Content uploaded by Leon Y. Xiao
Author content
All content in this area was uploaded by Leon Y. Xiao on Nov 11, 2024
Content may be subject to copyright.
Illegal loot box advertising on social media? An empirical study using the
Meta and TikTok ad transparency repositories
Leon Y. Xiao
a,b,*
a
Center for Digital Play, IT University of Copenhagen, Denmark
b
School of Psychological Science, University of Bristol, UK
ARTICLE INFO
Keywords:
Loot boxes
Video gaming regulation
Information technology law
Consumer protection
Social media marketing and advertising
ABSTRACT
Loot boxes are gambling-like products inside video games that can be bought with real-world money to obtain
random rewards. They are widely available to children, and stakeholders are concerned about potential harms, e.
g., overspending. UK advertising must disclose, if relevant, that a game contains (i) any in-game purchases and
(ii) loot boxes specically. An empirical examination of relevant adverts on Meta-owned platforms (i.e., Face-
book, Instagram, and Messenger) and TikTok revealed that only about 7 % disclosed loot box presence. The vast
majority of social media advertising (93 %) was therefore non-compliant with UK advertising regulations and
also EU consumer protection law. In the UK alone, the 93 most viewed TikTok adverts failing to disclose loot box
presence were watched 292,641,000 times total or approximately 11 impressions per active user. Many people
have therefore been repeatedly exposed to prohibited and socially irresponsible advertising that failed to provide
important and mandated information. Implementation deciencies with ad repositories, which must comply with
transparency obligations imposed by the EU Digital Services Act, are also highlighted, e.g., not disclosing the
beneciary. How data access empowered by law can and should be used by researchers is practically demon-
strated. Policymakers should consider enabling more such opportunities for the public benet.
1. Introduction
1.1. Loot boxes: prevalence, popularity, and associated concerns
Loot boxes are products inside video games that may be bought by
players to obtain random rewards.
1
The loot boxes in some video games
can also (or can only) be obtained for free through gameplay,
2
but the
present paper focuses on loot boxes that are available to players to buy
with real-world money either directly or indirectly through using in-
game currencies that are themselves bought with real-world money
(so-called ‘paid loot boxes’), which are simply referred to as ‘loot boxes’
below. Video games now offer many forms of in-game purchases with
randomised elements:
3
the players do not know what they will receive
until after they have spent real-world money. Not all such monetisation
mechanics are visually portrayed as a box that can be opened to receive
random rewards. In the present paper, ‘loot boxes’is used as a shorthand
to refer to all such in-game purchases with randomised elements,
including ‘gacha’summoning mechanics (which allow players to spend
money for a random chance at obtaining playable characters and
weapons through a ‘summoning banner,’rather than through opening
virtual treasure chests, and are often implemented in East Asian games
4
)
and simulated gambling or social casino games (which allow players to
spend real-world money to simulate participating in traditional
gambling activities like playing on slot machines but do not allow
* Corresponding author.
E-mail address: lexi@itu.dk.
1
Aaron Drummond and James D Sauer, ‘Video Game Loot Boxes Are Psychologically Akin to Gambling’(2018) 2 Nature Human Behaviour 530.
2
Nick Ballou, Charles Takashi Toyin Gbadamosi and David Zendle, ‘The Hidden Intricacy of Loot Box Design: A Granular Description of Random Monetized
Reward Features’(DiGRA Conference, Krak´
ow, July 2022) http://www.digra.org/digital-library/publications/the-hidden-intricacy-of-loot-box-design-a-granular-
description-of-random-mone-tized-reward-features/ accessed 25 January 2021.
3
Entertainment Software Rating Board (ESRB), ‘Introducing a New Interactive Element: In-Game Purchases (Includes Random Items)’(ESRB Ofcial Website, 13
April 2020) https://www.esrb.org/blog/in-game-purchases-includes-random-items/ accessed 19 July 2023.
4
Joleen Blom, ‘The Genshin Impact Media Mix: Free-to-Play Monetization from East Asia’(2023) 16 Mechademia 144; Orlando Woods, ‘The Economy of Time, the
Rationalisation of Resources: Discipline, Desire and Deferred Value in the Playing of Gacha Games’(2022) 17 Games and Culture 1075.
Contents lists available at ScienceDirect
Computer Law &Security Review: The International
Journal of Technology Law and Practice
journal homepage: www.elsevier.com/locate/clsr
https://doi.org/10.1016/j.clsr.2024.106069
Computer Law & Security Review 56 (2025) 106069
0267-3649/© 2024 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY license ( http://creativecommons.org/licenses/by/4.0/ ).
players to then convert any winnings back into legal tender, thus
differentiating these products from actual gambling
5
),
6
although there is
academic debate as to whether doing so is appropriate.
7
Loot boxes are widely implemented in contemporary video games
across the world: the most recent ndings suggest that about 80 % of the
highest-grossing mobile games sell loot boxes, including many games
deemed to be suitable for young children.
8
In the UK, the Gambling
Commission reported in 2022 following a study conducted by Ipsos that
24 % of 11- to 16-year-olds ‘paid’to open loot boxes with ‘money or
virtual currency,’
9
and this rate has stayed relatively consistent at 21 %
in 2023.
10
Unfortunately, the wording of this question left open the
unintended interpretation that it also encompasses loot boxes paid for
using virtual currency that was obtained without spending money (which
would not be ‘paid loot boxes’involving real-world money as dened
above that various stakeholders are most concerned about). The older
2020 Gambling Commission survey by Ipsos, whose wording did not
suffer from this problem, reported a 23 % loot box purchase rate
amongst the same age group.
11
The relative stability of this rate suggests
that few participants incorrectly broadly interpreted the 2022 and 2023
survey questions as including non-paid loot boxes. Regardless, note that
an industry-funded study (also conducted by Ipsos) reported that only
3.8 % of players, both minors and adults (between 11 and 64), bought
loot boxes.
12
The same industry body that funded the aforementioned
report previously stated that 53 % of 6- to 64-year-olds in Europe, or
126.5 million people, played video games in 2022.
13
Consequently,
because of the great number of people playing video games overall, even
the alleged ‘low’3.8 % loot box purchase rate means that at least over
4.8 million people in Europe alone are spending money on loot boxes
because of how popular video games are. A purchase rate of 21 % based
on the newest 2023 UK Gambling Commission data would instead mean
that more than 30 million people in Europe are buying loot boxes with
real-world money. This is likely an underestimate because the loot box
purchase rate amongst the whole population is likely higher than that
amongst 11- to 16-year-olds, given that adults are more likely than
children to be able to purchase loot boxes and also to spend more money
on them. (However, older adults, e.g., those aged between 50 and 64
may be less likely to purchase than younger adults. More research on
older video game players, which is not presently available, would be
helpful.) Senior management at Electronic Arts, one of the most popular
and protable game companies selling loot boxes, has stated that: (i)
young people should not be spending money on loot boxes; (ii) there are
many spending control features to limit or prevent spending by children;
and, (iii) importantly, most user accounts belong to adults.
14
Indeed,
previous academic studies reported higher adult purchase rates of 40–60
% amongst video game players.
