Cognosphere, the developer of popular video game, Genshin Impact, has agreed to pay $20 million and block users under the age of 16 from purchasing loot boxes without parental consent (among other requirements) in a ground-breaking settlement with the Federal Trade Commission (FTC). 

What Happened

This settlement comes after the FTC filed a complaint against Cognosphere (commercially known as “HoYoverse”) for allegedly violating the Children’s Online Privacy Protection Act (COPPA) and Section 5 of the FTC Act. The complaint centers around HoYoverse’s data collection practices and its allegedly unfair and deceptive trade practices in connection with its in-game loot boxes and virtual currency. 

As a brief refresher, “loot boxes” are in-game mechanisms that generate randomized virtual items when ‘opened’ by players. Loot boxes typically contain in-game items such as weapons, virtual apparel for the player’s character (also commonly referred to as “skins”), in-game currency or even additional loot boxes. Players may purchase loot boxes with earned in-game virtual currency or virtual currency purchased using real or ‘fiat’ currency. Loot boxes have been a common point of contention within the U.S. courts – consumers have alleged that the mechanics mimic gambling due to its chance-based nature, and thus violate various consumer protection laws. However, until this most recent FTC action, we had not seen much concrete legislative or regulatory movement targeting loot boxes specifically. 

The FTC focused on both privacy and consumer protection violations. Regarding unlawful privacy practices, HoYoverse allegedly collected personal data from children under the age of 13 without providing adequate notice and obtaining verifiable parental consent in violation of COPPA. The FTC also claimed that HoYoverse misled players about the odds of winning rare “five-star” items and used a confusing virtual currency structure that obscured the true cost of loot boxes. These practices, according to the FTC, constituted unfair and deceptive trade practices, violating Section 5 of the FTC Act. As part of the settlement, HoYoverse has agreed to pay a $20 million fine and enact significant operational changes, such as blocking users under the age of 16 from purchasing loot boxes without parental consent.

Why It Matters

This complaint is rife with allegations of conduct that game companies should consider when thinking through their own compliance strategies. The lessons to learn here are legion - we've covered some highlights and our key takeaways:

Child-Directed Games: Regarding privacy allegations, the FTC noted that Genshin Impact actively marketed itself to children through bright anime-style graphics, characters resembling “young children,” and campaigns specifically targeting children, such as engaging influencers popular with younger audiences. Thus, the FTC noted, Genshin Impact is “an online service directed to children,” making it subject to COPPA. 

This case serves as an important reminder for game companies that simply stating in a privacy policy that a game is not intended for children is vastly insufficient. The determination of whether a game is "child-directed" is made by regulators and extends beyond a company’s actual knowledge of users being under the age of 13. 

Loot Boxes & In-Game Currencies: The FTC also took issue with HoYoverse’s monetization strategies, particularly its “pay-to-win” gacha system where players purchase loot boxes for a chance to win rare “five-star” in-game items and characters. The agency alleged that HoYoverse misled players about their odds of winning, creating the false impression that success rates were higher than they actually were. In reality, players had only a 0.3% (three in one thousand) chance of winning specifically featured characters, and the FTC noted that players may need to spend anywhere from $360-$540 on loot boxes to win. 

For game companies that offer loot boxes/chance-based mechanics or any in-game currencies, this case illustrates the concerns regulators have regarding both transparency and potential harm specifically done to minor users due that lack of transparency. 

Court-Ordered Changes: In addition to the $20 million fine, HoYoverse has also agreed to enact several important changes in how Genshin Impact operates, such as:

• Prohibiting children under the age of 16 from purchasing loot boxes without parental consent;
• Allowing users to purchase loot boxes with real currency (rather than solely with in-game currency); 
• Disclosing loot box odds of winning and exchange rates for in-game currency;
• Deleting personal information collected from children under the age of 13 (unless HoYoverse receives parental consent to retain this data); and
• Complying with COPPA requirements, such as notice and verifiable parental consent requirements. 

This settlement underscores that the stakes go beyond just monetary fines – HoYoverse will spend significant time, money, and resources making the required changes to its business operations. Ensuring compliance before facing a court-ordered settlement is, undoubtedly, a simpler task.

What Comes Next

HoYoverse provided a statement to Polygon regarding the settlement, stating that although they believe that “many of the FTC’s allegations are inaccurate,” HoYoverse is willing to agree to the settlement because it values the trust of its community and its commitment to transparency. 

The FTC’s action against HoYoverse highlights a broader crackdown happening within the U.S. on the video games industry, particularly as it relates to children's privacy and consumer protection. This FTC settlement comes on the heels of the Consumer Financial Protection Bureau (CFPB) announcing a shift in its focus to consumer transactions within video games. The writing is on the wall: non-compliance is a non-starter.

Game companies need to be vigilant and proactive in their approach to compliance, thinking through strategies to minimize risk during development and deploying those strategies through distribution. The FTC recently provided tips for businesses in light of this settlement which boil down to this: (1) know your data practices to comply with data privacy laws and (2) prioritize transparency and compliance in your marketing and disclosures.

This settlement attempts to send a message to the video games industry: the risk is not worth the reward. We will continue to monitor developments and provide updates (along with pithy puns) as they emerge.