Rocking the Boat: Loot Boxes in Online Digital Games, the Regulatory Challenge, and the EU’s Unfair Commercial Practices Directive

The loot box, a feature of online video games, contains randomised virtual items of importance to gameplay. Comparisons are drawn between chance-based loot boxes and the legal and psychological definitions of gambling, leading to concerns that the format may be an unregulated form of quasi-gambling. Globally, several jurisdictions have intervened to control the loot box, some applying national gambling laws, while others have implemented more general rules, an alternative described as “consumer protection”. In 2020, a study commissioned on behalf of the EU Parliament recommended that loot boxes and in-game purchasing systems be regulated from a “consumer protection” perspective. This paper questions firstly whether the debate on product-specific rules for loot box games was conducted in reverse, commencing with a set of potential solutions, while research on harms is still at an early stage. It interrogates the “consumer protection” route, critiquing proposals that borrow from the conceptually and structurally distinct areas of gambling law and consumer protection law, without first resolving the tensions between them. The paper proposes that an alternative paradigm of “player protection” may be the better route towards solving the regulatory puzzle of loot boxes. The paper secondly argues for the EU and its Member States to adopt an interim approach, relying on existing legislation to tackle immediate concerns and facilitate testing of remedial measures, but which leaves the door ajar to alternative options, including regulation under national gambling law frameworks. It examines the UCPD as an immediate solution and considers how the updated UCPD Guidance addresses questions of potentially exploitative game design.

the boundaries of established rules. Yet, with a projected annual global turnover of 20.3 billion U.S. dollars by 2025, it generates significant revenue for the online games industry (Clement, 2021). It presents questions of psychological, social, and financial risk for players, eludes the most obvious course of regulation though gambling law, and attracts consistently negative political, media and academic attention (Drummond & Sauer, 2018;Freedman, 2019;Griffiths, 2018;Hong, 2019;Wardle, 2021, pp. 67-71;Zendle & Cairns, 2018).
Current academic commentary on the legal challenges of regulating loot boxes accepts that no single regulatory approach is likely to provide suitable, consistently effective solutions for the psychological, social, and financial risks of interaction with the format (Derrington et al., 2021;Xiao, 2021a). Difficulties for legislators are compounded by the essentially quasi-gambling structure of game design, the current stage of research into risks, associated harms, and the time lags between game development, research outputs, and substantive evidence of harm. Recently, the Committee on Internal Market and Consumer Protection (IMCO Committee) of the EU Parliament requested a study to investigate loot boxes in online games and their effects on consumers, especially young consumers (Cerulli-Harms et al., 2020). The objective of this study was to identify measures which could improve the regulation of loot boxes in the EU, for which several strategies were recommended (Cerulli-Harms et al., 2020, pp. 11, 42, 43).
This paper makes two contributions to the discussion on control of loot boxes. First it questions whether the debate on product-specific rules for loot boxes may have been conducted in reverse, commencing with a set of potential solutions, when research on harms is still at an early stage. It then interrogates the "consumer protection" route to regulation, critiquing proposals that graft together two conceptually and structurally distinct areas of law, without first resolving the tensions between them. Moreover, the "consumer protection" approach detracts from an investigation of the wider legislative landscape. The paper suggests that an alternative paradigm of "player protection" might be preferred for examination of regulatory questions around loot boxes. This proposes a more expansive viewpoint, taking a more inclusive view of other relevant areas of law. Secondly, this paper disagrees with some conclusions of Cerulli-Harms et al. and argues for the EU and its Member States to take an interim approach, relying on existing legislation to tackle immediate concerns and facilitate testing of remedial measures. In this context, it examines the Unfair Commercial Practices Directive ("UCPD") (2005) as a means of adjudicating some problematic aspects of loot boxes and considers how the updated UCPD Guidance addresses questions of potentially exploitative game design (EU Commission, 2021a). For the EU, this suggests a faciliatory approach which supports Member State measures of regulation and enforcement, while leaving the door ajar to alternative options, including regulation under national gambling law frameworks.
After a preliminary outline of the loot box phenomenon, and the social science research on its perceived risks and harms, the first part of this paper will examine the path of regulatory action and offer a critical analysis of same, while making an argument for reframing the overall regulatory approach. In the second part, through the lens of the Cerulli-Harms et al. study and its recommendations, it will consider some consequences of the foregoing for the EU. It will do so by examining the scope of the UCPD and its updated Guidance as a regulatory benchmark for the loot box format and show how this facilitates a policy that enables continued Member State exploration of alternative regulatory options.
understood (Close & Lloyd, 2020;Kolandi-Matchett & Abbott, 2021). Two main strands of enquiry are being studied: one examines the proximity of loot boxes to problem gambling, the second interrogates use and effects of potentially abusive psychological techniques (including some which have their origins in gambling formats) in loot box game design and mechanics. A third strand of enquiry, also at early stages, questions the potential for development of problem gambling behaviours in children who play games containing loot boxes, and their vulnerabilities to the psychological techniques of loot box design and mechanics.

Loot Boxes and Gambling Techniques
Structural similarities between gambling and loot boxes led inevitably to questions of classification. Some research concluded that the loot box met all criteria for the psychological definition of gambling and might be regulated accordingly (Drummond & Sauer, 2018;Griffiths, 2018, p. 53). A slightly different line of enquiry pursues possible causal connections between loot boxes and development of problem gambling: (Brooks & Clarke, 2019;Drummond et al., 2020;Garea et al., 2021;Zendle, 2019;Zendle & Cairns, 2018Zendle et al. 2020a). Research indicates that problem gambling symptoms appear to be positively related to loot box purchases, although there is insufficient evidence to conclude that loot boxes are a "gateway" to problem gambling and causal connections will require further investigation (Delfabbro & King, 2020;Derrington et al., 2021).
Other research focusses on the effects of known gambling techniques, i.e. devices and strategies borrowed from gambling products, as tools for driving player spending and engagement. Encouragement of repeat purchases by making receipt of valued objects both random and rare is a known and controversial gambling technique which relies on a "variable ratio schedule of reinforcement" or intermittent rewards system, to sustain player engagement with the game (Drummond & Sauer, 2018;King & Delfabbro, 2018). The probability of winning is programmed, made random and unpredictable to encourage repeat spending (Derrington et al., 2021, p. 306). A second gambling technique used is the "near-miss" experience, which is commonly found in electronic gaming products such as slot machines and designed to retain a player's interactions with the device (Schüll, 2012a(Schüll, , 2012b. Zendle et al. express concern at use of these and other tactics, such as showing players rare items which they might have won instead of the item they received, especially as the effects of the "near-miss" "…have been linked to a variety of cognitive distortions during gambling." (Zendle et al., 2020a, p. 185). These strategies create an environment of "entrapment" which may cause the player to escalate spending (Cerulli-Harms et al., 2020, p. 26). For players in an unregulated environment, this generates risks of addiction, behavioural, psychological, and financial consequences.

Loot Boxes and Game Design Strategies
Other research examines exploitative game design techniques in games containing loot boxes. These techniques are recognised influencers and manipulators of marketplace behaviours and may deceive the player. The premise of the loot box is that the actual longterm cost of interaction with the monetised game is concealed from the player, creating transactional and situational risks. Game mechanics are structured with deliberately limited disclosure of the virtual item being offered, coupled with sophisticated systems of data harvesting and analytics. These are used in combination with machine learning strategies to generate tailored offers and solicitations (King et al., 2019, p. 138;Delfabbro & King, 2020). These techniques may be supplemented by features which are evocative of the gambling environment, such as sounds, lighting, dramatization of loot box openings, use of complex key mechanisms, and may also be used in combination with gambling techniques, making them challenging to untangle and analyse (Cerulli-Harms et al., 2020, pp. 25, 26). Research labels the combination of game strategies found in games containing loot boxes as "predatory," manipulative, unfair, and exploitative of the player, creating an environment through psychological and data manipulation where players are more likely to make "maladaptive purchasing decisions" (King & Delfabbro, 2018, p. 1967. King and Delfabbro describe a system deliberately structured to maximise player spending using "…systems that manipulate reward outcomes to reinforce purchasing behaviors over skillful or strategic play" (King & Delfabbro, 2018, p. 1967. The fairness of this game model is concerning because it capitalises "…on informational advantages (e.g., behavioral tracking) and data manipulation (e.g., price manipulation) to optimize offers to incentivize continuous spending, while offering limited or no guarantees or protections (e.g., refund entitlement), with potential to exploit vulnerable players (e.g., adolescents, problematic gamers)" (King et al., 2019, p. 131). In this way, loot box game design can create both transactional and situational risks, tilting the informational balance substantially away from the player. There is also evidence that established consumer deception techniques are used, such a time-limited offers, pricing strategies such as "bundling," use of virtual currencies to mask levels of financial outlay, all of which can lead to overspending (Delfabbro & King, 2020;King & Delfabbro, 2018;Petrovskaya & Zendle, 2021;Zendle et al., 2020a).