15
In addition, when a child purchases a
loot box, their parent likely paid for it, and so the adult was also involved
in the transaction and arguably engaged with loot boxes and was
affected by them as well, which might not have been duly accounted for.
Concerns have been raised about the potential harms of loot boxes,
given their gambling-like nature. Unlike traditional gambling, which is
generally legally restricted to be available only to adults, loot boxes are
widely implemented in video games that have been given a low age
rating and thus deemed suitable for young children (e.g., aged 4 and
above by the Apple App Store).
16
A positive correlation between loot
box spending and problem gambling has been consistently replicated,
17
and recent longitudinal studies have found that young people who
purchased loot boxes were more likely to engage in traditional gambling
and also spend more money on it six months later.
18
However, incon-
sistent ndings as to whether loot box spending is linked to worse
mental health (irrespective of whether loot boxes are causing mental
distress or whether experiencing poor mental health leads subsequently
5
Jeffrey L Derevensky and Sally M Gainsbury, ‘Social Casino Gaming and
Adolescents: Should We Be Concerned and Is Regulation in Sight?’(2016) 44
International Journal of Law and Psychiatry 1; Sally M Gainsbury and others, ‘A
Taxonomy of Gambling and Casino Games via Social Media and Online Tech-
nologies’(2014) 14 International Gambling Studies 196.
6
Leon Y Xiao, Laura L Henderson and Philip WS Newall, ‘Loot Boxes Are
More Prevalent in United Kingdom Video Games than Previously Considered:
Updating Zendle et al. (2020)’(2022) 117 Addiction 2553; Leon Y Xiao, ‘Loot
Boxes’in PawełGrabarczyk and others (eds), Encyclopedia of Ludic Terms (IT
University of Copenhagen 2022) https://eolt.org/articles/loot-boxes accessed
19 July 2023.
7
cf David Zendle and others, ‘If Everything Is a Loot Box, Nothing Is:
Response to Xiao et Al.’(2022) 117 Addiction 2555.
8
David Zendle and others, ‘The Prevalence of Loot Boxes in Mobile and
Desktop Games’(2020) 115 Addiction 1768; Leon Y Xiao and others, ‘Gaming
the System: Suboptimal Compliance with Loot Box Probability Disclosure
Regulations in China’(2024) 8 Behavioural Public Policy 590; Leon Y Xiao,
‘Breaking Ban: Belgium’s Ineffective Gambling Law Regulation of Video Game
Loot Boxes’(2023) 9 Collabra: Psychology Article 57641; Leon Y Xiao, Laura L
Henderson and Philip Newall, ‘What Are the Odds? Lower Compliance with
Western Loot Box Probability Disclosure Industry Self-Regulation than Chinese
Legal Regulation’(2023) 18 PLOS ONE Article e0286681.
9
UK Gambling Commission, ‘Young People and Gambling 2022’(Gambling
Commission, 10 November 2022) https://www.gamblingcommission.gov.
uk/report/young-people-and-gambling-2022 accessed 12 July 2023.
10
UK Gambling Commission, ‘Young People and Gambling 2023’(Gambling
Commission, 16 November 2023) https://www.gamblingcommission.gov.uk/st
atistics-and-research/publication/young-people-and-gambling-2023 accessed
30 November 2023.
11
UK Gambling Commission and Ipsos MORI, ‘A Research Study among 11-16
Year Olds in England and Scotland’(2020) https://ckan.publishing.service.gov.
uk/dataset/young-people-and-gmabling-survey-2019/resource/49b79169-a
3be-417c-8241-35f33a5d63fd?inner_span=True accessed 30 November 2023.
12
Video Games Europe, ‘In-Game Spending: A Report by Ipsos for Video
Games Europe (Formerly ISFE) on Parents’Supervision of Ingame Spending’
(2023) 13 https://www.videogameseurope.eu/wp-content/uploads/2023
/09/Video-Games-Europe_In-Game-Spending-2023_Final-Sept.pdf accessed 12
October 2023.
13
Video Games Europe, ‘All About Video Games: European Key Facts 2022’
(August 2023) 8 https://www.videogameseurope.eu/publication/2022-all-
about-video-games-european-key-facts/ accessed 22 October 2023.
14
Wesley Yin-Poole, ‘The Big Interview: EA, FIFA and Loot Boxes’(Eurogamer,
8 October 2021) https://www.eurogamer.net/articles/2021-10-05-the-big-int
erview-ea-fa-and-loot-boxes accessed 30 November 2023.
15
Gabriel A Brooks and Luke Clark, ‘Associations between Loot Box Use,
Problematic Gaming and Gambling, and Gambling-Related Cognitions’(2019)
96 Addictive Behaviors 26, 28; Wen Li, Devin Mills and Lia Nower, ‘The
Relationship of Loot Box Purchases to Problem Video Gaming and Problem
Gambling’(2019) 97 Addictive Behaviors 27, 30; Leon Y Xiao and others, ‘Loot
Boxes, Gambling-Related Risk Factors, and Mental Health in Mainland China: A
Large-Scale Survey’(2024) 148 Addictive Behaviors Article 107860, 5.
16
Zendle and others (n 8); Xiao and others, ‘Gaming the System’(n 8); Xiao,
‘Breaking Ban’(n 8); Xiao, Henderson and Newall (n 8).
17
David Zendle and Paul Cairns, ‘Video Game Loot Boxes Are Linked to
Problem Gambling: Results of a Large-Scale Survey’(2018) 13 PLOS ONE
e0206767; Stuart Gordon Spicer and others, ‘Loot Boxes, Problem Gambling
and Problem Video Gaming: A Systematic Review and Meta-Synthesis’(2022)
24 New Media &Society 1001; Shaun Stephen Garea and others, ‘Meta-Analysis
of the Relationship between Problem Gambling, Excessive Gaming and Loot
Box Spending’(2021) 21 International Gambling Studies 460.
18
Gabriel A Brooks and Luke Clark, ‘The Gamblers of the Future? Migration
from Loot Boxes to Gambling in a Longitudinal Study of Young Adults’(2022)
141 Computers in Human Behavior Article 107605; J Gonz´
alez-Cabrera and
others, ‘Loot Box Purchases and Their Relationship with Internet Gaming Dis-
order and Online Gambling Disorder in Adolescents: A Prospective Study’
(2023) 143 Computers in Human Behavior Article 107685.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
2
to increased loot box purchasing) have been presented.
19
1.2. Regulating loot boxes: a consumer protection law approach?
Policymakers in many countries have considered whether to regulate
loot boxes. In nearly all countries (with the exception of Belgium
20
),
gambling law generally cannot be used to address the problem.
21
This is
because most loot boxes in most video games do not offer rewards that
are transferable between players, and so they do not possess real-world
monetary value and thus cannot satisfy the legal denition of
‘gambling.’
22
Even in relation to a small minority of loot boxes that do
offer transferable rewards and thus would constitute illegal gambling in
many countries, the relevant regulators have not actively enforced the
law, resulting in these products being largely unregulated and remaining
on the market.
23
Contract law is also unlikely to be helpful as a legal
recourse in many countries because the underlying loot box purchasing
contract is presumably legal and unchallengeable.
24
Consumer protection law has been suggested as being able to provide
some safeguarding for players.
