Introduction

The Digital Fairness Act (DFA) is the European Commission’s attempt to bring EU consumer law up to date with the realities of the digital economy, and video games are one of the areas where this matters most. As the Commission’s Fitness Check describes, for many players, a game is no longer something you simply buy once. Games now run on in-game currencies, sell virtual items, and offer paid “loot boxes”, and have increasingly become a commercial space aimed at children.

The figures are striking. The European video game market counts more than 126 million players, and a growing share of revenue now comes from in-app purchases rather than sales of the games themselves. The Fitness Check warns that many features are designed to keep players spending: prices shown only in a game’s own virtual currency, “pay-to-win” mechanics, and randomised rewards that some compare to gambling. 

Loot boxes are at the centre of the debate. A loot box is a paid feature that gives the player a random selection of virtual content, so the buyer does not know in advance what they will receive, much like a digital surprise pack. Because the contents usually cannot be exchanged back into real money, several countries have hesitated to treat them as gambling, yet they raise familiar concerns about impulse spending and the protection of minors. The public consultation on the DFA found wide support for several potential legislative actions like clearer pricing, better disclosure of the odds of winning, the ability to switch certain features off, and continued access to games that people have already paid for.

Whether the DFA should tackle these practices through consumer law, leave them to gambling regulators, or rely on industry self-regulation, remains an open question. To explore this question, we spoke with Dr. Pieterjan Declerck, who recently completed his doctoral research in the Law & Technology research group at Ghent University. His work assessed the legal framework surrounding the blurring lines between gaming and gambling, from loot boxes to skin betting, and how that framework could better tackle the related risks for young people.

Interview

The Digital Fairness Act is being framed as a way to update consumer protection for the digital world. Why have video games become such an important part of that conversation?

Pieterjan Declerck: Video games have become central to this conversation because they concentrate, within a single digital environment, many concerns that the Digital Fairness Act intends to address. The applicable regulatory framework is already fragmented across national gambling regulation, EU consumer protection law, EU data protection law, EU platform regulation and industry self-regulation. Many modern-day video games simultaneously operate not only as a form of entertainment, but also as a marketplace, a data environment and a social ecosystem.

This complexity means that players are both consumers and data subjects within data-driven business models. They encounter microtransactions, in-game virtual currencies and virtual items, random reward mechanisms, personalised offers, time-limited events and continuous engagement loops. Video games therefore illustrate the relevance of consumer protection concepts such as dark patterns, addictive design, unfair personalisation, virtual currency obfuscation, consumer digital vulnerability and cross-border enforcement challenges in a way that makes them a paradigmatic case for the Digital Fairness Act’s ambitions.

The European Parliament recognised the sector’s regulatory salience as early as January 2023, when it called for a harmonised European regulatory framework ensuring a high level of consumer protection in online video games, particularly for minors and young children, and invited the Commission to assess whether existing consumer law was sufficient. The Commission’s own Fitness Check identified virtual currency pricing, pay-to-win mechanics, randomised rewards and spending prompts as specific areas of concern. BEUC’s 2023 survey found that eighty per cent of players able to buy virtual items had been prompted to spend, and nearly half were confused about the real-money price of what they were purchasing.

Due to the focus on children’s rights in my doctoral dissertation, I feel it is relevant to frame consumer protection within the broader children’s rights context. Different children’s rights are aimed at protecting children. For video games, the main rights are the right to protection against economic exploitation, the right to privacy and the right to play. Consumer protection, at the EU and national level, is one legal domain through which children’s rights can be realised (another example is the domain of data protection). In the conversation of children’s rights, it has to be emphasised that video games also carry significant cultural, educational and social value. The child’s right to play has to be interpreted as an enabling right – a right that conditions how other rights are exercised in the digital play environment. Regulations should therefore not be framed as ‘anti-game’. They should be framed as ensuring fair play by design: preserving the positive value of play while requiring that the commercial architecture of games does not exploit players, particularly children whose evolving capacities make them less able to recognise and resist commercial pressure.

The convergence of video games and gambling-like mechanics has added particular urgency to this debate, because it has become clear that it may not be desirable to simply try to protect children under existing gambling regulations. The video game environment is unique and differs from the traditional gambling environment we know from, for example, casinos and betting websites. Therefore, the focus has shifted towards consumer protection as a means to ensure ‘fairness’ and protect vulnerable players. It is however unclear to what extent the consumer protection framework provides an encompassing solution. The Digital Fairness Act offers an opportunity to address the existing fragmentation at the EU level through a horizontal consumer-law instrument, which is why video games are squarely in the frame of the current legislative discussion.

