Loot Boxes, Teens & COPPA: the FTC’s First Games Enforcement for 2025

On January 17, 2025, the US Federal Trade Commission (FTC) announced a major enforcement action against HoYoverse, the makers of the mega-hit video game “Genshin Impact.” To settle the complaint, HoYoverse will be required among other things to pay a US$20 million fine, enter into a ten-year compliance monitoring program, delete any personal information collected from children without parental consent, and cease selling items via randomized “loot boxes” to players under 16 without verifiable parental consent (VPC).

‍

BOTTOM LINE: In addition to serving as another example of the FTC’s ongoing and aggressive enforcement of the Children’s Online Privacy Protection Act (COPPA), this FTC settlement could have an enormous impact on the games industry at large. This is because the FTC’s complaint raises questions about whether selling “loot boxes” to children and teens without VPC constitutes an “unfair and deceptive trade practice” under Section 5 of the FTC Act. 

‍

Key takeaways:

‍

• The FTC continues to cast a wide net in interpreting games as “child-directed” under COPPA. Like Epic Games’ Fortnite (which was subject to a similar FTC enforcement action in 2022), Genshin Impact is rated “T” for Teen by the Entertainment Software Ratings Board (ESRB), and listed as “12+” on the Apple App Store. Genshin Impact received the rating due to the game’s fantasy violence and alcohol references. Nevertheless, the FTC looked at the game’s content, which includes cute and childlike anime characters engaged in bloodless combat, along with HoYoverse’s advertising activities (e.g., promotional materials likely to appeal to children, partnering with influencers with large underage followings, etc) to conclude that Genshin Impact was “child-directed” for purposes of COPPA. The complaint notes that upon becoming aware of the FTC’s investigation, HoYoverse added a “Children’s Notice” in its privacy policy in 2022 that stated that children were not permitted to play its games. However, the FTC alleged the company did not include a neutral age screening mechanism or take any efforts to obtain parental consent from players suspected to be children, as is required for mixed-audience games under COPPA.
  
  
• The FTC alleged that Genshin Impact’s currency and loot box practices were confusing and deceptive. Much of the FTC complaint alleges that HoYoverse’s monetization scheme was complicated and confusing due to the use of multiple layers of currency sold in a variety of packs that “create[d] abstraction between the real money spent and the player’s purchases in the game.” The complaint also describes HoYoverse’s allegedly aggressive and occasionally deceptive advertising and promotion of loot boxes. The complaint discusses an incident when HoYoverse partnered with an influencer to create a promotional video designed to look like real gameplay, but the video was altered to show the influencer pulling  an ultra-rare item from a loot box in a way that differed from the actual game experience. The complaint also notes multiple places where HoYoverse’s odds disclosures were alleged to be inaccurate or misleading.
  
  
• In addition to COPPA violations, the FTC argued that selling loot boxes to children and teenagers without VPC is legally actionable. At multiple places in the complaint, the FTC argues that special risks are posed to children and teenagers from loot box mechanics: the FTC notes that children and teenagers “are less likely than adults to understand what they are spending or the real costs of desired digital items,” and may have “less developed executive function and behave more impulsively than adults,” causing them to be at increased risk. 

‍

Count V of the FTC’s complaint is especially notable because it alleges that the publisher’s  promotion and sale of loot boxes to players under 18 year old constitutes an “unfair act[ ] or practice[ ] in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), (n).” The full text of Count V is reproduced here:

‍

These few short paragraphs have the potential to radically impact the US games industry, but they are also (frustratingly) vague. The language above could imply that any sale of a loot box to a player under 18 would be a de facto unfair or deceptive trade practice. However, that interpretation would be inconsistent with the penalty actually imposed by the FTC, which allows HoYoverse to continue selling loot boxes so long as they are not misleading and a parent consents on behalf of any player under 16. The FTC’s own blogs discussing the case don’t really resolve this ambiguity: one blog calls out the lack of VPC for loot boxes as the main headline, whereas another blog with “tips for businesses” focuses only on the deception issue and is silent regarding whether parental consent for loot boxes is required.

‍

Because the FTC complaint here was settled and the final order was negotiated (as is typical in these enforcements), it is hard to know with certainty what the FTC's final position is on loot boxes for younger audiences. We hope to receive more clarity in the coming months, especially as Republican Commissioner Andrew N. Ferguson becomes the new FTC Chair. It is notable that Commissioner Ferguson dissented with respect to the inclusion of Count V above, calling it a “wholly novel theor[y] of liability” unsupported by evidence, but even he left open the possibility that future loot box schemes directed at minors could be deemed unfair. Regardless of what the FTC does however, Count V is hugely important because it gives the green light to any State Attorney General or private class action litigant to start filing lawsuits under their state’s “unfair business practices” statutes (modeled after the FTC Act), citing the HoYoverse complaint as precedent. Judges in these cases may be sympathetic to child plaintiffs, and may allow these cases to move forward regardless of what the FTC does next. 

‍

What should businesses do? Given the major increase in the risk of US lawsuits for any game that (a) is likely to appeal to children and/or teenagers, and (b) features paid loot box mechanics, we expect the industry to quickly reassess their COPPA compliance and look for VPC solutions for young players at scale. With respect to (a), businesses should be reminded that ESRB and app store ratings and Terms language purporting to block kids will not stop the FTC from classifying a game as child-directed. With respect to (b), and given the FTC’s other major news story this past week, the updated COPPA rule, game companies can mitigate their risk by ensuring that VPC is freely given and active (as opposed to presented solely on a “take it or leave it” basis), and that  parents can turn off loot boxes but still allow their child to play and use other game features. 

‍

Fortunately, k-ID’s unique Global Compliance Engine was built for this exact purpose: it provides game developers peace of mind and the option for a flexible compliance strategy, while offering parents greater control over their children’s gaming experience in a legally compliant manner. If you’re interested in learning more about our Global Compliance Engine, please reach out.

‍

k-ID will also be convening a limited number of industry roundtables in the weeks ahead. These will be closed door sessions to give industry leaders the opportunity to discuss the settlement and its implications for the industry and different monetization practices. If you would like to attend one of these, please register your interest here. Confirmed registrants will be notified by email.

‍