25
For background, the relevant consumer
protection law is set out in the EU Unfair Commercial Practices Directive
2005 (UCPD). The UCPD was implemented in EU countries, and those
national versions apply as law. This included implementation into na-
tional UK law (because, at that time, the UK was and would still be a part
of the EU for more than another decade, until its eventual withdrawal
from the EU on 31 January 2020, i.e., ‘Brexit’
26
) as the Consumer Pro-
tection from Unfair Trading Regulations 2008 (CPUTR). Despite Brexit,
some previously implemented EU laws were ‘retained’or incorporated
into UK law.
27
The CPUTR therefore remained effective after Brexit as
retained EU law. The UCPD has been updated since Brexit (e.g.,
amendments and insertions made by the Omnibus Directive
28
), and
those updates were not incorporated into UK law. However, those did
not change the basic principles and rules relied upon for present pur-
poses. This meant that the relevant aspects of consumer protection law
in the EU and the UK were effectively identical even after Brexit. It
should also be noted that the UK has since adopted the Digital Markets,
Competition and Consumers Act 2024 (DMCCA), which will revoke and
replace the CPUTR at a yet unknown future date. Again, no substantive
changes were or rather will be made to the relevant legal provisions
relied upon herein. In any case, the CPUTR applied as the law when the
present study was conceptualised and when data collection was
conducted.
Consumer protection law is unlikely to resolve all concerns sur-
rounding loot boxes, but it can address certain questionable commercial
practices. For example, suggesting that certain loot box rewards can only
be obtained during a limited time period but then later offering those
same rewards for sale after the relevant period would be a prohibited
commercial practice under EU and UK consumer protection law
29
and
would also likely be illegal elsewhere. However, even though consumer
protection law may in theory forbid certain business practices, without
active enforcement by the regulator, it must not be presumed that all
companies are compliant and not using prohibited practices. Consumer
protection law may provide consumers with a personal right of redress
through which they may ask to be compensated by a company after
being harmed by illegal commercial practices (although even that is not
provided for so-called ‘misleading omissions,’which is the prohibited
practice that is relevant to the present study, in the UK
30
and started
being provided in the EU only very recently since 2022
31
). However, it is
far less clear what mechanisms are provided by consumer protection law
to allow an interested party (irrespective of whether they are a consumer
that has already been harmed, a competitor, or a general member of the
public) to complain to a regulator alleging that a certain prohibited
practice is being used by a certain company, request more active
enforcement, and be guaranteed that a reply will be provided and, if
appropriate, that enforcement actions will be taken to stop that com-
pany from using prohibited practices.
32
To benet the public, it is not
compensation for past harms that is being sought here, but rather stricter
enforcement of consumer law to prevent harm in the future.
1.3. Applying UK advertising regulations to loot boxes: the ASA and the
CAP Code
In the UK, advertising regulation (which partially enforces consumer
protection law both (i) because consumer protection law is also enforced
through other means and (ii) also because advertising regulation im-
poses certain rules that are stricter than legal requirements in some re-
spects, e.g., restricting adverts that a section of the public might nd
offensive but are not otherwise necessarily illegal
33
) is an exception to
the rule of not providing a direct complaint mechanism that guarantees
a reply: interested parties may directly complain about specic pieces of
advertising for alleged breaches of advertising rules to the regulator and
ask for enforcement actions to be taken, and the regulator will investi-
gate, which may result in rulings upholding the complaint and
19
cf Xiao and others, ‘Loot Boxes, Gambling-Related Risk Factors, and Mental
Health in Mainland China: A Large-Scale Survey’(n 15); Peter J Etchells,
Alexandra L Morgan and Daniel S Quintana, ‘Loot Box Spending Is Associated
with Problem Gambling but Not Mental Wellbeing’(2022) 9 Royal Society
Open Science Article 220111; Aaron Drummond, Lauren C Hall and James D
Sauer, ‘Surprisingly High Prevalence Rates of Severe Psychological Distress
among Consumers Who Purchase Loot Boxes in Video Games’(2022) 12 Sci-
entic Reports 16128.
20
Xiao, ‘Breaking Ban’(n 8).
21
Leon Y Xiao and Pieterjan Declerck, ‘PAID VIDEO GAME LOOT BOXES ARE
NOT GAMBLING UNDER DUTCH GAMBLING REGULATION? SHIFTING THE
GOALPOST IN ELECTRONIC ARTS V. KANSSPELAUTORITEIT’(2023) 27
Gaming Law Review 445.
22
Leon Y Xiao and others, ‘Regulating Gambling-like Video Game Loot Boxes:
A Public Health Framework Comparing Industry Self-Regulation, Existing Na-
tional Legal Approaches, and Other Potential Approaches’(2022) 9 Current
Addiction Reports 163.
23
Leon Y Xiao and Laura L Henderson, ‘Illegal Video Game Loot Boxes with
Transferable Content on Steam: A Longitudinal Study on Their Presence and
Non-Compliance with and Non-Enforcement of Gambling Law’(2024) Inter-
national Gambling Studies https://doi.org/10.1080/14459795.2024.2390827
accessed 19 September 2024.
24
Joke Baeck and Ignace Claeys, ‘Restitution of Money Spent on Loot Boxes in
Video Games?’(2021) 41 Computer Law &Security Review 105566.
25
Peter Cartwright and Richard Hyde, ‘Virtual Coercion and the Vulnerable
Consumer: “Loot Boxes”as Aggressive Commercial Practices’[2022] Legal
Studies 1; D Leahy, ‘Rocking the Boat: Loot Boxes in Online Digital Games, the
Regulatory Challenge, and the EU’s Unfair Commercial Practices Directive’
(2022) 45 Journal of Consumer Policy 561.
26
European Union (Withdrawal) Act 2018, s 20(1).
27
ibid, s 3(1).
28
Omnibus Directive [2019] OJ L328/7, art 3(5).
29
Leon Y Xiao, ‘Drafting Video Game Loot Box Regulation for Dummies: A
Chinese Lesson’(2022) 31 Information &Communications Technology Law
343, 348–349; Unfair Commercial Practices Directive (UCPD) [2005] OJ L149/
22, annex 1, para 7; The Consumer Protection from Unfair Trading Regulations
2008 (CPUTR), SI 2008/1277, sch 1, para 7; Digital Markets, Competition and
Consumers Act 2024 (DMCCA), sch 20, para 7.
30
CPUTR, regs 27A–27L; DMCCA, ss 232–235. Both reg 27B(1) and s 232(7)
omit a ‘misleading omission’from the list of ‘prohibited practices’against
which the consumer has rights of redress.
31
UCPD, arts 11 and 11A, as inserted by the Omnibus Directive [2019] OJ
L328/7, art 3(5).
32
UCPD, art 11(1); cf CPUTR, reg 19 27L, which was the UK implementation
of art 11(1) of the UCPD; DMCCA, s 231.
33
Committee of Advertising Practice (CAP), ‘UK Code of Non-Broadcast
Advertising and Direct &Promotional Marketing (CAP Code) (12th Edition)’
(2010) s 4 https://www.asa.org.uk/codes-and-rulings/advertising-codes/non-
broadcast-code.html accessed 30 September 2024.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
3
requesting the relevant advert to be withdrawn or amended.