Loot boxes are often compared to gambling, but many countries have concluded that they are not gambling because players cannot cash out their winnings. From a legal point of view, where would you place loot boxes, and does it matter whether we call them gambling or not?

Pieterjan Declerck: I have pragmatically chosen to describe loot boxes as ‘gambling-like elements’ or, my preference, as examples of random reward mechanisms. Whether loot boxes legally qualify as gambling depends on how each national jurisdiction defines the constitutive elements – typically consideration, chance and a prize of monetary value. The cash-out question – whether a player can convert virtual items back into real money – has been decisive in most Member States. Belgium, where the Gaming Commission concluded in 2018 that certain loot boxes fell within the scope of the gambling law, remains an exception, although as we have seen the enforcement of this so-called ban is sub-par (see also Leon Xiao’s research in this regard).

However, the cash-out criterion captures only a narrow dimension of the problem. In-game items carry value to players because of their utility, scarcity, social status and role in progression or competitiveness – regardless of formal convertibility into ‘real-world value’. Video games really establish an ecosystem, where the value of in-game items and currencies is an important aspect which interacts with gameplay mechanics, social features etc.

From a psychological perspective, loot boxes exhibit structural similarities to gambling through variable ratio reinforcement schedules and exploit cognitive biases including entrapment, near misses, loss chasing, sunk cost effects and the gambler’s fallacy. The available empirical evidence is consistent with this structural characterisation: reliable evidence associates loot box engagement and spending with problem gambling, although no causal link has definitively been established. This distinction between association and causation is important and should be considered carefully in any regulatory discussion.

From a consumer protection perspective, a relevant legal question is whether the commercial design of loot boxes constitutes an unfair, misleading or aggressive commercial practice within the meaning of the Unfair Commercial Practices Directive (UCPD). This question does not depend on a prior gambling classification. It asks whether the trader exercised professional diligence, whether the practice materially distorted or was likely to distort the economic behaviour of the average consumer – or, critically, of a clearly identifiable group of particularly vulnerable consumers such as children – and whether the commercial design exerted undue influence impairing the consumer’s freedom of choice.

It matters whether we classify loot boxes as gambling because it determines the extent to which regulatory tools are available. If loot boxes are classified as gambling, the – often very strict – rules of gambling law apply, which could cause overregulation of video games (e.g. age and identity verification, licencing requirements, reporting obligations, self-exclusion tools). If loot boxes are not classified as gambling under national law, we must turn to other legal domains to address the potential risks (consumer protection, data protection, platform regulation, etc.). But it is unhelpful to be trapped in a binary distinction between ‘gambling’ and ‘harmless entertainment’ and we should instead focus on the effective risks loot boxes have introduced, particularly those arising from value confusion, psychological pressure, data-driven personalisation and deceptive design. The Digital Fairness Act, depending on its eventual wording, may contribute to this ‘horizontal’ protection route, without requiring each Member State first to resolve the gambling classification question.

Protecting children is a recurring theme in both the Fitness Check and the consultation, since young people are now an important commercial audience for games. What specific risks do you see for younger players, and to what extent can the harms that children may experience also occur among older players?

Pieterjan Declerck: The risks for children are multi-dimensional. In my work, I assess them through the lens of children’s rights under the UN Convention on the Rights of the Child (CRC), using the right to play and protection against economic exploitation as core analytical instruments. Below some of my takeaways, with attention to the evidence base and the legal framework.

Value confusion. Virtual currencies – and particularly so-called premium virtual currencies – create an intermediate layer between real money and in-game items. This intermediate layer obscures the real cost of transactions and makes it more difficult for consumers to assess value.The confusion deepens where currencies can both be earned through gameplay and purchased with real money, because the player loses the ability to distinguish ‘earned’ from ‘bought’ value within the same wallet. BEUC’s survey evidence indicates that nearly half of players surveyed were confused about the real-money price of virtual items. For children with developing numeracy and financial reasoning, this problem is particularly acute.