Loot Boxes and Children
Research on the effects of loot box game design and mechanics on children is still at an early stage. For younger players, online video games are an acknowledged source of entertainment, especially as so many game formats appeal to this age cohort. King et al. warn that adolescents "…tend to be most avid players…[they] may also be the most vulnerable and least well-informed consumer group" (King et al. 2019, p.143). The progress of research is hampered by a paucity of independently verified longitudinal data on children's interactions with online games (Cerulli-Harms et al. 2020;Kolandi-Matchett & Abbott, 2021;Lawn et al., 2020).
Research shows that exposure to monetised games and quasi-gambling activities at an early age may constitute a gateway to disordered gambling activity (Blaszczynski & Nower, 2002). One study of the interactions between children and loot box games observed that loot boxes shared "…important structural and psychological similarities with gambling" and they "…100% allow for (if not actively encourage) underage players to engage with these systems,", making loot-boxes a "ripe breeding ground" for development of problem gambling in children (Drummond & Sauer, 2018). More recent research connects loot-boxes with vulnerability to development of disordered gambling and gaming behaviours in children and adolescents, which may be exacerbated in older adolescents (Zendle et al., 2019, p. 17). The implications of this connection are as yet unclear, but "…may potentially lead to serious adverse consequences for younger gamers." (Delfabbro & King, 2020, pp. 7-9;Zendle et al., 2019, p. 17). Some research has yielded positive results for pathways between spending on loot boxes and development of problem gambling behaviours in adolescents (Derrington et al., 2021, p. 307;Zendle & Cairns, 2018;. A large-scale survey of 16-18 year olds conducted by Zendle et al. established that for this age-range at least, there were some links between development of problem gambling and games containing loot boxes, which combine certain features. This research concluded that games which enable the player to sell loot box rewards to third parties for value, "… either cause problem gambling among older adolescents, allow game companies to profit from adolescents with gambling problems for massive monetary rewards, or both of the above" (Zendle et al., 2019, p. 1). More recently, it was confirmed that adolescent loot box purchasing behaviour can be linked to problem gaming, creating questions around development of addictive symptoms in younger players (Ide et al., 2021).
Known developmental risk factors for children and adolescents also make them particularly vulnerable in the marketplace. Cerulli-Harms et al. report evidence that younger children find it difficult to assess the true cost of a product, they do not understand risk in the same way as adults do, and they are also susceptible to development of socially disordered behaviours in response to certain stimulii (Cerulli-Harms et al., 2020, p. 29). The study also reports that adolescents present an additional set of risks associated with development of disordered gambling behaviours: These include impulse control abilities and a tendency towards development of problem gambling habits (Cerulli-Harms et al., 2020, p. 29). The consequences of pressuring techniques and tactics on younger players such as prolonging player "time-on-device" through deliberate use of heightened interactive experiences, are also not yet fully known.
Potential risks and harms to children must be considered too within the "gamblification" of games. Gaming-gambling convergence is a relatively new phenomenon and describes the assimilation of gambling techniques and strategies into game formats and vice versa, resulting in hybrid products which may contain manipulative content (Brock & Johnson, 2021;Kolandi-Matchett & Abbott, 2021). Convergence poses questions about transitions between gameplay and gambling, and the causation pathways for development of disordered behaviours, especially in children and adolescents (Griffiths, 2008;Kolandi-Matchett & Abbott, 2021).

Loot Boxes: The Regulatory Debate
The loot box has proven itself a stubbornly recalcitrant subject of gambling law. The simple expedient of regulating loot boxes within gambling control frameworks ran aground at an early stage. In this part, the paper will first examine the regulatory history of the loot box, giving examples, and outline the "consumer protection" alternatives to formal gambling regulation. A critical assessment of the path to regulation considers whether the legislative question began with a misstep that may still need correction. The argument is made that a "consumer protection" label is conceptually misleading when the underlying regulatory proposal comprises two structurally disparate areas of law. The section concludes by suggesting an alternative, more holistic, "player protection" approach which goes beyond consumer protection and gambling law.

Regulatory Action on Loot Boxes-Some Examples
Legal definitions of gambling proved a stumbling-block to an ostensibly neat regulatory solution. Most definitions of gambling are based on the three essential transactional elements of a "game of chance": These are a "wager" or stake, the element of "chance," and a "prize". This is to state the legal definition at its simplest: Statutory definitions are usually complex, nuanced, and driven by regulatory objectives intended to capture either a narrow or broad range of activities. Although loot boxes can meet the legal criteria of "wager" and "chance," the key question for application of gambling laws has been whether loot box contents constitute a "prize." This hurdle for gambling laws concerns whether loot box contents have real-world value (Derrington et al., 2021, pp. 310-313). If the virtual item is valueless, then it is not a "prize" within the sense of most gambling laws: This was the case when the gambling laws of Denmark, Finland, France, Sweden, and the UK were examined (Cerulli-Harms et al., 2020, pp. 34-37). In Germany and Poland, where the definition of gambling was differently framed, law also failed to capture loot boxes (Cerulli-Harms et al., 2020, p. 36;Interplay, 2019). The key question then became whether purchasers of chance-based virtual game items could also "cash-out" loot box contents and convert them into realworld value. While some games will facilitate players wishing to sell unwanted virtual items to other players (potentially giving them a real-world value), most games do not allow this or leave such transactions to third-party websites (U.K. Report, 2019, p. 32). Social science research is dismissive of the value question, considering it tangential to the debate on whether loot boxes are gambling (Zendle et al., 2020a).
The situation in Belgium and the Netherlands illustrates the disparity of interpretation and lack of predictability if reliance is to be placed on gambling laws alone. In Belgium, loot boxes were considered to come within the national law definition of gambling (EU Commission, 2021a, p. 104). Here, purchase of a loot box was found to be the legal equivalent of placing a wager, since a "win" did not have to be in money or money's worth and the element of chance could be a secondary aspect of the transaction (Belgian Gaming Commission, 2018, pp. 10-12). In 2018 the Belgian regulator announced that loot boxes should be removed from games (Valentine, 2019). In the Netherlands, the gambling regulator initially considered that games containing loot boxes came under national gambling regulation if their contents were transferable and could be traded for value. In 2019 the regulator requested providers to remove loot box cash-out features from games (Valentine, 2019;Xiao, 2021aXiao, , 2021b. This decision was challenged by Electronic Arts, a games provider, initially without success (Sanders, 2021). However, in March 2022 the Dutch Council of State overturned the decision of the lower court in Electronic Arts Inc and Electronic Arts Swiss S.A.R.L. v Kansspelautoriteit (2022) and ruled that for the purpose of assessing whether the loot box was a gambling transaction, the entire game should be examined. On the Court's analysis, because the loot box could not be separated from the rest of the game for individual play and was only one element of the video game in question, it did not exist in isolation, and could not be considered gambling. The Court adopted the view that since the "vast majority" of players opened the loot box as an element of the game, its role was an element of game participation, rather than a standalone gambling product.
In other EU Member States, proposals to rely on gambling law persist: In March 2021, Spanish authorities commenced a public enquiry which proposes to investigate regulation through update of existing gambling laws (Menmuir, 2021). In Ireland, legislation to reform and update gambling law was expected to make specific rules for loot boxes (Murray, 2020). The proposed Irish reforms published in 2021 do not expressly refer to the format, although there is a degree of ambiguity in the definition of "gaming," which might yet prove sufficiently flexible to extend gambling regulation to loot boxes (Department of Justice, 2021).
Elsewhere, some alternatives are being explored under the umbrella of "consumer protection", a catch-all term for measures which combine elements of information disclosure and rules borrowed from the gambling regulator's toolbox. However, there seems to be significant variation between regulatory choices. In Japan and China, for example, chancebased loot boxes are not regulated under gambling law but are subject either to formatspecific rules or prohibited (Derrington et al., 2021, p. 314). In Japan, the first country to legislate, the exploitative elements of the loot box were targeted (Liu, 2019, p. 780). The rationale for intervention is to redress disparities between the cost of obtaining loot box rewards and the value of the prize or pay-out for completing a set of virtual items (Derrington et al., 2021, p. 315). In China, despite strict prohibitions on unlicensed gambling, regulators refrained from bringing the "…thriving video game industry business model" within gambling regulation. (Liu, 2019, p. 784). A set of format-specific rules were introduced, making loot box games subject to spending limits, setting mandatory disclosure obligations for the so-called drop-rate of loot box contents (i.e. the percentage chance of a particular item appearing in a loot box), and creating specific safeguarding measures to protect children through rules on identification, registration and payment confirmation (Derrington et al., 2021, p. 315;Frank, 2017;Liu, 2019, p. 784;Xiao & Henderson, 2021, p. 187). Xiao reports that in 2021 China introduced further measures which impose curfews on underage players (Xiao, 2022, p.43).
In South Korea, existing rules for protection of children apply to the game containing loot boxes (Derrington et al., 2021, p. 314;Liu, 2019, pp. 782-783;Xiao, 2021aXiao, , 2021b. The approach here is to rate games and then rely on parental control and supervision to monitor game play by children (Liu, 2019, p. 782). The South Korean Games Rating Board, a self-regulatory body organised by the Korean Association of Game Industry, acts as a regulator for games (Xiao, 2021a(Xiao, , 2021b). The Board rates games in a proactive manner, with discretion to refuse approval on several grounds, "…including a game's potential to constitute online gambling" (Derrington et al., 2021, p. 314). In one case where a game demonstrated features that blurred the lines with gambling, it refused to confer a rating until the offending feature was removed (Liu, 2019, p. 783). Xiao describes the operation of the regulatory board as "exemplary": It avoids collusion with "…influential games companies and does not discriminate against smaller games companies by targeting them" (Xiao, 2021a(Xiao, , 2021b. Steps to implement consumer protection rules have also been taken by the South Korean Fair Trade Commission which in 2018 fined one operator for failing to disclose that "…the probability of winning certain items" in one format of loot box game, "…was less than 1%" (Derrington et al., 2021, p. 314). South Korea also adopted rules on game spending limits for minors under the age of 19 and for adults. However, in both cases the measures were repealed by reason of "…unfair economic discrimination against the video game industry as compared to other creative industries" (Xiao, 2021a(Xiao, , 2021b. Curfews on play by minors are in place since 2011 and form part of the wider laws concerning gaming, and so were not enacted specifically to address concerns about loot box games (Xiao, 2021a(Xiao, , 2021b). Xiao has questioned the appropriateness of curfews as a measure which is "…particularly paternalistic, as they severely restrict the liberty of the individual" and this may explain why they have only been implemented against children (Xiao, 2021a(Xiao, , 2021b. Recent changes in South Korea appear to agree, since Xiao also reports that in 2021 some restrictions were lifted on players under 16, citing children rights to "…self-determination and to pursue happiness" (Xiao, 2022, p. 40).
An outright ban on a most forms of loot box was mooted in the US. In 2019 a "Loot Box Bill" was introduced in the US Senate but has since stalled. The Bill would have effectively banned most types of game monetization (Mann, 2020, p. 236). The Bill was criticised by the industry as poorly conceived and lacking insight into the commercial structures of the game development industry (Schrier, 2019;Schwidessen, 2018;Watts, 2019). It comes in the wake of a similar Bill in the Hawaiian parliament to counteract "predatory mechanisms" such as loot boxes. Declaring that consumer protection objectives justified an abolitionist policy, the Bill sought to prohibit sales to minors of digital games with randomised reward purchasing systems (State of Hawaii, 2018).
A real problem for regulators is the time lapse between development of new game formats and research outputs proving evidence of risk and harms to players. In Australia, a 2018 Senate Committee inquiry recommended a review of existing regulatory frameworks, including consumer protection legislation, to establish whether they "…adequately address issues unique to loot boxes" (Australian Report, 2018, pp. 72-73). Kolandi-Matchett and Abbott report that this recommendation was not accepted by Government due to "…the lack of research evidencing gambling harms from loot boxes" (Kolandi-Matchett & Abbott, 2021). A similar observation was made by the UK Parliamentary Committee which warned that "…there is not yet enough evidence to reliably conclude that loot boxes cause problem gambling" (U.K. Report, 2019, pp. 73, 81).