34
For context, there is no singular piece of advertising law in the UK.
Relevant provisions are found across a multitude of legislation both
primary and secondary (more than 200, according to the relevant
regulator
35
). There is also no dedicated government regulator for
advertising in the UK (which is also true for many other countries in
Europe and beyond). Instead, an ‘independent’industry self-regulator
funded by the advertising industry through a voluntary ‘arm’s length’
levy, the Advertising Standards Authority (ASA), is responsible for
monitoring and enforcing advertising rules on a day-to-day basis. Those
rules are intended to ensure that all advertising is ‘legal, decent, honest
and truthful.’
36
Industry self-regulation therefore supplements the law
by not only incorporating existing legal requirements but also, in some
respects, raising the standard to be higher than the minimum legal
requirement. Industry self-regulation also allows disputes to be resolved
more efciently than would be possible through traditional legal means:
indeed, a direct complaint procedure that guarantees a reply from the
ASA is provided, which is not realistic to expect of all government
regulators.
37
The UK advertising rules are set out in the industry-specic UK Code
of Broadcast Advertising (BCAP Code),
38
which regulates TV and radio
advertising specically, and in the more general UK Code of Non-
broadcast Advertising and Direct &Promotional Marketing (CAP
Code),
39
which regulates all other advertising. The two do not differ
substantially (e.g., the same rule that applies to both might be found in
differently numbered corresponding sections) and are effectively iden-
tical for present purposes. References below are made only to the gen-
eral CAP Code (as that applies to social media advertising, which is the
focus of the present study), although similar provisions of the BCAP
Code would apply if the advertising was communicated through TV or
radio instead.
The advertising rules enforced by the ASA are drafted by the Com-
mittee of Advertising Practice (CAP). Section 3 of the CAP Code regu-
lates misleading advertising. Section 3.1 generally requires that
advertising ‘must not materially mislead or be likely to do so.’Section
3.3 species that advertising must not mislead by ‘omitting material
information’or by ‘hiding material information or presenting it in an
unclear, unintelligible, ambiguous or untimely manner.’Section 3.3
further denes ‘material information’as ‘information that the consumer
needs to make informed decisions in relation to a product.’These as-
pects of the CAP Code directly incorporate the requirements set out in
Article 7 of the UCPD and Regulation 6 of the CPUTR. The prohibition on
‘misleading omissions,’the denition of ‘material information,’and the
‘unclear, unintelligible, ambiguous or untimely’phrasing, inter alia, in
the CAP Code are copied from the UCPD and CPUTR. The CAP Code
therefore enforces, in the advertising context, broader consumer pro-
tection law in the UK (whose relevant provisions stem directly from EU
law). Accordingly, depending on the specic provision, breaches of the
CAP Code, which itself is not a piece of ‘law’per se, may also be con-
traventions of actual laws (e.g., consumer protection law as expressed
through the CPUTR). The ASA can refer matters (e.g., repeated and
egregious breaches of the CAP Code) to the relevant regulators (i.e.,
Trading Standards and the Competition and Markets Authority (CMA))
for them to take enforcement actions,
40
e.g., criminal prosecutions for
offences committed under the CPUTR, such as engaging in a commercial
practice that constitutes a misleading omission.
41
The CAP has recognised potential concerns from consumers and
parents about in-game purchases and loot boxes in particular. After a
consultation, the CAP published its ‘Guidance on advertising in-game
purchases’in 2021.
42
In that Guidance, it was claried that any adver-
tising for a video game must disclose whether it contains generic in-
game purchases (i.e., of any type, including loot boxes) and whether it
contains loot boxes specically.
43
This is because the presence of in-
game purchases and that of loot boxes specically are ‘material infor-
mation’(within the meaning of Section 3.3 of the CAP Code) that a
consumer needs to decide whether or not to engage with a video game
(by purchasing a copy of the software or downloading it for ‘free’).
Therefore, omitting such information on their presence will cause the
advertising to be misleading and in breach of Sections 3.1 and 3.3 of the
CAP Code. The European Commission has also published a guidance
noting that the EU UCPD (or rather national implementations thereof)
should be interpreted as specically requiring ‘the presence of paid
random content (e.g. loot boxes, card packs, prize wheels) …be clearly
disclosed to the consumer,’
44
thus conrming that this rule also applies
to the EU beyond the UK and also evidencing that the UK rule has its
basis in EU law.
Following a study identifying that many companies operating pop-
ular video games failed to duly label their games as containing loot
boxes and thus did not disclose their presence on app store product
listing pages,
45
two complaints were made to the ASA for alleged
breaches of UK advertising rules. The ASA has since upheld these two
complaints in October 2023 and declared the relevant advertising illegal
by nding that:
‘Because the ad did not make clear that the game contained loot
boxes, which we considered was material to consumers’decisions to
download the game, we concluded that the ad misleadingly omitted
material information.’
46
Those two previous complaints concerned the product listings for
video games on app stores, which is recognised as a form of advertising
for regulatory purposes. However, such product listings are actually
quite idiosyncratic as a form of marketing. This is because, generally,
those webpages have to be actively searched for by a potential consumer
for the information contained therein to be viewed. Video games are also
advertised through other means, ranging from billboards to trailers
shown on TV channels.
47
In contrast to app store listings, these other
34
ibid 113–114.
35
ibid 118.
36
ibid 13, s 1.1.
37
ibid 3.
38
Broadcast Committee of Advertising Practice (BCAP), ‘UK Code of Broad-
cast Advertising (BCAP Code) (1st Edition)’(2010) https://www.asa.org.uk/
codes-and-rulings/advertising-codes/broadcast-code.html accessed 30
September 2024.
39
CAP (n 33).
40
ibid 121–122.
41
CPUTR, reg 10.
42
CAP and BCAP, ‘Guidance on Advertising In-Game Purchases’(20
September 2021) https://www.asa.org.uk/resource/guidance-on-advertising-
in-game-purchases.html accessed 11 July 2023.
43
ibid 10–11.
44
European Commission, ‘Commission Notice –Guidance on the Interpreta-
tion and Application of Directive 2005/29/EC of the European Parliament and
of the Council Concerning Unfair Business-to-Consumer Commercial Practices
in the Internal Market (C/2021/9320) [2021] OJ C526/1’(29 December 2021)
105 https://eur-lex.europa.eu/legal-content/EN/TXT/?
uri=CELEX:52021XC1229(05) accessed 19 October 2023.
45
Leon Y Xiao, ‘Beneath the Label: Unsatisfactory Compliance with ESRB,
PEGI, and IARC Industry Self-Regulation Requiring Loot Box Presence Warning
Labels by Video Game Companies’(2023) 10 Royal Society Open Science
Article 230270.
46
Advertising Standards Authority (ASA), ‘Ruling on Hutch Games Ltd
[Concerning F1 Clash on the Apple App Store] A23-1196857’(4 October 2023)
https://www.asa.org.uk/rulings/hutch-games-ltd-a23-1196857-hutch-games
-ltd.html accessed 4 October 2023; ASA, ‘Ruling on Hutch Games Ltd [Con-
cerning Rebel Racing on the Google Play Store] A23-1196862’(4 October
2023) https://www.asa.org.uk/rulings/hutch-games-ltd-a23-1196862-hutch
-games-ltd.html accessed 4 October 2023.
