Loot Boxes and Paid Random Items

Some video games include purchases where the outcome is left to chance, often called “loot boxes,” “gacha,” or “paid random items.” This page explains how these features are rated and labelled, what’s changing with PEGI age ratings, and how age verification works across major platforms.

How PEGI now rates paid random items

PEGI has expanded its age rating criteria to cover a wider range of “interactive risks,” including paid random items and other features that affect how children interact with games and other players.

• Games with paid random items such as card packs or gacha mechanics, where you pay without knowing what you’ll receive, will now be rated PEGI 16.
• Social casino games where the core gameplay depends on repeatedly paying to take part in chance-based mechanics that resemble real gambling, such as slot-machine spins or roulette, will be rated PEGI 18.

These sit alongside several other new criteria:

• Paid random items (card packs, gacha, etc.) = PEGI 16
• Social casino-style gambling mechanics = PEGI 18
• Unrestricted communication features = PEGI 18
• Time- or quantity-limited in-game offers = PEGI 12
• Rewards for returning to a game = PEGI 7
• Penalties for not returning to a game = PEGI 12

PEGI describes these changes as a way to address online interaction risks, strengthen online safety, and better reflect the questions and concerns parents raise today.

Timeline

• The new criteria apply to all newly submitted games from 1 June 2026, with a gradual rollout across participating online storefronts. 

• From 1 October 2026, PEGI will begin reclassifying existing games that meet the relevant conditions under the new criteria. 

You may start to see rating labels on familiar games change over the coming months, this is expected, and reflects PEGI applying its updated criteria retrospectively rather than any change to the game itself. 

Age verification and child accounts 

Platforms and publishers are also strengthening the tools available to verify player age and manage what younger accounts can do: 

• PlayStation, Xbox and Roblox have all introduced age verification measures at the platform level. 

• Publisher-level controls are adding further protection on top of this. Ubisoft, for example, disables default spending permissions on young player accounts — in-game purchases are blocked by default on child accounts unless a parent actively chooses to enable them. 

• Apple has been expanding its age assurance tools through 2026. From 24 February 2026, the App Store began blocking users in Australia, Brazil and Singapore from downloading 18+ rated apps unless their adult status is confirmed. Apple’s updated Declared Age Range API also lets apps request a user’s age category (for example, under 13, 13–16, 16–18, or 18+) without sharing exact personal data — this is rolling out in response to age assurance laws in US states including Texas, Utah and Louisiana, alongside similar requirements internationally. 

Together, platform-level and game-level controls give parents more than one layer of protection, but they work best alongside a conversation with your child about what they’re playing and spending. 

Disclosure of loot box odds and in-game purchases 

Since 2020, all major games publishers and platforms have committed to disclosing the probability of obtaining items through loot boxes, so players can see the odds before they buy. 

App stores also require games to clearly show whether a title includes in-game purchases, including paid random items, in a prominent position on its store listing, so this information is visible before you download.  

If you think you or your child have made a purchase you’re not happy with, see our guide to requesting a refund for links to each platform and publisher’s refund process.