Controlling the Loot Box: The "Consumer Crotection" Alternative
Legal research on potential solutions is also at an early stage, and sector-specific proposals are still being developed. Xiao has analysed the overall legislative landscape, taking account of regulatory and non-regulatory schemes introduced so far and recommends a combination of self-regulation and legislative intervention. (Xiao, 2021a(Xiao, , 2021b). Derrington et al. propose a uniform approach to game categorization, based on an analysis of the known inherent risks of different formats of loot box game (Derrington et al., 2021). This framework recognises that the legal definition of gambling is a policy matter for different legislatures and focusses on the underlying game format to provide a new classification framework. The scheme proposes "tiered" levels of classification, ranging from game formats which should be considered gambling, to formats which may require less stringent control e.g., via games ratings and parental controls. There are advantages to this analysis: it begins from first principles, questioning the challenges which variations of the loot box product might present for different classes of player, cautioning against risks of over-regulation and undue interference in personal choice (Derrington et al., 2021, p. 302). It also creates a methodology for assessment of games. The proposal has not been subjected to practical testing, so further research and refinement may be necessary.
The difficulties encountered by legislators have also caused the scientific community to examine alternative measures that reconcile interactions between monetised game design, behavioural impacts, and consumer protection law (Petrovskaya & Zendle, 2021). A "consumer protection" approach for games containing loot boxes is intended to apply more general measures of control, particularly those which address psychological risks and potential harms to children (Derrington et al., 2021, p. 314). This "consumer protection" route borrows rules from gambling frameworks but is considered a more flexible instrument than gambling regulation.
For example, while Drummond et al. accept that not all loot boxes will meet the definition of gambling, they also noted that regardless of legal definitions, all loot box spending should be subject to limit-setting, cooling-off periods and suspension of play, all of which are measures commonly found in gambling control (Drummond et al., 2019). King and Delfabbro have developed a "social responsibility" model for industry self-regulation which provides a framework of measures also borrowed from models of consumer information and gambling regulation . This framework invokes concepts of ethical game design and information disclosure, supplemented by interventions derived from gambling regulation frameworks such as limit-setting and exclusion . The merits of this model are its customised measures designed to address the potential psychological harms of loot boxes, together with interventions designed to curb overspending (Xiao & Henderson, 2021). It has a wide scope and offers solutions for the broader problem of unfair practices in game monetization. The model has been criticised for the assumptions it makes concerning the effectiveness of self-regulation (Xiao & Henderson, 2021). It has also been questioned for the scale of proposed interventions, the risk of interfering in personal decision-making through paternalistic measures, and risks of overregulation (Xiao & Henderson, 2021;Xiao, 2021aXiao, , 2021b.

The Regulatory Solutions for Loot Boxes: A Skewed Debate?
The global legislative response to loot boxes may have been conducted in reverse: in the loot box format a set of potential harms was identified and where action was taken, the focus of legislators has been on the means of controlling loot boxes rather than the rationale and justification for control. This is a core weakness and may be a feature of the environment in which the risks of loot boxes were first investigated and articulated: it has largely been a debate initiated by analogies with gambling, coupled with urgency to intervene at regulatory level, to "do something" about loot boxes. This path to regulation may have bypassed some fundamental questions, such as the justificatory reasons for intervention, addressing conceptual questions, and identifying a clear set of regulatory goals. McCaffrey cautions against hasty regulation of loot boxes, a view with which this author agrees, warning that unconsidered public policy interventions may generate costs and unintended consequences which "… can create more harm than the problems they are intended to solve, and sometimes even worsen those problems" (McCaffrey, 2020). McCaffrey also recommends that the task of finding an appropriate policy response to the challenge of loot boxes is multidisciplinary, predicated on evidence of harm and implemented only to the extent of actual need (McCaffrey, 2019, p. 491). Product or sector-specific legislation for loot boxes and quasi-gambling game formats should be advanced based on sound evidentiary and public interest foundations, with due regard for the interests of all stakeholders.
Control of loot boxes and the wider spectrum of monetised games comes within the rubric of "lifestyle risk" regulation, of which other examples are regulation of tobacco products, alcoholic beverages, and unhealthy foods. Regulation of lifestyle risks involves questions of public policy and is generally prompted by scientifically identified harms (Alemanno & Garde, 2013;Somek, 2008, pp. 33-34). However, the fact of such evidence may not be sufficient to justify intervention: Regulation of risk behaviours involves interference in personal autonomy and with freedom of individual decision-making. Somek argues, for example, that tobacco-control legislation "…can only be democratically legitimate under certain restrictive conditions." (Somek, 2008, p. 61). According to Somek, in a pluralistic society, these conditions anticipate a combination of social and cultural debate, followed by a degree of consensus that regulatory intervention is necessary and justified. When these conditions prevail, they are the prerequisite to political and legislative action (Somek, 2008, pp. 61-80).
Taking Somek's analysis as one possible benchmark for regulatory action on loot boxes, the decision to enact product or sector-specific regulation should be preceded by clearly defined justifications based on public interest requirements of economic, legal, and ethical reasons, supported by evidence to justify action. In the case of games containing loot boxes, this is a greater prerequisite than merely identifying the measures most likely to mitigate harms. Legislative action on loot boxes involves interference in personal and transactional decision-making, and freedom to interact with a type of leisure activity having acknowledged educational and social benefits (Abarbanel, 2018, p. 233). It also has economic consequences: Until now, games providers have operated in a relatively unregulated environment, subject to compliance with any applicable industry standards and the general rules around transactions with purchasers.
The precautionary principle has been suggested as an alternative justificatory route to bypass the requirement for supported evidence of risks and harms (Kolandi-Matchett & Abbott, 2021). The principle justifies departure from a structured approach to the risk regulation process when there is "…plausible but insufficient scientific evidence of risk of harm" (Kolandi-Matchett & Abbott, 2021). Kolandi-Matchett and Abbott argue that where delays exist between research outputs and development of new gaming/gambling technologies, harms may become more established and of greater severity before they are identified, and this would justify precautionary regulation. Regulation of loot boxes justified by the precautionary principle is however more complicated than control of products, substances, and services. Use of the precautionary principle here involves regulation of behaviours as well as products. Reliance on the precautionary principle to justify intervention at this stage of research gives rise to questions about the scope of the principle and its use to regulate choice and exercise of personal freedoms, all of which have normative and jurisprudential consequences.

