Another study of this relationship in a non-western country, the PRC, failed to find a statistically significant correlation, 189 which suggests that relationships between loot boxes and gambling in the PRC is generally weaker than those previously observed in Western countries. 190 Consumers in certain countries, such as the PRC, are more likely to be exposed to loot boxes than consumers in other countries, such as Western countries, because of the increased prevalence of loot boxes. However, the strength of the relationship between loot box purchasing and problem gambling severity appears weaker in the PRC than in Western countries. Given the existence of such structural differences in the video game markets, and such psychological differences in the players' loot box purchasing behaviour, the third assumption that the same consumer protection measures would somehow be effective across different countries therefore ought to be questioned. Regulators and policymakers in different countries should consider taking divergent approaches to loot box regulation by finding solutions which would best protect their unique population of video game players ('playerbase'), whilst balancing the economic interests of their distinctive video game market, rather than to blindly follow the regulatory approach of another specific country. More practically, countries should conduct national research on loot box harms before imposing long-term legal restrictions on loot box sales that are likely to curtail both the players' freedom to purchase loot boxes and play certain video games, and the video game companies' commercial interests. Instead of attempting to achieve an international standard of consumer protection, 191 divergent yet conscientious regulatory actions in different countries may therefore not only be justifiable, but also be more desirable.

Conclusion
The potential harms of loot boxes, or more accurately, randomised monetisation methods, have been increasingly recognised by regulators and policymakers.
Regulation of some manner is likely forthcoming in many countries. The drafting language of such future laws ought to not only be sufficiently technically aware so as to prevent suboptimal compliance by video game companies seeking to skirt the rules, but also not be overly technical so as to be too difficult for consumers to understand and for companies to comply. By examining the drafting language of loot box probability disclosure law in the PRC, and of five Bills concerning loot boxes that never passed into law in the US, and by interpreting the results from two empirical studies on the compliance actions taken by companies and on the self-reported effects of probability disclosures on players' loot box purchasing behaviour, a number of recommendations have been made. Firstly, in the drafting language of future laws, the use of a neutral terminology such as 'randomised monetisation method' to describe these mechanics should be preferred over the use of the terminology of 'loot boxes' (and of other terms such as 'randomised "pull" mechanics' and 'randomised "fusion" mechanics') in isolation to avoid misleading players and companies alike as to what mechanics would be covered by the regulation. Secondly, any future regulation should be complemented with adequate enforcement powers by assigning a regulator that can ably monitor compliance, and deter and punish non-compliance. Thirdly, any future regulation should delineate specific methods of compliance rather than to allow companies discretion as to how to comply with the law: in relation to probability disclosures, this means explicitly requiring disclosures at specific locations (in-game on the loot box purchase page and on the game's official website); to provide a sufficient, but not overly complicated, degree of detail (initially Category-Based Disclosures but with the option for players to subsequently access Individual Reward-Based Disclosures); and to be accessible in a specified, uniform and industrystandard manner. Fourthly, prospective regulation should recognise certain submechanics of loot boxes, such as pity-timers, which gradually change the player's probabilities of obtaining rarer rewards and carefully consider how to regulate them: should they be required to be disclosed in a specific way or should they be banned outright? Finally, in light of potential differences in the structure of national video game markets (e.g. prevalence of loot box implementation) and in the cognition and purchasing behaviour of players from various jurisdictions, policymakers in different countries should consider what degree of loot box regulation is appropriate for their country, rather than to blindly copy the regulation adopted in another country.