Economic exploitation. I have framed the risk of spending pressure through Article 32 of the CRC – the right to protection against economic exploitation. Paid loot boxes can constitute economic exploitation when children are manipulated into spending money through behavioural design practices, including where personalised offers target an individual child or subgroup of children based on profiling. The test I propose is whether the commercial design nudges or manipulates children into transactional decisions they would not otherwise have taken, thereby exploiting their developmental vulnerabilities for commercial gain.

Gambling-related psychological harms. Loot boxes exhibit variable ratio reinforcement schedules and exploit cognitive biases including entrapment, near misses, loss chasing, sunk cost effects and the gambler’s fallacy. Some evidence associates loot box purchasing with psychological distress and financial harm.However, the available evidence on causation remains limited: reliable evidence associates loot box engagement with problem gambling, but no definitive causal link has been established. The precautionary principle can be useful in this context to justify regulatory action where scientific indications of potential danger exist despite residual uncertainty, particularly where children are the affected population.

Ecosystem amplification. A critical insight from our multidisciplinary study of FIFA Ultimate Team is that children may experience undue influence not only from the loot box mechanism itself, but from the combined layered ecosystem around it. Time-limited events, objective-based rewards, publisher communications and streamer content all amplify uncertainty, sociability, competitiveness and financial pressure beyond what the isolated loot box presents. This means that regulatory assessment should consider the function of random reward mechanisms within overall game design, including whether they are necessary for progression or competitiveness and the pressure experienced in the surrounding ecosystem.

Personalisation and profiling. Video games collect vast amounts of behavioural data about players. Relevant data categories include data provided by the player, observed gameplay and commercial data, and inferred or constructed profiles. Personalised offers, dynamic pricing, adaptive difficulty and targeted promotions based on a child’s gameplay patterns, spending history or inferred emotional state may constitute aggressive commercial practices where they exploit vulnerabilities and cause transactional decisions that players would not otherwise have taken. 

Can these harms also affect adults? They can. Vulnerability in the digital environment is dynamic and situational, not a fixed personal characteristic. Adults experiencing financial stress, those with lower digital literacy, individuals with gaming or gambling problems, or players in states of intense engagement can all be vulnerable to the same mechanisms. The legal difference is not that adults are invulnerable, but that children merit a higher threshold of protection because of their evolving capacities and developmental stage.The UCPD already recognises that practices directed at or reaching vulnerable consumers should be assessed from the perspective of the average member of that group. In the digital context, informational and power asymmetries can render any player situationally vulnerable, child or adult. A well-designed Digital Fairness Act may therefore contribute to the protection of children and provide meaningful safeguards for all players in situations of digital vulnerability.

The gaming industry tends to argue that self-regulation and existing rules are sufficient, while consumer groups call for binding measures such as switching features off by default or disclosing the odds of winning. How do you weigh these competing positions?

Pieterjan Declerck: Both positions contain elements of truth, but neither is satisfactory as stated. Let me explain my reasoning by distinguishing the legal baseline from the empirical evidence on effectiveness.

The existing legal baseline. EU consumer law already provides a relevant framework. The UCPD prohibits unfair, misleading and aggressive commercial practices, including direct exhortations to children in Annex I. The Commission’s 2021 UCPD Guidance states that paid random content such as loot boxes should be clearly disclosed, including the probabilities of receiving different items, and that prices should be displayed in real currency. The CPC Network’s 2025 key principles on virtual currencies state that both the purchase of premium virtual currency with real money and the subsequent use of that currency to acquire in-game content or services are subject to EU consumer law. These are existing real regulatory tools, which provide a foundation to build on regardless of their undeniable limitations.

The limits of guidance and self-regulation. Commission guidance and CPC statements are not legally binding, meaning that their application in individual cases remains uncertain and courts may have to determine applicability on a case-by-case basis. Another criticism of these guidelines is that they often remain rather vague and are therefore difficult to apply in practice. Similarly, it is uncertain whether complying with these – mostly – increased transparency obligations would effectively address the identified risks for players.

The effectiveness of self-regulatory labelling is also discussed in my PhD research: it identifies concerns around the binding value, clarity, post-release verification and enforcement of PEGI or other systems providing labels and descriptors for video game content. Limit-setting tools in video games to limit, for instance, expenditure or playtime, or parental control tools are often cited by video game industry actors, however their effectiveness remains uncertain, especially when it comes to protecting the most vulnerable players. The situation needs to be avoided where the existence of these tools is used to shift the responsibility from the video game industry to parents and children.