Consumer Protection or Player Protection?
As a potential solution based on existing legislation, the "consumer protection" model is also conceptually challenging: With foundations in two different strands of regulation, it amalgamates conceptually different types of legal mechanism. In the scientific literature, moves towards a "consumer protection" approach for loot boxes are justified by reasons of psychological risks and potential harms, especially to children (Derrington et al., 2021, p. 314). While this "consumer protection" route may appear more accessible than gambling regulation, it also poses some questions.
Firstly, the term "consumer protection" may be a misnomer when the real objective is to create a scheme of 'player protection' from a blend of consumer protection law and gambling laws, but which falls outside of formal gambling regulation. Consumer protection has a very specific meaning in legal frameworks and is not the same as the "consumer protection" schemes proposed in the scientific literature. If the term "consumer protection" were substituted by a more neutral term, such as "player protection" it would be clearer that the proposed response to game monetization is a tailored set of measures, which are designed to address the very particular challenges of unfair monetization methods and unethical game design.
Secondly, the debate so far on "consumer protection" does not seem to take account of the structural differences between consumer protection law and gambling law. Gambling laws are designed to control engagement with gambling activity, characterised by control of the gambling product, the gambling provider, and the player, with a high degree of regulatory supervision, intervention, and control (Miers, 2004, p. 333). They are built on a command-and-control model which permits limited access to an otherwise prohibited activity by imposing rules around access, player participation, service provision and product standards which protect the social, health, and financial well-being of the player in the gambling environment (Miers, 2004, p. 329). They control supply and are supported by diverse measures that cut across the regulatory areas of consumer protection, advertising control, health, and product safety (Miers, 2004, p. 330). Gambling frameworks also come at a cost to the operator: Licensing is a prerequisite to operation and close control of commercial activities is a sine qua non for the gambling industry. Gambling laws have a deep vertical impact on the underlying gambling transaction.
The information paradigm of consumer protection legislation is much less invasive of the transactional relationship. While some provisions intervene in the material elements of the consumer/trader transaction, measures such as imposition of spending limits, curfews and restrictions on play, technical standards that control the frequency of rewards and measures which restrict the subject-matter of the contract are more likely to be found in gambling law than in consumer protection law. EU consumer law is focussed on information asymmetries and its interference in the market is mainly to redress informational imbalances, by assuming that an "informed consumer" can make market choices based on comparison between products (Siciliani et al., 2019, p. 19). On the other hand, unlike gambling laws, which tend to distinguish only between rules which impact adults and rules which impact children, consumer protection laws tend to be more nuanced as to the transacting parties, giving a greater horizontal scope. For example, the UCPD distinguishes between classes of consumer, recognising not just the fact of vulnerability but also degrees of vulnerability, including situational vulnerability (EU Commission, 2021a, p. 100). Granular distinctions of this kind which differentiate between types of players are not always a feature of gambling law.
The challenge of the "consumer protection" approach is that it proposes to graft elements from these two different regulatory schemes without first investigating the conceptual and structural constraints which distinguish them. Development of this model must reconcile, for example, tensions between the vertical scope of gambling regulation, i.e., a high level of transactional interference, and the horizontal scope of consumer protection regulation, i.e. the broadest application to the widest classes of consumer. This does not mean the tensions flagged here cannot be resolved, but there is a balance to be achieved between these two regulatory structures, which in the interests of all stakeholders, remains to be investigated. This paper proposes that the regulatory debate could be made simpler if the "consumer protection" label of research were to be abandoned and given the more accurate title of "player protection". A "player protection" approach also suggests a wider focus, encouraging examination of alternative regulatory solutions from a more holistic viewpoint. A "player protection" method of regulatory analysis should take into consideration other areas of potential relevance, such as regulations on health and safety, artificial intelligence, financial regulation, data protection and self-regulatory initiatives. The rationale for a "player protection" paradigm is twofold. First, if research cannot yet justify product and sector-specific legislation, immediate responses must be found elsewhere for some issues of game design. Second, further regulatory options may be available beyond the confines of consumer protection and gambling laws. A player protection approach does not offer itself as a packaged, ready-made solution. On the other hand, it encourages a method of analysis which takes the broadest possible view of existing and emerging law, to consider all alternatives and to push the regulatory and research debate beyond the legal frameworks considered so far.

Loot Boxes: Recommendations of the Cerulli-Harms Study and the UCPD
In this second part, the paper will consider the EU's role in the regulatory debate. The recommendations made by Cerulli-Harms et al. are critiqued, to argue that similarities between games containing loot boxes and gambling are too great to close off any potential regulatory avenue, gambling law being the most pertinent example, and that a proposal to enact sector-specific regulation may not be justified. It compares the recommendations of Cerulli-Harms et al. against the UCPD and the new UCPD Guidance, which now extends to commentary on manipulative game design practices, with the loot box as a specific example. The paper will show how reliance on the UCPD to tackle immediate concerns and facilitate testing of remedial measures leaves the door ajar to alternative options, including regulation under national gambling law frameworks. The paper then examines how the UCPD and the updated UCPD Guidance addresses questions of potentially exploitative game design.

The EU and Regulation of Loot Boxes
The EU does not have a regulatory policy for monetised games. It had a formal policy for online gambling in the period 2012-2018, but this has expired and was not revived (EU Commission, 2012). It did, however, sponsor an Expert Group on Gambling for review of gambling-related regulatory issues and concluded a non-binding cooperation agreement between gambling regulatory authorities, including EEA members, which is still in force (EU Commission, 2015). Although loot boxes were discussed by the Group in March 2018, and it was agreed that further assessment of the respective positions in Member States was necessary to progress possible regulatory avenues, the Group's mandate expired soon thereafter and has not been renewed (Cerulli-Harms et al., 2020, p. 32).
The Gambling Regulators European Forum ("GREF") appears to have adopted the role of this Expert Group. This is an informal discussion group of gambling regulators drawn from EU (and some non-EU) states. In 2019, it initiated its own review of the loot box. Because definitions of gambling are so varied between the Member States, it did not recommend that loot boxes be regulated within gambling law (GREF, 2019). It observed that a co-ordinated response is necessary which considers the views of all stakeholders, including consumer protection enforcement, health, education, digital and financial regulation (GREF, 2019, p. 14). GREF also expressed concern that information asymmetries, in-game metrics and data harvesting techniques could cause unfairness for consumers. It considered this imbalance a potentially critical issue, and called on consumer protection organizations to advocate for better consumer information on in-game purchases, especially in respect of the content and "drop-rate" of loot boxes (GREF, 2019, p. 14).
The EU has yet to formulate a response. In 2013/14, it sponsored a joint enforcement initiative on underage In-App purchases in online games with the European Consumer Centres. This enforcement action led to both Apple and Google voluntarily agreeing to more stringent conditions for video game in-app purchases but did not elicit a similar response from the video-game industry (EU Commission, 2014;EU Commission, 2014a;Danish Consumer Ombudsman, 2014). A later initiative in 2018 concerned analysis of complaints about loot boxes in games, but to date the results have not been published (Cerulli-Harms et al., 2020, p. 32).

Recommendations of the Cerulli-Harms et al. Study
Commenting on the research and developments to date, Cerulli-Harms et al. observed that "…more research is needed to provide robust and conclusive findings" which would guide regulation (Cerulli-Harms et al., 2020, p. 8). Overall, Cerulli-Harms et al. considered that the EU should take a broad perspective on the question of problematic game design (Cerulli-Harms et al., 2020, p. 42).
The study made three significant recommendations to EU legislators. The first was that gambling regulation should not be used to prohibit loot boxes from video games. The rationale here is the risk of fragmentation in the EU Internal Market for online games. (Cerulli-Harms et al., 2020, p. 42). The study considered that despite similarities in the definition of gambling among all jurisdictions, and the cooperation undertaken through GREF, a national approach to regulation is too limiting (Cerulli-Harms et al., 2020, p. 42). It recommended a broader, consumer protection focus, framed away from national gambling legislation (Cerulli-Harms et al., 2020, p. 42).
The study suggested secondly that the EU implement this approach by relying on enactments of the consumer acquis. It should do so to test the effectiveness of intervention methods by drawing on "…consumer information, transparency and player control measures" (Cerulli-Harms et al., 2020, p. 43). The precise means of achieving this intervention are not teased out, but the study notes that many existing control practices, for example, raising awareness about risks, restricting advertisements, especially those directed at children, disclosing the fact of loot box features and disclosure of probabilities, can be implemented using existing pre-contract information structures. The focus of intervention here is firmly placed on disclosure measures and strategies to redress information asymmetries (Cerulli-Harms et al., 2020, p. 43). The study also usefully points to the advantages of putting measures into practice by relying on existing frameworks, so that interventions can be tested on the ground (Cerulli-Harms et al., 2020, p. 43).
Finally, the study also notes that EU regulatory competence allows it to look beyond the consumer acquis, and to consider an approach based on evidence of effectiveness, which allows it to adopt a range of measures from "…non-binding recommendations to binding legislation in the form of Directives" (Cerulli-Harms et al., 2020, p. 43). The study recites examples of EU "consumer protection" interventions taken elsewhere, such as the withdrawal rights conferred under the Consumer Rights Directive (2011), warning labels and information messages under the Tobacco Products Directive (2014), and restrictions on advertising directed at minors and protection from harmful online content under the Audio Visual Media Services Directive (2014), (Cerulli-Harms et al. 2020, p. 43). It noted that measures adopted in these Directives bear similarities with intervention measures for loot boxes identified in the study and could be replicated should interventions under EU consumer law prove insufficient to protect players from the potentially harmful effects of games containing loot boxes (Cerulli-Harms et al., 2020, p. 43).