47
Colin Charles Mathews and Nia Wearn, ‘How Are Modern Video Games
Marketed?’(2016) 5 The Computer Games Journal 23.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
4
forms of advertising would reach consumers who would not be actively
looking for video games to download (and may therefore be less aware
of possibly problematic issues relating to the advertised product, such as
the potential harms of loot boxes). Previous research has not considered
whether other forms of advertising for video games containing loot
boxes are compliant with advertising rules.
1.4. Social media advertising and ad transparency repositories
One prominent and relatively novel form of advertising for video
games is through social media, which is regulated in the UK under the
CAP Code. This channel is particularly relevant given widespread
adoption of social media across the world across all age groups.
48
Indeed, this form of advertising is also more easily objectively studied
(as compared to more traditional, physical forms) due to affordances
recently provided by various major platforms either voluntarily or as a
result of mandatory legal requirements. In response to increasing scru-
tiny, in 2018, social media companies, like Facebook
49
and Twitter (as X
then was),
50
began providing searchable libraries for the advertising
shown on their platforms, although this was initially limited to political
advertising only.
51
Since then, some companies have expanded the
functionalities of their ad libraries by also providing information on non-
political, commercial advertising either voluntarily or as a result of
stricter regulation,
52
such as the world’s rst obligations imposed by the
EU Digital Services Act (DSA).
53
The DSA designated a number of online platforms, including Face-
book, Instagram, TikTok, and Twitter (which has since become X but is
referred to below as whichever entity existed at the relevant time), as
‘very large.’
54
These platforms are required under Article 39 of the DSA
to maintain a searchable repository for all ads shown to EU and EEA
consumers and provide information about those ads. (For clarity, the UK
left the EU before the DSA was adopted. Therefore, the obligations
imposed therein are not part of UK law. The UK has also not adopted
similar laws requiring ad repositories at its own volition.) These re-
positories are legally obligated, at a minimum, to provide the information
listed under Article 39(2), including: a copy of the advert and the
identity of what is being advertised (Article 39(2)(a)); the identity of the
advertiser (Article 39(2)(b)) and whoever paid for the advert if different
(Article 39(2)(c)); when the advert was shown (Article 39(2)(d)); the
characteristics of the (groups of) recipients that were targeted by the
advert and/or excluded from targeting (Article 39(2)(e)); and the
number of recipients the advert eventually reached, including detailed
numbers broken down by various characteristics used for targeting
purposes (Article 39(2)(g)). If the advert has been removed for being
illegal and/or contrary to the service provider’s terms and conditions,
detailed information as to why the removal took place, including the
basis for removal must also be provided (Article 39(3) referring to
Article 17(3)). All information should be kept for at least one year after
the relevant ad was last shown (Article 39(1)).
Admittedly, there can be no independent assurance that these da-
tabases are perfectly accurate, despite relevant legal requirements.
Previous research has raised concerns about faulty design and imple-
mentation,
55
which give rise to research limitations. The functionalities
(especially when not legally required) can also be changed or removed
at any time on a discretionary basis. For example, Twitter removed
public access to its ad library in 2021 without providing any reasons just
three years after voluntarily implementing it in 2018 because it was
entirely discretional whether this service and the data were provided.
56
This service has since been relaunched by X (Twitter’s successor)
(https://ads.twitter.com/ads-repository), as required by newly adopted
laws (i.e., the DSA, as discussed above), but for EU regions only (and not
the EEA regions, even though the DSA is also supposed to apply to them,
as detailed below).
57
However, despite and duly recognising these
shortcomings, the information provided by these ad libraries can be
taken at face value to address certain research questions, including the
present ones.
The ad libraries of different platforms provide varying levels of
functionality. The summary below is factually correct as of the data
collection period for the present study (i.e., October 2023), but may
become inaccurate as various features (particularly those that are not
legally required to be provided) are added or removed at the whims of
these private commercial entities. For example, the ad library for X is
provided only to minimally comply with EU law (specically, Article 39
of the DSA), so it provides only information about ads that target con-
sumers in EU countries and nothing more (not even the EEA countries to
which the DSA is supposed to apply, given the law’s ‘Text with EEA
relevance’designation).
58
This means that the X ads repository is not
useable for any research intending to study ads specically targeting
non-EU territories, including the UK (which, due to Brexit, is an ex-EU
country to whose consumers the DSA transparency obligations that
were adopted after Brexit do not apply).
In contrast, the Meta (which encompasses advertising on Facebook,
Instagram, and Messenger) and the TikTok ad libraries go above and
beyond their minimum legal obligations to be transparent about EU-
targeting ads, which is required under the DSA because they have
been designated as ‘Very Large Online Platforms (VLOPs).’
59
Meta and
TikTok additionally allow for ads that target non-EU territories to be
scrutinised, even though the two companies are not (or at least have not
yet been) required by law to provide some of this information. The Meta
library appears to allow ads targeting every country/territory in the
world to be searched, whilst the TikTok library allows for those targeting
the three EEA countries that are not part of the EU (i.e., Iceland,
Liechtenstein, and Norway, which are supposed to be covered by the
DSA), Switzerland, and the UK to be scrutinised, but not those targeting
elsewhere.
The various ad repositories also differ as to the degree of information
that is then provided about the total impressions that a certain ad has
48
Johannes Knoll, ‘Advertising in Social Media: A Review of Empirical Evi-
dence’(2016) 35 International Journal of Advertising 266.
49
Richard Allan and Rob Leathern, ‘Increasing Transparency for Ads Related
to Politics in the UK’(Facebook, 16 October 2018) https://about.fb.com/n
ews/2018/10/increasing-transparency-uk/ accessed 12 October 2023.
50
Bruce Falck, ‘Providing More Transparency around Advertising on Twitter’
(28 June 2018) https://blog.twitter.com/en_us/topics/company/2018/Prov
iding-More-Transparency-Around-Advertising-on-Twitter accessed 12 October
2023.
51
Paddy Leerssen and others, ‘Platform Ad Archives: Promises and Pitfalls’
(2019) 8 Internet Policy Review https://policyreview.info/articles/analysis/pla
tform-ad-archives-promises-and-pitfalls accessed 11 October 2023.
52
Nick Clegg, ‘New Features and Additional Transparency Measures as the
Digital Services Act Comes Into Effect’(Meta, 22 August 2023) https://about.fb.
com/news/2023/08/new-features-and-additional-transparency-measures-a
s-the-digital-services-act-comes-into-effect/ accessed 12 October 2023.
53
Digital Services Act (DSA) [2022] OJ L277/1.
54
European Commission, ‘Digital Services Act: Commission Designates First
Set of Very Large Online Platforms and Search Engines’(25 April 2023) https
://ec.europa.eu/commission/presscorner/detail/en/IP_23_2413 accessed 20
September 2024.
55
Paddy Leerssen and others, ‘News from the Ad Archive: How Journalists
Use the Facebook Ad Library to Hold Online Advertising Accountable’(2023)
26 Information, Communication &Society 1381, 1382.
56
Bruce Falck, ‘Providing More Transparency around Advertising on Twitter
[as Updated on 25 January 2021]’(25 January 2021) https://blog.twitter.co
m/en_us/topics/company/2018/Providing-More-Transparency-Around-Adve
rtising-on-Twitter accessed 12 October 2023.