The evidence on disclosure. Probability disclosures are often cited as the silver bullet regarding transparency. While they may be necessary, in practice they are not a catch-all solution: compliance is often suboptimal, with probabilities presented in ways that are non-compliant, opaque or impossible for ordinary consumers to use meaningfully (which can lead to the opposite effect: reducing transparency even further). Transparency is a necessary condition for fair commercial practice, but it is not a sufficient condition where the underlying design creates pressure to spend.

Consumer group positions. BEUC’s position represents the strongest expression of consumer advocacy in this area. It recommends banning premium virtual currencies, paid loot boxes and pay-to-win mechanisms outright, deactivating in-app purchases by default in games likely to be played by minors, and requiring spending limits set by the payment-account holder. These proposals reflect genuine consumer concerns and the weight of the survey evidence BEUC cites cannot be overlooked. However, from a child-rights perspective, a more nuanced and proportionate approach may be required, which avoids preventively banning or removing video game design features in their entirety and instead focuses on the problematic aspects.

My position. My conclusion in my PhD research is that paid loot boxes should be prohibited for children, or at the very least subject to effective restrictions and mitigation measures, and that social casino games should not be accessible to children. For adults, robust transparency, meaningful spending controls, fair design obligations and targeted protections for vulnerable players may be preferable to blanket prohibition – though the precise calibration depends on the severity of the practice and its context within the game ecosystem. The principle of proportionality requires balancing the child’s best interests against the economic interests of the video game industry.

Institutionally, I have argued for a co-regulatory approach: binding public rules that set the regulatory floor, combined with industry implementation through a strengthened PEGI system or equivalent (e.g. sector code) that is supervised, enforceable and subject to public oversight and sanctions. Self-regulation has had its opportunity; the evidence of uneven implementation suggests it has not been sufficient on its own to prevent harms. Binding measures are needed, but they should be proportionate, context-sensitive and designed to preserve the positive value of play.

Video games already sit within a web of EU rules, including consumer law, the Digital Services Act, the AI Act, and national gambling laws. What gap, if any, would a Digital Fairness Act actually fill?

Pieterjan Declerck: The gap is not a complete absence of applicable law. It is fragmentation, legal uncertainty and enforcement difficulty.

Consumer law (UCPD, CRD, DCSD). The UCPD provides the broadest horizontal framework. Its prohibition of unfair commercial practices, including misleading omissions and aggressive practices involving undue influence, is capable in principle of capturing many problematic video game monetisation practices. However, the UCPD was not designed for digital environments of this complexity, and significant open questions remain: whether the ‘second-stage transaction’ – where a player uses already-purchased virtual currency to acquire a loot box – is itself subject to pre-contractual information requirements under the Consumer Rights Directive; how withdrawal rights apply to digital content delivered through randomised mechanisms; and at what point virtual currency design becomes sufficiently confusing to constitute a misleading omission. Another key example is how to apply the ‘transactional decision’ test under the UCPD: when has a player been unduly influenced to the extent it has caused them to take a transactional decision they would otherwise not have taken? There is a grey area between subtle nudging and outright manipulation, and regardless of the application of this ‘spectrum of influence’, the question of proof of such undue influence is equally difficult to answer.

The Commission’s Fitness Check itself concluded that the current consumer law framework provides a strong baseline but leaves insufficient certainty and insufficient incentives for digital fairness by design. Another issue with consumer protection law is the extent to which consumer authorities can enforce the existing rules in practice.

The Digital Services Act. The DSA contains relevant provisions on manipulative interface design (Article 25) and protection of minors on online platforms (Article 28). However, its scope is limited to intermediary services and online platforms as defined in Article 3. Not every game or in-game store will necessarily constitute an online platform or intermediary service within the meaning of the DSA. This means the DSA’s design-level obligations do not automatically apply to all video game environments. 

The AI Act. Article 5 of the AI Act prohibits AI systems that materially distort behaviour through subliminal, purposefully manipulative or deceptive techniques, or that exploit vulnerabilities due to age, disability or social/economic situation where significant harm is likely. Its relevance to video games is limited by two thresholds: first, the practice must involve an ‘AI system’ as defined in the Act; and second, it must meet the specific statutory thresholds of manipulation or exploitation. Most problematic game monetisation practices – virtual currency design, loot box probability structures, time-limited offers, scarcity cues – will not necessarily involve AI systems within the Act’s definition. The AI Act is therefore not an automatic consumer-law solution for game design.

