UK Loot Box Self-Regulation Failed to Change Apple App Store Practice
Loot boxes on the Apple App Store did not meaningfully respond to UK industry self-regulation, and the gap between written rules and real-world practice remained wide months after the rules took effect. In a longitudinal assessment of the 100 highest-grossing iPhone games, loot box disclosures were sparse, parental consent was absent, and reward-probability information was rarely presented in a consistent way. The result is a blunt one: a voluntary framework meant to protect children and consumers did not move the market.
The issue matters because loot boxes occupy a difficult space between entertainment and gambling-like monetization. Players pay real money for randomized in-game rewards, a structure that can encourage repeated spending even when the player has little control over the outcome. For younger users, the concern extends beyond money alone. Randomized reinforcement can normalize gambling-like behavior, and when purchase pathways are embedded inside popular games, exposure can be frequent, frictionless, and hard for families to monitor.
A Voluntary Framework Met by Broad Non-Compliance
The study examined the 100 highest-grossing iPhone games during two periods: January to June 2024, before the self-regulations came into effect, and July to December 2024, after implementation on 18 July 2024. Investigators focused on three empirically testable measures: explicit parental consent before enabling loot box purchases by under-18s, disclosure of loot box presence, and disclosure of the probabilities attached to different rewards.
Among games with loot boxes, 0.0% sought explicit parental consent before allowing under-18s to purchase them. None. In a consumer setting built around frictionless in-app purchasing, that absence carries direct implications for child protection and informed decision-making at the point of sale.
Only 23.5% disclosed the presence of loot boxes at all, and those disclosures were visually obscured and difficult to access. A small number of games did disclose reward probabilities, but consistent disclosure remained rare: only 8.6% did so across all loot boxes identified in the sample. In practical terms, players were often left without basic information about what they were buying or how the reward structure worked.
The transparency deficit was not subtle.
No Evidence of Enforcement After Notice
A particularly consequential finding was the absence of any meaningful enforcement response. Games that failed to comply before the self-regulations came into force remained non-compliant many months later. That held true even after Ukie and the Apple App Store were given evidence of the breaches and asked to delist games if the problems were not corrected.
This is where voluntary regulation breaks down in a way clinicians, regulators, and policy makers will recognize from other consumer-protection failures: rules without enforcement function as suggestions. A framework that depends on goodwill from the very companies profiting from the behavior it seeks to constrain is structurally weak unless an outside body can verify compliance and impose consequences.
The authors’ central conclusion is difficult to avoid. Ukie cannot enforce its own rules, and the platform hosting the games did not act decisively when violations were documented. Without meaningful enforcement leverage, the same non-compliance persisted even after the policy change that was supposed to improve it.
Why the Findings Matter for Consumer Protection and Child Safety
The broader policy question is not simply whether a few disclosures were missing. It is whether an industry-led approach can protect consumers when the commercial incentive runs in the opposite direction. Loot box monetization depends on engagement, repeated spending, and uncertainty; each of those features can conflict with transparent disclosure and age-appropriate safeguards. When a child can tap through a purchase flow without explicit parental consent, the safeguard is not a safeguard at all.
Probability disclosure also has a concrete public-interest role. Randomized reward structures resemble gambling mechanics precisely because chance is central to the transaction. Without clear odds, consumers cannot estimate value or risk in a meaningful way. In a marketplace where digital purchases can be made in seconds, that opacity has real consequences for spending behavior, particularly among young people and vulnerable users.
The study’s findings also reach beyond one trade association or one app store. They speak to a recurring regulatory pattern: when enforcement is left to industry, compliance often depends on the least demanding interpretation of the rules. Where the consequences for violating those rules are weak or absent, the rules themselves do little work.
Regulators, Platforms, and Legal Standards Remain the Weak Link
The authors argue that platforms, the advertising regulator, and consumer protection regulators must enforce pre-existing rules more effectively. Their position is grounded in a simple proposition: if a practice is already subject to general legal standards, those standards should apply to video games as they do elsewhere. Games are not exempt because the product is digital, popular, or commercially successful.
The study also presses a sharper policy recommendation. Governments should not rely on industry self-regulation, especially after repeated demonstrations of its weaknesses. For loot boxes, stricter legal regulation is the logical next step if the goal is genuine consumer protection rather than symbolic reassurance. The evidence here does not suggest a temporary implementation problem that might be corrected with a gentle reminder. It points to a durable failure of the model itself.
A striking aspect of the results is their stability over time. After the rules were introduced, the compliance profile did not improve in any meaningful way. Non-compliance persisted, enforcement did not materialize, and the same gaps remained visible months later. For families, that means the practical environment facing children and adolescents on the App Store looked much the same after regulation as before it.
A Warning Against Treating Self-Regulation as a Substitute for Law
This longitudinal study was preregistered as a Stage 1 protocol, adding weight to the interpretive confidence around its design. Its value lies not only in documenting a policy failure but also in showing how quickly a voluntary framework can become performative when market incentives dominate and oversight is weak. The consumer-facing protections that were promised were not delivered in the sample studied.
The policy lesson is concrete. If loot boxes are to be constrained, the rules must be backed by verification, platform-level enforcement, and legal consequences for non-compliance. Without that, the burden falls back on parents and children to detect opaque monetization tactics inside games that are designed to keep them engaged.
The unresolved question is not whether voluntary rules can exist. It is whether anyone should expect them to work when the evidence already shows they did not.