57
X Corp., ‘Ads Transparency’(2023) https://business.twitter.com/en/help/
ads-policies/product-policies/ads-transparency.html accessed 11 October 2023.
58
ibid.
59
European Commission (n 61).
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
5
received. The Meta platform provides this information only in relation to
the EU (e.g., how many users of a certain age group from Ireland, an EU
country, have seen the ad), which represents the minimum extent of
disclosure required by EU law (i.e., Article 39 of the DSA). In contrast,
the TikTok platform provides additional information beyond its legal
obligations (e.g., how many impressions the ad received in the UK,
which is not required to be disclosed by any law and therefore is being
disclosed entirely voluntarily). The TikTok ad library additionally al-
lows for search results to be sorted based on their number of impressions
(dened as the number of unique users that have seen the ad), which the
Meta platform does not permit. This means that the most widely viewed
ads on TikTok can be easily identied, but this cannot be done using the
Meta ad library. Further, due to wider coverage of different territories
provided voluntarily, TikTok can be used to study a few non-EU coun-
tries of interest (e.g., the UK) in greater detail. Needless to say, the more
functionalities and information an ad library provides, the more
research questions can be answered using it.
1.5. Present study and research questions
In summary, UK advertising regulation incorporates and enforces
aspects of UK consumer protection law (that companies must not
mislead consumers by omitting material information), which imple-
mented EU consumer protection law prior to Brexit. Therefore, aspects
of UK advertising regulation (that video game advertising must disclose
the presence of generic in-game purchases and of loot boxes specically)
originate from and are identical to EU consumer protection law. The
UK’s withdrawal from the EU has not affected this thus far. Further, EU
law (the DSA) that was adopted after Brexit imposed obligations on
social media platforms to provide a repository of all adverts shown and
to share data. This law is not part of UK law, and the UK has not adopted
similar laws, so these obligations are not imposed in the UK. However,
seemingly as part of complying with that EU law, some social media
platforms have entirely voluntarily provided certain advertising data
related to the UK when not obliged to do so. This creates an ironic sit-
uation whereby, despite Brexit, compliance with UK advertising rules
(which are, in essence, EU consumer protection law) can be assessed
using affordance likely provided by non-applicable EU law adopted post-
Brexit.
Acknowledging the limitations of, and the divergent functionalities
provided by, ad libraries for social media platforms, the present study
sought to pragmatically conduct research on the ad libraries of two
different leading platforms by taking advantage of the respective fea-
tures that they each provide. The Meta library allows for ads to be easily
searched for based on the identity of the advertiser account (which for
video games is usually, conveniently, the dedicated account for that
game title). Therefore, this ad library was used to identify what per-
centage of advertising on Meta-owned social media platforms (i.e.,
Facebook, Instagram, and Messenger) for popular games known to
contain loot boxes failed to disclose the presence of in-game purchases
and of loot boxes specically. The search function for the TikTok library
on the other hand was less useful, as ads were generally attributed to
advertisers whose identity is only shown as a company name (which
may or may not be a company that is obviously related to the video
game, e.g., the publisher of the video game), rather than the game title,
which made them less identiable. However, as detailed above, it is
possible to sort all the ads in the TikTok library based on how many
unique users have seen each ad and thusly obtain a list of the ads that
received the greatest number of impressions on TikTok. This allowed for
the most ‘popular,’or most viewed, ads relating to video games that
implement loot boxes to be identied. These ads were then evaluated to
check whether they were compliant with advertising regulations by
having disclosed the presence of in-game purchases and of loot boxes
specically. The total number of impressions received by the non-
compliant ads could also be calculated based on the data provided by
the TikTok ad library.
The following four research questions were addressed:
Research Question 1: What percentage of popular games known to
contain loot boxes advertised on Meta-owned social media platforms
without disclosing loot box presence?
Research Question 2: What percentage of the ads that received the
greatest number of impressions on TikTok pertained to video games
known to contain loot boxes?
Research Question 3: What percentage of the TikTok ads identied
through Research Question 2 disclosed the presence of loot boxes?
Research Question 4: How many total impressions did the non-
compliant TikTok ads identied through Research Question 3
receive?
The present study’s research questions and design, despite the
methodology being mixed method with a qualitative focus, were pre-
registered in the Open Science Framework at: https://doi.org/10.1760
5/OSF.IO/ECRA4.
2. Method
Content analysis was conducted on the ads libraries provided by
Meta (https://www.facebook.com/ads/library) and TikTok (htt
ps://library.tiktok.com/ads/). The relevant country settings for the ad
libraries were put to the UK because of the present focus on identifying
non-compliance with UK advertising regulations (even though the same
adverts might also be illegal elsewhere, e.g., under EU consumer law).
On Meta, this meant setting the ‘Select country’option to the UK only.
On TikTok, this meant setting the ‘Ad target country’to the UK only.
For Research Question 1, a list of 187 games previously known to
contain loot boxes (as collated for the purposes of a previous study and
since added to using the results from that same study
60
) was used. This
entire list was preregistered. The titles of these 187 games (with some
exibility as to whether or not to include, e.g., subtitles) were entered
into the search tool for the Meta ads library. The coder determined
whether any of the search results were an ad for the game title searched
for. When a dedicated advertiser account for the game was identied,
then that account’s page was used to identify the most recent adverts
relating to said game. The coder then looked for any disclosure of the
presence of in-game purchases and of loot boxes specically in any form
(irrespective of visual prominence, e.g., font size of the disclosure text).
All loot box presence disclosures were deemed as having also satised
the requirement to disclose in-game purchases in general, i.e., act also as
a generic in-game purchase presence disclosure. It was preregistered
that if multiple ads were run for a game, then up to three of the most
recent ads for the same game would be examined. It was also preregis-
tered that only search results for ads that were run after 20 September
2021 would be examined because that was the date on which the
‘Guidance on advertising in-game purchases’was published.
61
In theory,
companies were obliged to comply with the requirements even prior to
that date as the Guidance only claried what obligations were already
owed under pre-existing law. However, this was deemed a justiable
date for an articial cut-off to be set. In fact, all ads examined were run
after said date.
For Research Questions 2, 3 and 4, the list of all TikTok ads displayed
by the ad library was sorted using the function ‘Unique users seen: High
to low.’The coder determined whether each ad related to a video game
that implements loot boxes. The coder rst determined which video
game the ad pertained to (and the ad was excluded when such a
determination could not be condently made). Then, the coder
60
Leon Y Xiao, ‘Shopping Around for Loot Box Presence Warning Labels:
Unsatisfactory Compliance on Epic, Nintendo, Sony, and Microsoft Platforms’
(2023) 1 ACM Games: Research and Practice Article 25.
61
CAP and BCAP (n 42).