Justifying Intervention: Some Questions for the EU
Cerulli-Harms et al. do not suggest a rush to legislate for loot boxes. However, they propose restraints on Member States capacity to act and envisage intervention at EU level. This paper takes an alternative view and disagrees that an embargo on regulation through national gambling frameworks and/or sector-specific EU legislation is necessary or advisable.
Similarities between gambling transactions and games containing chance-based loot boxes are too close to preclude Member States from regulating some games as gambling. Research outputs may yet prove links between monetised games and gambling which necessitate a higher level of intervention to protect players. This may be most effective when measures are taken at national level, through gambling control measures. For example, the analytical and regulatory approaches proposed by Derrington et al., yet to be tested in practice, may simply become unavailable as regulatory options for EU Member States, if they cannot be given effect under gambling law. There is also the question of Member States freedom to legislate for gambling, a competence repeatedly recognised by the Court, absent harmonization of the wider EU gambling industry (Planzer, 2014, pp.109-115). Described in Kingdom of Belgium v European Commission (2017) by Advocate General Bobek as a "…rather sensitive subject-matter, certainly from the point of view of a number of Member States," interference in Member States rights to legislate for gambling activities is a highly politicised area of EU policy activity (Littler, 2011;Littler et al., 2011;Planzer, 2014). Closing the door to regulation through gambling law when research is still not conclusive as to potential risks and harms, where games are still undergoing development, and market engagement with regulators is still at an early phase, may be a restrictive step and a potentially disproportionate restraint on national regulators. It also presupposes that monetised games are exclusively a game format and as such, are entitled to circulate in the Internal Market for games. When questions as to the quasi-gambling nature of monetised games and their implications for players are still not resolved, the EU should consider a less prescriptive view of intervention.
Proposals to introduce sector-specific intervention at EU level may also be loaded with unintended effects. Drawing parallels with the EU's intervention in tobacco products invokes a proposal to extend the current scope of regulation for lifestyle risks into the realm of public health policy. Where the EU has intervened in lifestyle risks, it is to address issues concerning substance control and not control of behaviours (Planzer & Alemanno, 2010). For example, the Tobacco Products Directive (2014) may have been motivated by public health concerns, but the Recitals to the Directive frame it primarily as an Internal Market measure, intended to approximate rules on manufacture, presentation, and sale of tobacco products, and resolve obstacles to cross-border trade. To propose intervention for games containing loot boxes is to invite extension of EU activity into an untested area, and at that, one which combines elements of product and behavioural control. This gives rise not just to questions of competence, but also the legitimacy of EU action. Not every lifestyle risk which traverses the borders of Member States justifies EU intervention. As Somek observes, when such risks concern matters of public health "…[a]ll that the Union is permitted to do is to complement Member States policies by encouraging co-operation and supporting their undertakings." (Somek, 2008, p. 99). If this is correct, then on the question of regulating loot boxes, the EU's role becomes complementary, and limited to supporting Member States policies.
By contrast, Member States are not so constrained, except to the extent that they must adhere to their obligations under primary and secondary EU legislation. Member States are free to adopt policies designed to protect public health. They are also better placed to respond to calls for regulation of loot boxes: national legislatures can initiate the regulatory debate by creating public fora, canvassing the views of stakeholders, and identifying the public policy grounds which justify intervention. As a lifestyle risk with similarities to gambling, Member States also may be in a superior position to enact targeted, responsive legislation, with the benefits of immediacy and speed. Moreover, Member States are permitted the discretionary scope to take a "wait and see" approach, to refrain from or take partial action, or even to allow the online games market to regulate itself.

Towards a Common EU Policy for Loot Boxes?
This author prefers a very limited role for the EU, allowing Member States the discretion to investigate and test "player protection" measures through national legislation, self-regulatory codes of practice and other voluntary schemes.
Several other sources of EU law outside the scope of this paper also have importance here: Aside from consumer protection laws, there are existing laws on data protection, control of advertising, and product safety to be explored further. Emerging rules on artificial intelligence as well as non-binding technical standards such as those developed by the European Committee for Standardization (CEN) are also relevant. As to the latter, for example, a set of technical standards such as the CEN Workshop Agreement on Responsible Remote Gambling Measures might be considered (European Committee for Standardization, 2014). This is a multi-stakeholder voluntary code of minimum standards for remote gambling which supplements existing harmonised EU rules such as the UCPD and is "… not intended to replace existing legislation, but rather guide and facilitate future regulatory efforts" (European Committee for Standardization, 2014, p. 6).
The EU could begin by encouraging Member States to take this multidisciplinary approach, drawing on alternative EU legislative sources, and facilitating co-operation between national gambling regulators and their consumer regulator counterparts, through a vehicle such as the European Consumer Centres network. The updated UCPD Guidance is another cogent example of the type of assistance which the EU can render here: It provides a common interpretative standard against which one or more Member States can adjudicate game design practices and take enforcement action. Reliance on this existing legislation will also facilitate testing and systematic verification of the regulatory measures noted by Cerulli-Harms et al. .
It is unquestionable that EU consumer protection legislation has a role in a multidisciplinary approach. However, applying the entire consumer acquis runs risks of potentially negative consequences and overregulation. For instance, classifying the loot box transaction as a wholly consumer transaction may restrain Member State ability to regulate it under gambling law, and could reverse any regulatory gains made in those Member States where the loot box purchase comes within gambling regulation. Gambling is excluded from the E-Commerce Directive (2000a), the Consumer Rights Directive (2011) and the Digital Services Directive (2019). The value of applying the entire consumer acquis is also questionable. For example, although Cerulli-Harms et al. take a positive view of the withdrawal rights for purchasers of loot boxes, none of the scientific research undertaken so far suggests that the position of the player would be enhanced through the types of pre-contractual information, notice and withdrawal rights afforded by the Consumer Rights Directive and the E-Commerce Directive. Moreover, as the subject-matter comprises digital content, rights of withdrawal from contracts for purchase of loot boxes may be worked around by the simple expedient of having the purchaser exercise the waiver specified in Article 16(m) of the Consumer Rights Directive. Similarly, the substantive rights and conformity requirements of the Digital Services Directive may be of limited benefit to the loot box purchaser.
The UCPD and the Unfair Contract Terms Directive (1995) are the only EU consumer protection measures which apply to both consumer transactions and gambling transactions. The regulatory value of the Unfair Contract Terms Directive may seem limited against the perceived risks and harms of loot boxes, but there is evidence elsewhere of unfair contract terms in user agreements for such games . A comparable investigation has not been conducted in the EU, but should similar unfair terms be prevalent in games that contain loot boxes and circulate in the EU market, the rules of the Directive can be applied even if Member States choose to regulate the games as gambling transactions.
EU action should support deployment of the UCPD to tackle questions of problematic game design, adverse psychological and financial consequences, opaque offer and pricing techniques, and exploitation of both vulnerable adults and under-age players, as identified by Cerulli-Harms et al. (Cerulli-Harms et al., 2020, p. 8). As these are matters which principally concern unfair and unconscionable market practices, the updated UCPD Guidance may be the best starting place for both the EU and its Member States.

The UCPD and Loot Boxes
The remainder of this paper investigates how the UCPD deals with the risks and harms of loot boxes identified in the study undertaken by Cerulli-Harms et al. (Cerulli-Harms et al., 2020, p. 21). Before looking at the substantive issues of that study, four broader aspects of the Directive with relevance to the loot box debate will be considered first. These are the health and safety competences of national legislatures in Article 3(3), the vulnerable consumer test of Article 5(3), the role of codes of conduct provided through Article 10 and the Annex, and the strengthened enforcement process introduced through the New Deal for Consumers programme of legislative reforms (EU Commission, 2020; EU Commission, 2021a, 2021b).

Article 3(3) and Recital 9
Recital 9 recognises the competence of national legislatures to legislate for the "health and safety aspects of products," enabling them to regulate specific products such as "alcohol, tobacco or pharmaceuticals" on grounds of protection of health and safety. The special position of health and safety legislation is also recognised in Article 3(3): the UCPD is without prejudice to "…Community or national rules relating to the health and safety aspects of products." Any conflicts between EU rules and the Directive are resolved through Article 3(4), as most recently confirmed by the Court in Konsumentombudsmannen v Mezina AB (2020) . The position of national rules on health and safety is not as clear: if, for example, national rules on the health and safety aspects of loot box games were to also concern issues covered by the UCPD, such as misleading representations and misleading omissions of information, then the national rules may prevail. Wilhelmsson argues that the maximum harmonization character of the Directive must be reconciled with health policies that come outside its scope (Wilhelmsson, 2006a(Wilhelmsson, , 2006b. This interpretation seems to coincide with the Court's view: in Criminal proceedings against Luc Vanderborght (2017) the Court had no hesitation upholding general and absolute national rules prohibiting advertising in respect of oral and dental care which conflicted with the maximum harmonization objective of the UCPD, on grounds that the national provision was intended to protect public health and exempted under Article 3(3). Some guidance on the issue might also be drawn from the earlier judgment in Criminal proceedings against Gottfried Linhart and Hans Biffl (2002), where the Court distinguished between claims made in the marketing of a cosmetic product and issues of risk to public health, treating the former as questions to be dealt with under the UCPD.

