On January 17, 2025, the Department of Justice filed a complaint upon referral from the Federal Trade Commission (FTC) against Singapore-based Cognosphere Pte. Ltd and its Californian subsidiary Cognosphere LLC, which collectively does business under the name “HoYoverse”. The complaint consists of five counts split into essentially two major prongs against HoYoverse and their game, Genshin Impact.[1]
- First, HoYoverse violated the Children’s Online Privacy Protection Act (COPPA) by marketing Genshin Impact to children and teenagers and collecting their personal information.
- Second, HoYoverse has violated Section 5(a) of the FTC Act by engaging in deceptive practices by misrepresenting the costs and odds of winnings of its loot boxes.
HoYoverse stated that it believed the FTC’s allegations were inaccurate but ultimately agreed to settle with the FTC by paying a $20 million fine and making changes to Genshin Impact and its disclosures to address the allegations in the complaint. Although the complaint was not litigated in court, it does reveal some important factors that the FTC considers when determining whether a game is violating COPPA and whether a loot box monetization system is deceptive and unfair.
In this three-part blog post we’ll look into the background of the loot box mechanic including the gachapon subset, COPPA, and Genshin Impact.
Background
What is the Children’s Online Privacy Protection Act (COPPA)?
The Children’s Online Privacy Protection Act of 1998 governs the safety and privacy of children by restricting collection of children’s personal information by Internet websites and online service providers.
COPPA applies to sites and services that are either directed toward children under the age of 13 or have actual knowledge that children 13 are providing information online. If an online service provider’s practices fall under COPPA, then they must take steps to: (i) provide notice on its website or service of what information it collects and how they use that information; (ii) obtain “verifiable parental consent” before collecting, using, or disclosing the information; (iii) provide parents with reasonable means of reviewing the information collected and to refuse to permit further use or maintenance of that information; (iv) not condition a child’s participation in the game on the child disclosing more personal information than reasonably necessary to participate in the game; and (v) establish and maintain reasonable procedures to protect the confidentiality, security and integrity of the personal information collected from children.
Personal information is defined broadly to include: (i) first and last names; (ii) home or other physical addresses; (iii) online contact information including screen or user names that functions as online contact information; (iv) phone numbers; (v) Social Security numbers; (vi) a persistent identifiers that can be used to recognize users across different websites and services; (vii) photographs, videos, or audio files containing a child’s image or voice; (viii) geolocation information that can be used to identify a city, town, or street name; or (ix) information about the child or child’s parents the site or online service collects and combines with an identifier described above.
Violators of COPPA can be fined up to $53,088 per violation, although the exact penalty will be determined based on several factors and vary on a case-by-case basis.[2] Fees can ramp up quickly, as each separate instance of collecting personal information from a minor is a separate violation of COPPA.
What Are Loot Boxes?
Loot boxes are virtual boxes that have random prizes inside that a player can buy in a video game using either in-game currency or real currency. These prizes vary and can be functional, such as a weapon or new character, or cosmetic such as an outfit or skin to give the player a unique look.
Loot boxes have come under heavy scrutiny, with many arguing that the addictive and chance-based nature of loot boxes makes it akin to gambling. Major concerns include the complex system of percentages behind certain rewards, inaccurate or misleading disclosures of the actual rates to obtain a desired reward from a loot box, and advertising around loot boxes to heighten the appeal and addictive nature of them.
These mechanics are regulated to varying degrees internationally. Loot boxes are illegal to sell in countries like Belgium due to such country’s gambling laws. This has forced some games to fully cease servicing the game within those countries.[3] Other countries such as Germany, Austria, and South Korea have enacted requirements that games with loot boxes be rated for certain ages or above. Several jurisdictions have varying disclosure requirements around the actual probability of obtaining a specific reward, the specific cost in real currency to open a loot box, etc.
In the United States, there have been efforts on both the state and federal level to regulate the practice, but no legislation has passed to date. The FTC had previously conducted a workshop studying these mechanics in 2019[4] and issued a staff paper in 2020[5], which highlighted some of the FTC’s major concerns with the practice. However, no action was brought at the time.
How Do These Apply to Genshin Impact?
Genshin Impact is an initially free-to-play open world action role-playing game. It is also a “gacha” or “gachapon” game.
Gachapon originally referred to toy vending machines popular across Japan and the rest of East Asia that would spit out capsules containing a random toy within them. In the context of games, players typically spend in-game currency to pull an in-game gachapon machine and obtain a random prize. Although players can earn a limited amount of in-game currency by completing in-game missions; some players decide to buy in-game currency with real currency.
The practice has become so widespread and popular that there is an entire genre of games called “gacha games.” Gacha games often have Japanese animation art styles and feature huge rosters of characters with unique designs and abilities that players can mix and match into teams. A constant influx of new characters with appealing designs and powerful abilities induces players to spend in-game currency to obtain those characters, and is the main method that gacha games are monetized.
Gachapon systems are extremely similar to loot boxes. Although gachapon systems actually predate loot boxes by a few years, they are essentially the same thing as far as the FTC is concerned. Both systems provide random rewards with “better” rewards being much rarer. This incentivizes players to open loot boxes or pull gacha more often, which is often only possible by spending real currency in exchange for in-game currency. With its animated art style and its status as one of the most popular gachapon games at the moment, Genshin Impact was a natural target for a complaint related to COPPA and loot boxes. In Part II and Part III of this three-part series, we will explore the factors that the FTC examined in their complaint against HoYoverse and what lessons we can learn in terms of COPPA and loot box compliance.
[1]https://www.ftc.gov/news-events/news/press-releases/2025/01/genshin-impact-game-developer-will-be-banned-selling-lootboxes-teens-under-16-without-parental
[2]https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
[3]https://unite.pokemon.com/en-gb/news/notice-of-termination/
[4]https://www.ftc.gov/news-events/events/2019/08/inside-game-unlocking-consumer-issues-surrounding-loot-boxes
[5]https://www.ftc.gov/news-events/news/press-releases/2020/08/ftc-staff-issue-perspective-paper-video-game-loot-boxes-workshop
View all posts by this author