The GDPR. The GDPR addresses personal data processing, profiling, transparency and automated decision-making, and provides specific protection for children. It is essential for addressing personalised commercial practices in games – particularly personalised offers, dynamic odds and targeted promotions based on behavioural data. However, it does not directly regulate consumer harms such as value confusion, spending pressure or unfair monetisation design that do not depend on personal data processing. It is a necessary but insufficient part of the picture.

National gambling law. National gambling laws are divergent across Member States and most turn on whether the mechanism involves a prize of monetary value or the possibility of cash-out. They cannot provide a harmonised safety net of consumer protection across the Single Market for gambling-like mechanisms that do not meet the national gambling threshold.

The gap the DFA could fill. A well-designed Digital Fairness Act could address the horizontal consumer-law gap by: clarifying unambiguously that all game monetisation practices, including second-stage virtual currency transactions, fall within consumer law’s scope; adding specific unfair practices to the UCPD Annex I blacklist; requiring fair-by-design and child-rights-by-design obligations; creating enforceable obligations for virtual currencies and random reward mechanisms; and strengthening coordinated cross-border enforcement. The European Parliament’s IMCO Committee has already called for loot boxes, in-app currencies and persuasive technologies to fall within the DFA’s scope.If, however, the DFA merely restates existing principles without resolving the sector-specific uncertainties, it will add complexity without legal certainty.

Finally, looking ahead, what would a good outcome of the DFA look like for players, and what would tell you that the EU has missed its chance to get this right?

Pieterjan Declerck: Because no Commission proposal has yet been published in the materials reviewed, any view about what the DFA will contain must be treated as anticipatory. What follows is therefore a normative statement of what I believe the DFA could achieve. A good outcome would, first, recognise video games as a specific digital environment with genuine play value and real consumer risks – neither demonising games nor accepting the status quo. It would provide clear, binding and enforceable rules addressing the following:

Virtual currencies and price transparency. Mandatory display of real-currency prices at the point of every transaction, eliminating the obfuscation created by intermediate virtual currencies. Serious consideration is required of restricting or prohibiting premium virtual currencies that serve no function other than to obscure value and create remainder balances encouraging further spending. 

Random reward mechanisms. (i) Probability disclosures that are meaningful, accessible, and presented in a manner comprehensible to the relevant audience – including children and parents. Whether this is possible is unclear, as it may also require a more fundamental change in video game design where it is avoided to include large numbers of virtual items in video games. (ii) Prohibitions or strict restrictions on paid loot boxes for children. (iii) Assessment of random reward mechanisms not in isolation, but within the broader video game ecosystem, considering whether they are necessary for progression or competitiveness and the pressure experienced in the surrounding layers of the gameplay design.

Personalisation and exploitative design. Clear prohibitions on personalised commercial practices that exploit player vulnerability – including dynamic odds, targeted offers based on inferred emotional states or gameplay difficulties, and adaptive pricing based on spending propensity.

Child rights by design. Child rights impact assessments for video games likely to be played by children; consultation with children of different ages in the assessment process; privacy-preserving age assurance where age-based restrictions are necessary; child-friendly transparency; and ethical design principles that ensure the right to play is not contingent on purchasing power.This should include addressing video game architectures where meaningful participation, progression or competitiveness depends on spending.

Design accountability. Above all, a good outcome would shift responsibility away from individual players and parents alone and towards product design and business accountability. The question should not be whether the player or parent failed to set limits; it should be whether the product was designed fairly and in accordance with professional diligence in the first place. This is where the DFA’s ambition should lie: not merely in disclosure, but in design obligations with genuine enforcement consequences.

How would I know the EU has missed its chance? The DFA will have failed if it: limits itself to additional disclosure obligations without addressing underlying design; leaves compliance to voluntary codes or soft-law guidance that can be ignored without consequence; ignores the surrounding video game ecosystem and treats each monetisation practice in isolation rather than assessing its function in context; fails to address virtual currencies and data-driven personalisation; creates obligations too vague to enforce or too general to change industry practice meaningfully; or fails to place children’s rights – including the right to play, development, freedom of thought and protection against economic exploitation – at the centre of its design.