Article 5: The Consumer
Through the concepts of the "average targeted consumer" and the "vulnerable consumer" in Articles 5(2)(b) and Article 5(3), respectively, the UCPD makes allowances for personal and situational vulnerability of consumers. These concepts may have special relevance for immersive game design and use of entrapment techniques in games. As a refinement of the average consumer test, the average "targeted" consumer of Article 5(2)b permits a more nuanced and specific assessment of the fairness of commercial practices (Howells, 2018, p. 69;Weatherill, 2007, p. 135). Examples of the average "targeted" consumer of online monetised games might be players of a certain demographic, or players who display identifiable behavioural characteristics in their interactions with games featuring chance-based loot boxes. In a new departure, the revised UCPD Guidance recognises this type of situational vulnerability in the digital environment, noting that personalised persuasion practices may be manipulative and "…hence unfair" (EU Commission, 2021a, p. 100).
The obviously weaker consumer of Article 5(3) UCPD is rendered "particularly vulnerable" in a way which the trader may be reasonably expected to foresee. This category of consumer may be distinguished from the average "targeted" consumer: Practices do not have to be targeted at this group and potentially all commercial practices which might affect the behaviour of the vulnerable consumer may be assessed under Article 5(3) (Trzasksowski, 2013, p. 13). Here again, the revised UCPD Guidance acknowledges the risks to all categories of vulnerable person, noting that the concept of vulnerability is "dynamic and situational" (EU Commission, 2021a, p. 100). This broad approach to the concept of vulnerability may be the key provision of the Directive to justify action on loot box games: intervention on this basis is not justified by medical criteria of disordered behaviour but is focussed on the effects which a commercial practice has on different categories of persons. This has significance for potential research questions and intervention measures around disordered and addictive behaviours.
Both the American Psychiatric Association and the World Health Organization International Classification of Diseases (WHO ICD-11) classify gaming disorder as an addictive behaviour, placing it within the category of mental, behavioural, and neurodevelopmental disorders (American Psychiatric Association, 2013; WHO, 2019). Maladaptive behaviours such as excessive spending do not come within this classification and are considered an indication of disordered gambling (King et al., 2019, p. 140). The scientific definitions of addiction and disorder set a high bar and concentrate on symptoms and behaviours rather than the triggering environment. The strength of Article 5(3) is that it looks beyond the individual to consider the effects of a commercial practice on a consumer or a particular class of consumer, made vulnerable by virtue of certain personal attributes. Where monetised games contain quasi-gambling features and known manipulation techniques, they create situational risks for the vulnerable consumer of Article 5(3), which includes persons with symptomology of disordered gaming as well as disordered gambling. The element of foreseeability redresses the balance between the trader and the vulnerable consumer, so that the more pressing question is to show whether the techniques employed in loot box game design will trigger disordered behaviours (EU Commission, 2021a, p. 36). This is a less onerous evidentiary burden than having to prove the addictive pathways between loot boxes and disordered behaviours.
On the other hand, Article 5 (3) is not all-encompassing. Irrational consumer responses unrelated to medically defined mental disease may fall into a regulatory grey area. Trzasksowski considers that consumers who behave more irrationally than the average consumer, but do not fall into the categories of vulnerable consumer, are not protected by Article 5(3) (Trzasksowski, 2013, p. 14). In that case, their behaviour would be evaluated against the standard of the "average consumer" or, if it can be shown that certain consumer cohorts are deliberately targeted through sales practices, game design or game structure, then such practices may be measured against the standard of the "average targeted consumer".

Article 10: Codes of Conduct
One relatively untapped provision of the UCPD might also be given greater consideration. Article 10 UCPD provides that Member States may encourage control of unfair commercial practices through industry codes of conduct. Article 6.2 (b) UCPD requires traders to adhere to codes of conduct to which they are subscribed, provided that the commitments contained in the code are firm and capable of being verified. In addition, Annex 1 Points No. 1, 2 and 3 absolutely prohibit false claims of adherence to codes of conduct. Although Member States are not obliged to prosecute traders for breaches of codes of conduct, in Bankia SA v Juan Carlos Mari Merino and Others (2018) the CJEU endorsed development of such codes as a means of avoiding recourse to enforcement involving administrative or judicial action. A criticism of the UCPD is that it does not incentivise the adoption of codes by offering regulatory privileges, such as immunity from enforcement to traders who comply (Pavillon, 2012, p. 272). Nonetheless, codes of conduct can be considered a potential "benchmark of fairness," capable of setting sector-specific rules for an industry (Pavillon, 2012). The online gambling industry seems to have already grasped this: In 2020 a voluntary code for advertising of online gambling was agreed and adopted between certain prominent EU-based licensed operators (EGBA, 2020). The code is modest in its ambitions. It reflects existing regulatory requirements and places enforcement measures within existing voluntary arrangements, but without prejudice to national laws, the requirements of UCPD, and other relevant legislation, together with any local self-regulatory measures in Member States.
The games industry too seems aware that a moral imperative requires it to take remedial steps which might undo some of the reputational damage inflicted by loot boxes. In 2018, the International Game Developers Association (IGDA) posted a call to action urging game developers to "…immediately implement self-regulation measures, including age-appropriate marketing, consumer advice on odds for random in-game rewards, and parental controls." (Crecente, 2018;King et al., 2019, p. 132). There are good commercial reasons why the online games industry should consider adoption of voluntary codes of conduct and self-regulatory measures. McCaffrey questions the need for sector-specific regulation of loot box games, but recommends that the industry engage with consumer concerns, addresses and responds to stakeholder criticism, and makes efforts to "defuse" claims of unfairness by taking positive action (McCaffrey, 2019). If it has not done so voluntarily, the games industry may find itself being "nudged" towards fairer commercial practices through an EU-wide investigation and enforcement campaign.

Enforcement and the UCPD
The revamped Consumer Protection Co-Operation Regulation (2017), together with the reforms of the Omnibus Directive (2019a), strengthen deterrent effects for breaches of the UCPD. Until now, the loot box game has circulated in an EU market devoid of significant penalty for breach of consumer protection rules. At Article 3(6) the Omnibus Directive introduces a new range of penalties for breach of the UCPD, intended to be "…effective, proportionate and dissuasive." A further dimension will be added when the reformed Directive on Representative Actions (2020) comes into effect: It will introduce a common EU-wide procedural mechanism for consumer representative actions for injunctions and redress measures. This suite of reformed enforcement structures will significantly enhance the investigative powers and penalties available for breaches of the UCPD. It also anticipates joint enforcement actions, supported by an enhanced scheme with new powers of enquiry. Apart from the enforcement action taken in 2013/2014, the effect of collective action on the online games sector remains relatively untested. The reformed enforcement scheme provides even greater scope to the EU, its Member States, and consumer representative groups, offering more immediate solutions for tackling the problematic aspects of games containing loot boxes, and thereby avoiding legislative delays.

The Revised UCPD Guidance 2021
The new UCPD Guidance takes a position on fairness in online games, providing an insight into the relationship between the principles of the Directive and the research cited by Cerulli-Harms et al. (EU Commission, 2021a, p. 105). It notes the presence of "gambling elements" in games, based on "addictive interface designs" incorporating slot machines, loot boxes or betting (EU Commission, 2021a, p. 104). It warns that loot boxes and similar "paid random content" should be clearly disclosed "… including an explanation of the probabilities of receiving a random item" (EU Commission, 2021a, p. 105). It notes that the "…sale of loot boxes in games must comply with the information obligations under the Consumer Rights Directive and UCPD concerning the price and main characteristics of the product" (EU Commission, 2021a, p. 105). It is regrettable that the Guidance does not go on to itemise the specific provisions of both Directives which it considers relevant to disclosure of probabilities. On the other hand, a close reading of Article 6(1)(a) and 7(1) together with Article 7(2) UCPD and the professional diligence obligations of the games provider under Article 5 all point towards a high standard of disclosure.
Cerulli-Harms et al. considered two main problem area for loot boxes: Firstly, questions of problematic game design, which were divided into the categories of manipulative pricing and offer strategies, and psychologically structured reward and presentation features. The second area looked at risks to children and underage players. The impact of the UCPD on each area will be examined in turn, taken against the analysis offered by the Guidance.