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
6
determined whether that game contains loot boxes either by checking
whether it is on the aforementioned list of 187 popular games previously
known to contain loot boxes or through actual gameplay or external
research (e.g., checking whether the game was attached with the generic
‘In-Game Purchases’presence label or the dedicated ‘In-Game Purchases
(Includes Random Items)’loot box presence warning label on the Google
Play Store or in the PEGI database
62
). Any evidence of loot box presence
is publicly available at the data deposit link. The TikTok search tool
provides data starting from 1 October 2022, which is a date by which all
video game companies should have complied with UK advertising reg-
ulations (as it is over a year after the CAP Guidance was published), so it
was preregistered that the entire database would be used. As preregis-
tered, sampling stopped after the rst 100 adverts pertaining to games
offering loot boxes that received the greatest number of impressions
globally were identied. Importantly, different ads for the same game
title were separately counted as the material could have varied (and, in
some cases, did in fact vary) greatly. For Research Question 3, all 100
ads were examined by the coder to nd any disclosure of the presence of
in-game purchases and of loot boxes specically in any form (again,
irrespective of visual prominence, and loot box disclosures were deemed
as also satisfying the requirement to disclose generic in-game pur-
chases). For Research Question 4, the number of unique users from the
UK that have seen a certain ad was obtained from the relevant TikTok ad
summary webpage, a copy of which has been archived for each advert at
the data deposit link.
Following the preregistration, all underlying data are shared for
wider public scrutiny of the results via the data deposit link: https://doi.
org/10.17605/OSF.IO/6ZSUA. Screenshots were taken of texts and non-
moving graphical materials, and all videos were archived, such that all
adverts can be reviewed at a later date by any interested party.
In accordance with the Danish Code of Conduct for Research Integrity,
as adopted by the IT University of Copenhagen, the present study did not
require research ethics assessment and approval because no human
participants or personal data were expected to have been involved and
only publicly available information was examined and recorded.
3. Results
3.1. Study 1: Meta
Ads for the 187 preregistered game titles were searched for using the
Meta ad library. During this process, it was discovered that one of the
games on the list, Brawl Stars (2017, Supercell), no longer offered loot
boxes for sale in exchange for real-world money at the data collection
date.
63
(However, subsequently, loot boxes were reintroduced back into
the game, which is irrelevant to the present study but noted for the re-
cord.
64
) This game was therefore excluded from the sample for being
irrelevant: a game not containing loot boxes is obviously not required to
disclose loot box presence. No relevant advertising activity could be
found for 126 titles, meaning that advertising was found for 60 games on
the original list. Three games were added into the sample. Two games,
NBA 2K24 (2023, 2K Games) and WWE 2K23 (2023, 2K Games), were
added because they represented more recent versions of older titles on
the original list that were found to have not advertised simply because
they were outdated and have since been replaced (e.g., NBA 2K23 (2022,
2K Games) and WWE 2K22 (2022, 2K Games)). The two newer titles,
which were advertised, were deemed to be suitable replacements for the
older titles. Another game, The Elder Scrolls Online (2014, Bethesda), was
added because two entries on the original list (The Elder Scrolls Online
Collection: Blackwood (2021, Bethesda) and The Elder Scrolls Online
Collection: High Isle (2022, Bethesda)) are expansion packs providing
more content for the base game that was added into the sample. The
actual game (which was advertised) was deemed to be a suitable
replacement for its expansion packs (which were not advertised) for the
present research. In summary, 63 games offering loot boxes were found
to have advertised on Meta-owned platforms and were included in the
sample (or 33.7 % of 187 relevant games checked; Brawl Stars and the
two Elder Scrolls expansion packs were excluded for this calculation, but
the three added games detailed above were included).
Amongst these 63 games, for two games, only one relevant advert
could be found. For the other 61 games, the three most recent adverts
were assessed for each game as preregistered. Therefore, in total, 185
separate adverts were studied. Notably, some of these adverts were
identical as some games advertised using the same material multiple
times, but these were shown as separate advert entries with a unique
numbering in the database and were therefore treated as such.
As to compliance, amongst the 185 adverts detailed in Table 1, only
20 adverts (10.8 %) disclosed the presence of in-game purchases and
merely 13 of those 20 adverts (7.0 %) also disclosed the presence of loot
boxes. (A loot box presence disclosure was deemed as having also dis-
closed the presence of generic in-game purchases.) At a game level,
amongst 63 games, only 10 games (15.9 %) made in-game purchase
disclosures in at least one advert studied, and only six of those 10 games
(9.5 %) also made loot box disclosures in at least one advert studied.
Only four games (6.3 %) were found to have complied with the
requirement to disclose the presence of in-game purchases in all of those
games’adverts studied (i.e., the most recent three ads shown), and only
three of those four games (4.8 %) were found to have also complied with
the requirement to disclose loot box presence in all adverts studied.
3.2. Study 2: TikTok
As preregistered, the list of the ads that received the greatest number
of unique impressions were scraped. Data collection stopped after 1074
total entries were reviewed because exactly 100 ads conrmed as
relating to games containing loot boxes had been examined. Notably,
154 out of 1074 ads could not be studied because they were removed
due to violation of TikTok’s terms of service and could no longer be
viewed in the repository (14.3 %). For these ads, all information about
the identity of the advertiser and other interested parties has also been
removed. Given that these ads could not be studied, they were excluded
from the sample.
Amongst the remaining 920 entries that were viewable, 151 ads
related to video games (16.5 %), including one ad each for the Amazon
Prime Gaming subscription service and the Sony PlayStation VR2 virtual
reality headset. As with Study 1, notably, some of these adverts were
identical or nearly so as some games advertised using the same material
multiple times, but these were shown as separate advert entries with a
unique numbering in the database and were therefore treated as such. It
was not possible to determine what specic video game six ads were
linked to because the TikTok ad repository did not provide any infor-
mation on the URL (Uniform Resource Locator) that a specic advert
would have redirected the viewer to. This crucial (and arguably the most
important) information about the ad has been omitted by TikTok, which
appears to be an obvious breach of the platform’s obligations under
Article 39(2)(a) of the DSA to disclose the identity of the ‘product, ser-
vice or brand’advertised. This was in contrast to the Meta database,
which always provided this information (i.e., the relevant URL). Addi-
tionally, 13 ads were for two games that did not contain offer any in-
game purchases according to PEGI (Pan-European Game Information),
which is the European video game age rating organisation: 10 ads for
Star Wars Jedi: Survivor (Electronic Arts, 2023) and 3 ads for Dead Space
62
Xiao, ‘Beneath the Label’(n 51).
63
Marie Dealessandri, ‘Supercell Removes Loot Boxes from Brawl Stars’
(GamesIndustry.biz, 12 December 2022) https://www.gamesindustry.
biz/supercell-removes-loot-boxes-from-brawl-stars accessed 15 January 2023.
64
Leon Y Xiao, ‘.@BrawlStars Reintroduced #LootBoxes, Seriously. You
Directly Purchase Something Else and Are given Loot Boxes for “FREE.”’ (X, 20
January 2024) https://twitter.com/LeonXiaoY/status/1748665362881667574
accessed 29 April 2024.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
7
(Electronic Arts, 2023), respectively. The aforementioned 21 ads were
excluded from the sample because they were either irrelevant or could
not be reliably studied. Accordingly, 130 out of the 920 most viewed ads
(that have not been removed for content violation) marketed video
games with in-game purchases (14.1 %), and 100 promoted games with
loot boxes (10.9 %).