Pricing and Offer Strategies
Cerulli-Harms et al. described use of "lure-to-pay" strategies, using default techniques to deceive a consumer into signing up for a "free" trial which converts into a full subscription (Cerulli-Harms et al., 2020, p. 24). The Guidance takes a strong stance on misleading practices such as free trials and subscription traps, as well as virtual pricing and bundling practices. It reminds traders that tactics of this kind may omit material information and infringe Articles 7(1), 7(2) and 7(4)(a), as well as Article 6(1)(a) (EU Commission, 2021a, pp. 58, 102-103). Traders are also reminded of their specific information obligations concerning recurring cost under Articles 6(1) (d), and/or Article 7 (EU Commission, 2021a, pp. 58, 102-103). The practice of pricing game items in virtual currency is warned against, reminding traders that in a game, virtual items must be priced in real-world currency (EU Commission, 2021a, p. 104). The Guidance recommends too that reliance be placed on the precontractual information obligations for recurring payments under Article 8(2) Consumer Rights Directive, which are more extensive and transaction-specific than the provisions of the UCPD. Use of the Consumer Rights Directive in this instance may run counter to the benefits of relying solely on the UCPD. There is nothing to suggest that an equivalent standard of precontractual disclosure cannot be imposed on the games provider, in reliance on a combination of Articles 6(1)(a) and 7 UCPD. The CJEU takes a broad view of deceptive practices: Verein gegen Unwesen in Handel und Gewerbe Köln e.V. v Mars GmbH (1995) confirms that the truthfulness of information should be examined within the context of overall presentation. So, for example, in Bundesverband der Verbraucherzentralen und Verbraucherverbände -Verbraucherzentrale -Bundesverband e.V. v Teekanne GmbH & Co. KG (2015), which concerned the Directive on Labelling of Foodstuffs (2000b), the Court confirmed that even where information furnished is factually correct, presentation and overall impact may adversely influence and mislead consumer perception of the product. Although Cerulli-Harms et al. recommend compulsory disclosure concerning subscriptions and cancellation, the better course might be to rely on the combined effects of Articles 6(1) and 7 UCPD to advocate for proscription of sales techniques which are deliberately framed to mislead the player into the consequences of signing up to a game service. The role of compulsory information disclosures in loot box contract-formation should be assessed from the situational perspective: The games environment is pressurised and subject to other manipulative techniques intended to drive spending, of which the player may not be aware (EU Commission, 2021a, p. 104). Information alone may not be sufficient to protect players, since information disclosures assume that consumers are "…not only fully rational agents, but also blessed with unlimited computational bandwidth" (Sicilani et al., 2019, p. 13). It may be more effective for regulators to consider complete prohibition of "lure-to-pay" marketing strategies from monetised games.
The Court also leans against practices which obscure pricing, for example, through practices such as "bundling" and structuring of prices. The UCPD imposes a requirement of candour: in Denmark v Canal Digital Denmark A/S (2016), paras [41] and [43], the CJEU ruled that in assessing a "highly structured" product, consideration should be given to the resulting "…asymmetry of information that is likely to confuse consumers." This was a case where the trader had engaged in the commercial practice of "price partitioning," dividing price into several components, "…one being particularly emphasised in the marketing, while the other, which nevertheless constitutes an inevitable and foreseeable element of the price, is completely omitted or is presented less prominently." Pricing in virtual currency and making it difficult for the consumer to gauge the potential financial outlay and cost of game play through use of "key mechanisms" and other price-obscuring tactics, are issues which may be examined against the UCPD.
There are some limitations here to the scope of the UCPD: for example, third party sites which promote gambling-like activities, sell viewing rights, and offer unregulated secondary services to players, must be investigated separately from game providers, as their practices concern questions other than fairness of design and the game experience. Cerulli-Harms et al. also suggest that financial control tools such as those used to curb spending in online gambling might be appropriate (Cerulli-Harms et al., 2020, p. 25). Measures of this type are outside the immediate scope of the UCPD, but there is nothing to prevent the games industry adopting them on a voluntary basis, enforced through the Consumer Protection Co-Operation Regulation (2017). The Regulation anticipates situations where a trader may make voluntary commitments to remedy infringements, if such measures benefit consumers. While the types of remedies listed in Recital 17 of the Regulation do not include voluntary financial control tools, nothing suggests that voluntary industry commitments borrowed from gambling control measures cannot be made and accepted to remedy infringements of the material information and other provisions of the UCPD, so long as there are no negative impacts to consumer's rights of redress for individual harms.

Reward Structures and Presentation Features
The Guidance is unequivocal that practices which use consumer information in conjunction with algorithms and artificial intelligence systems (AI) for commercial purposes are subject to UCPD rules as to fairness, as well as the rules on use of data of the ePrivacy Directive, the GDPR "…or sector-specific legislation applicable to online platforms" (EU Commission, 2021a, p. 99). The Guidance points to the opaqueness of manipulative practices, which makes them unfair and distinguishes them from "…highly persuasive advertising or sales techniques" (EU Commission, 2021a, p. 100). For the first time, the Guidance considers the issue of so-called dark patterns, a form of "malicious nudging," and datadriven practices, warning against their use in games of chance (EU Commission, 2021a, pp. 100-101).
The UCPD goes further than merely requiring traders to disclose the functionality of game design, especially where data-harvesting techniques are being used for commercial purposes (Helberger, 2016, p. 10). The commercial intent of a practice may not be readily discernible to the consumer, and disclosure of the actual commercial purpose of a game design feature may be woven into product information in a way which the consumer may not easily comprehend. This issue is not unique to loot boxes or monetised game design and can be found also in other online marketing contexts (Sax et al., 2018, p. 104). Further research may be needed to establish consumer perception of commercial intent in monetised gaming, but where consumers are unaware that the information they provide though game-play is "…a major determinant of purchasing-related in-game variables and situations," and the probability of receiving a "chance-based" virtual item, then at a minimum, consumers should be made aware of this game design feature, not just at the beginning of game play, but at repeated intervals during interaction with the game (King et al., 2019, p. 138). Rött considers that since it affects the consumer's transactional decision-making processes, being subjected to manipulative strategies is material information the consumer requires and which the trader should provide, a conclusion with which the author agrees (Rött, 2019, p. 54).
The Guidance reminds traders that practices which distort the economic behaviour of the average or vulnerable consumer may amount to a misleading practice under Article 6 and 7, an aggressive practice under Articles 8 and 9 or indeed a breach of the game provider's duties of professional diligence under Article 5 (EU Commission, 2021a, p. 100). The caveat here is that a breach will be assessed on a case-by-case basis. For regulators, this may require clear definition of the "manipulative practices" in question, as a prerequisite to any potential enforcement action on loot boxes. The Guidance clarifies that the UCPD does not require intention for the use of dark patterns but notes there is no formal legal definition of same, and reliance may have to be placed on "… principles derived from international standards and codes of conduct for ethical design" (EU Commission, 2021a, p. 101). Consequently, research must not only identify manipulative practices in games containing loot boxes, but should also demonstrate their adverse impact on the decision-making process. King et al. were the first to recognise the importance of investigating the distinctive features of monetised games which might render them unfair (King et al., 2019, p. 143). A recent study by Petrovskaya and Zendle examined monetised games to isolate techniques considered misleading, aggressive, or unfair from the player perspective (Petrovskaya & Zendle, 2021), This study found 35 monetization techniques subjectively reported by players as either misleading, aggressive, or unfair. Although the study was based on players subjective perceptions, the authors noted the diversity of problem practices, not all of which came under the UK equivalent of the UCPD. They also observed that among the practices reported, players may not be aware of "…a potentially problematic mechanism that may have adverse consequences" (Petrovskaya & Zendle, 2021, p. 15).
The fact that monetised game design may generate significant information about the individual player, thereby enabling tailored interactions, offers, inducements and solicitations, also exposes the player of loot box games to potentially aggressive marketing practices. King et al. considered that 12 out of the 13 micro-transaction patents which they examined relied on sophisticated collection of data and analytics to create tailored offers and purchasing options for players (King et al., 2019, p. 139). This player-generated data may influence the virtual goods and purchasing opportunities which the individual player will receive during a game. Together with the psychological and cognitive techniques used to drive purchasing, these systems may result in the "entrapment" of the player, causing him to escalate in-game purchases (King et al., 2019, p. 141). The point is also addressed by the Guidance: use of behavioural biases or manipulative practices to trigger offers, "pervasive nagging" and use of visual and acoustic effects are singled out as examples of pressuring tactics (EU Commission, 2021a, p. 104).
The CJEU leans against commercial practices which attempt to condition a consumer's commercial decision-making through the application of pressure. The Court takes a sympathetic approach to the consumer: In Autorità Garante della Concorrenza e del Mercato v Wind Tre SpA and Vodafone Italia SpA (2018) it observed at para. [54], that in a sector "… as technical as that of electronic communications by mobile telephony, it cannot be denied that there is a major imbalance of information and expertise between the parties." The pressure on the consumer must be real and likely to impair the consumer's freedom of choice or conduct in respect of a product. , it acknowledged that undue influence may exist in circumstances caused by "unfair conduct" on the part of the trader which is liable to make a consumer "… feel uncomfortable and thus to confuse his thinking in relation to the transactional decision to be taken." Exploitation of cognitive biases during game play may create confusion in the mind of the consumer of the type which Articles 8 and 9 UCPD are designed to address. However, the fact of aggressive practices and undue influence should first be tested through an investigation of individual game systems, a pre-requisite which the UCPD Guidance seems to acknowledge (EU Commission, 2021a, p. 100).
Finally, there may also be good commercial reasons why game providers should consider clear and unequivocal disclosure of the game mechanics used to drive purchasing. In Vincent Deroo-Blanquart v Sony Europe Limited (2016) the CJEU noted that where a consumer is correctly informed about the standard features of a product in a clear and unambiguous way, and those standard features meet "…the expectations of a significant proportion of consumers" (in this case sale of computers with pre-installed software), so long as the consumer may then withdraw from the sale, the criteria of honesty and good faith are satisfied, the trader having demonstrated "…care towards the consumer." The obligations of game providers are greater than merely disclosing information and obtaining consent to use of player data. Informing consumers in a clear and unequivocal manner how game design and structure will use gameplay and player data to generate in-game revenue, goes to protect the interests of both the consumer and the trader. This again invokes a standard of responsibility on the part of the games industry, which goes beyond bare compliance with prescriptive informational obligations and takes a more global view of the obligations which must be discharged vis-a vis the player.

Issues Concerning Children and Underage Players
The vulnerability of children to problematic game design practices was a key finding of Cerulli-Harms et al. The risk factors for children stem not just from dangers of excessive spending but from potential impacts on psychological and cognitive development. Although games containing loot boxes and monetization features are not necessarily targeted at children, more than 90% of games containing loot boxes were rated as suitable for children aged over 12 (Cerulli-Harms et al., 2020, p. 27). Video game age ratings are a selfregulatory initiative of the games industry in the EU, where ratings are set by Pan European Game Information (PEGI). PEGI is supported by games providers operating in the EU but evaluates games independently. Assessment is based on indicators such as presence of bad language, violence, or representation of drug use in the game, and more recently, warnings have been added where paid random items are a feature of a game (Cerulli-Harms et al., 2020, p. 27). Similarly, initiatives to disclose the probabilities of obtaining different items were adopted by Apple's App Store and Google Play, but regulators question "…the usefulness and enforceability of such self-regulatory measures" (Cerulli-Harms et al., 2020, p. 40). Parental control measures in games were also considered inadequate because their application and use is voluntary, with few parents electing to apply parental controls (Cerulli-Harms et al., 2020, p. 40).
Notwithstanding the questionable efficacy of age rating and labelling as a deterrent for minors and as an information mechanism for their parents, rating schemes seem to appeal to regulators (Cox, 2012;Moshirnia, 2019). For example, when Germany enacted the latest iteration of its Youth Protection Act/Jugendschutzgesetz (2021), it included a suite of provisions concerning games content. This most recent amendment will enable formal recognition of a voluntary games rating system similar to that administered by PEGI and introduces provisions on technical settings for protection of underage players. The detail of the games rating system and other provisions are still to be agreed between federal and state authorities (GAME, 2021). At §14.8, the new regulations provide for labelling systems using descriptors such as "feature labels" and warning notices to highlight additional content posing an interaction risk for children or adolescents. From the perspective of the recommendations made by Cerulli-Harms et al. the German initiative could be seen as something of an adverse step: the unilateral nature of this initiative contributes a risk of market fragmentation, which could be avoided if a common EU-wide position for rating and labelling of content was adopted. On the other hand, it is a good example of how piloting and testing of measures can be undertaken at national level. The very serious social and public health consequences of exposing juvenile and underage players to negative developmental risks justifies adoption of a policy which retains the option for Member States to regulate loot box games.
The UCPD offers an unusual degree of flexibility when determining the age thresholds which apply to children and underage players. Article 5(3) is not prescriptive as to numerical ages: it is addressed to groups of persons with particular vulnerability to commercial practices, in the categories of "…mental or physical infirmity, age or credulity." According to Micklitz, this a deliberate choice on the part of the Directive and allows Member States "…a margin of appreciation in determining the need for protection of weaker parts of the population" (Micklitz, 2006, p. 116). This is helpful where research distinguishes between different classes of children based on age and vulnerability to disordered development, and it also allows Member States freedom to respond to identified risks. Furthermore, Article 5 (3) is not limited to persons under the age of majority, but may also extend to practices which adversely impact young adults. Practices do not have to be targeted any group of vulnerable consumers identified through Article 5(3), and potentially all commercial practices which might affect the behaviour of the vulnerable consumer may be assessed (Trzasksowski, 2013, p. 13).
The UCPD Guidance takes notice of the risk to children arising from known marketing practices and design strategies. The most recent Guidance notes the issues highlighted by Cerulli-Harms et al. concerning children, offering a useful interpretation (EU Commission, 2021a, p. 103). It warns against use of aggressive practices and combinations of practices in breach of Articles 8 and 9, which "…exacerbate the consumer impact" (EU Commission, 2021a, p. 104).
One provision treated as particularly relevant to children is the prohibition in Annex 1 Point No. 28 against direct exhortations to children. This is the marketing feature also known as "pester power." The EU Commission's study on online marketing to children also investigated the interactions of children with embedded advertising in games and prompts for in-game purchases, finding that in general, children acted to their detriment in such scenarios (EU Commission, 2016a, 2016bEU Commission, 2016a;EU Commission, 2021a, p. 104). Assessment of this practice under the UCPD is undertaken on a case-by-case basis, using criteria such as marketing design, medium of communication, language, use of characters and direct appeals to children (EU Commission, 2021a, p. 70). An interesting observation of the Guidance is that the UCPD applies to all games "… that are likely to appeal to children, not only those solely or specifically targeted at children" (EU Commission, 2021a, p. 71). The key criterion here is whether the trader could reasonably be expected to foresee that a game holds appeal for children (EU Commission, 2021a, p. 71).
Finally, the Guidance also acknowledges the role of parental controls and has assembled the relevant legislative provisions from the Consumer Rights Directive, the UCPD and the Directive on Payment Services. It recommends that traders should make use of "platform-level controls" offered by hosting platforms, but it also draws attention to the obligations on traders in respect of arrangements for payment. It advises traders of the information obligations under Article 7(4) UPCD and Article 6(1)(g) Consumer Rights Directive, and at the same time reminds them that the requirements of Article 64 of the Directive on Payment Services (2015) oblige traders to obtain the payer's consent before processing a payment, in the absence of which the payment "…is considered to be unauthorised" (EU Commission, 2021a, p. 104). It also cautions against default payment settings and recommends consent for time-setting. As research demonstrates, parental controls are desirable features of loot box games, and encouraging games providers to make them accessible may also aid assessment of their effectiveness. There is precedent for deploying the UCPD here: in 2020 the Italian Autorità Garante della Concorrenza e del Mercato (AGCM) acted on loot box games under the UCPD, resulting in two games operators undertaking to improve labelling, content and positioning of information concerning cost and features of in game purchases, together with introduction of more userfriendly parental controls (AGCM, 2020).

Conclusion
Regulation of loot boxes is only one part of a much greater debate to be had on regulation of quasi-gambling and exploitative game formats. The route to sector-specific rules for loot boxes and other types of monetised games remains to be fully evidenced and supported by public interest justifications. If these new and challenging game structures are to be given a regulatory home, the current alternatives of consumer protection and gambling law may have to be replaced by a no-man's-land of customised regulatory intervention. Yet it is still the case that pending advancement of a tailored model, players of loot box games, particularly children, are at risk.
An alternative approach, which recognises the immediacy of some harms, is to adopt a "player protection" model, which investigates other avenues of existing and emerging legislation. A 'player protection' model should encompass a broad church, looking beyond the confines of consumer protection and gambling law. It should investigate and borrow widely, taking account of other potentially relevant rules in fields such as health and safety, artificial intelligence, financial regulation, and data protection. This list is not prescriptive but serves to highlight that interdisciplinary dialogue on the regulation of monetised games must commence from an understanding of what can be tolerated as a "player protection" measure.
The key conclusion of Cerulli-Harms et al. was that the debate on regulation of loot boxes should be framed away from gambling and moved towards consumer protection. For the EU, "consumer protection" has a specific and defined context, which makes it an imperfect remedy for regulation of loot boxes and monetised games. Some provisions of EU consumer law, such as compulsory precontractual disclosures, withdrawal rights and quality assurance provisions may have a limited role in the consumer risks associated with loot boxes. Reliance on the full scope of the consumer acquis also has adverse implications, with limiting effects for Member States wishing to rely on gambling law frameworks as a regulator for loot box games.
For Cerulli-Harms et al. questions of transparency of the format and unfairness visa-vis different types of players were the critical issues requiring urgent intervention. In issues of this type, the UCPD, as evidenced by the updated Guidance, offers an existing and flexible legislative solution which can tackle exploitative game design, use of psychological manipulation techniques to drive spending, use of aggressive game mechanics and industry targeting of vulnerable players. The UCPD also offers an enhanced enforcement mechanism in the reformed Regulation, and unlike most other transactional rules of the EU consumer acquis, can be applied alongside national rules on gambling, health, and safety. As a principles-based measure, it provides a ready-made solution to at least some regulatory questions presented by the loot box and other forms of monetised games. It may be used to test various solutions without necessitating product-specific regulation, and it allows industry to voluntarily participate through codes of conduct, while still permitting Member States the freedom to regulate the loot box under national gambling laws.
Scientific research may be critical of this modest approach. On the other hand, deployment of an existing legislative provision and its enforcement framework to tackle the more pressing issues of loot boxes is more achievable than proposing entirely new laws for a format which may, in the end, require a nuanced intervention, based on evidence of actual risk and harm. By allowing Member States the freedom to enact local legislation, coupled with potential for adoption of a voluntary code of conduct, the games industry may also find itself nudged towards participating in the resolution of what has proven a legal and scientific minefield. Ultimately, the larger issue may be whether the dilemma of loot boxes and problematic game design is more properly a question of public health policy, a question which remains to be addressed.

Funding Open Access funding provided by the IReL Consortium
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http:// creat iveco mmons. org/ licen ses/ by/4. 0/.