As to compliance amongst the 130 ads relating to games that con-
tained in-game purchases listed in Table 2, only 9 ads disclosed generic
in-game purchase presence (6.9 %). Amongst the 100 ads relating to
games that contained loot boxes, only 7 ads disclosed loot box presence
specically (7.0 %). At a game level, amongst 40 individual titles con-
taining in-game purchases whose ads were studied, only 4 games dis-
closed generic in-game purchase presence (10.0 %), and amongst 19
titles with loot boxes, only 3 games disclosed loot box presence specif-
ically (15.8 %).
Interestingly, every compliant ad related to video games published
by Electronic Arts. Amongst the 93 non-compliant ads that failed to
disclose loot box presence, the advertiser’s registered location according
to TikTok was China for 46 ads (49.5 %); Israel for 13 ads (14.0 %); the
US for 12 ads (12.9 %); Singapore for eight ads (8.6 %); Finland for
Table 1
Meta adverts studied listed by game title (N=185).
Game # of
ads
Disclosed in-game
purchases
Disclosed loot
boxes
Bingo Blitz 3 1 0
Dragon City 3 2 0
Golf Clash 3 1 1
Hunt: Showdown 3 1 1
Lost Ark 3 3 0
Monster Legends 3 3 3
NBA 2K24 3 2 2
Star Wars: Galaxy of
Heroes
3 3 3
The Elder Scrolls Online 3 3 3
WWE SuperCard 3 1 0
8 Ball Pool 3 0 0
Age of Origins 3 0 0
Angry Birds 2 3 0 0
Archero 3 0 0
Arknights 3 0 0
Azur Lane 3 0 0
Backgammon - Lord of the
Board
3 0 0
Bingo Frenzy 3 0 0
Black Desert 3 0 0
Black Desert Mobile 3 0 0
Blackjackist 3 0 0
CSR Racing 2 3 0 0
Castle Clash: Guild Royale 3 0 0
Disney Magic Kingdoms 1 0 0
Disney Speedstorm 3 0 0
Evony - The King’s Return 3 0 0
F1 Clash 3 0 0
Final Fantasy Brave Exvius 3 0 0
Frost &Flame: King of Avalon 3 0 0
Genshin Impact 3 0 0
Guns of Glory 3 0 0
Hustle Castle 3 0 0
Huuuge Casino 3 0 0
Idle Heroes 3 0 0
Jackpot World Casino 3 0 0
June’s Journey 3 0 0
Kiss Of War 3 0 0
Last Day on Earth 3 0 0
Last Fortress 3 0 0
Lords Mobile 3 0 0
Magic: The Gathering Arena 3 0 0
Marvel Strike Force 3 0 0
Match Masters 3 0 0
Merge Mansion 3 0 0
Mighty Party 3 0 0
PUBG MOBILE 3 0 0
Pirates of the Caribbean:
Tides of War
3 0 0
Rise of Empires: SLG Game 3 0 0
Rise of Kingdoms 3 0 0
RuneScape 3 0 0
Rush Royale 3 0 0
Score Hero 3 0 0
Slotomania - Slot Machines 3 0 0
Star Trek Fleet Command 3 0 0
Tennis Clash 3 0 0
Texas HoldEm Poker 3 0 0
The Seven Deadly Sins: Grand
Cross
3 0 0
WWE 2K23 3 0 0
War Machines 1 0 0
War Robots 3 0 0
World Series of Poker Game -
WSOP
3 0 0
World of Tanks Blitz 3 0 0
World of Warships Legends 3 0 0
Total 185 20 (10.8 %) 13 (7.0 %)
Note. Game titles with ads that were compliant in some manner are bolded and
listed before other entries. The three fully compliant games’titles are
underlined.
Table 2
TikTok adverts studied listed by game title (N=130).
Game # of
ads
Disclosed in-game
purchases
Disclosed loot
boxes
Apex Legends 3 3 3
EA Sports FC 24 3 3 3
FIFA 23 1 1 1
Coin Master 8 0 0
Eatventure 2 0 0
Family Island 1 0 0
Genshin Impact 5 0 0
Honkai: Star Rail 5 0 0
Last Empire War Z 2 0 0
Merge Mansion 7 0 0
Monopoly GO 8 0 0
Roblox 1 0 0
Stormshot: Isle of Adventure 3 0 0
Stumble Guys 3 0 0
Survivor.io 2 0 0
The Sims FreePlay 1 0 0
Top War 40 0 0
Travel Town 4 0 0
War and Order 1 0 0
Total for games with loot boxes 100 7 (7.0 %) 7 (7.0 %)
F1 23 2 2
BitLife - Life Simulator 1 0
Bridge Race 5 0
Call of Duty: Modern Warfare 1 0
Candy Crush Saga 1 0
Diablo IV 1 0
GTA Online: San Andreas
Mercenaries
1 0
Going Balls 2 0
Hogwarts Mystery: Harry Potter 2 0
Impulse - Brain Training Games 1 0
Just Dance 2023 Edition 1 0
Merge Miners / Merge and Dig 2 0
My Mini Mart 2 0
Overwatch 2 1 0
Spider-Man 2 1 0
Stealth Master: Assassin Ninja 1 0
Tall Man Run 1 0
Tile Busters 1 0
Triple Cat Sort - Goods Master /
Goods Triple - Sort &Match 3D
1 0
Woodoku 1 0
World of Warcraft: Dragonight 1 0
Total for games without loot
boxes
30 2 (6.7 %)
Total 130 9 (6.9 %)
Note. Game titles with ads that were compliant are bolded and listed before other
entries.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
8
seven ads (7.5 %); Hong Kong for four ads (4.3 %); Germany for two ads
(2.2 %); and the UK for one ad (1.1 %). Notably, all eight ads that
supposedly had an advertiser based in Singapore (listed as ‘COGNO-
SPHERE PTE. LTD.’) and two of four ads whose advertiser was sup-
posedly based in Hong Kong (listed as ‘MIHOYO LIMITED’) were
actually for games operated by the Mainland Chinese company miHoYo,
who would ultimately benet and likely produced or at least had control
over the advertising content.
65
The listed ‘advertiser’was but a fully
owned subsidiary based in a different jurisdiction. This indicates that the
supposed geographic origin of an ad provided by TikTok requires further
scrutiny. There may have been other examples of complex corporate
structures that the author is unaware of.
For each ad, TikTok provides the value for ‘Unique users seen,’which
is dened as ‘An estimate of the number of unique users who have seen
the ad at least once.’It is not known for how long a user needs to have
watched the ad for them to be counted, and it cannot be known whether
the user was paying attention to the ad or whether they consequently
purchased or downloaded the advertised game. An individual estimate
was provided for each country that the ad targeted. A total estimate for
all countries was provided using a broad range. Given that the present
study’s focus is on the UK situation, only the estimated ‘Unique users
seen’values relating to the UK were recorded and summed as required.
Many of these ads also targeted EU and EEA countries in which the same
ads should similarly be found to be non-compliant with consumer pro-
tection law (specically, the requirement for companies not to
misleadingly ‘omit material information that the average consumer
needs to take an informed transactional decision’under Article 7 of the
UCPD and national implementations thereof) and advertising regula-
tions incorporating and applying the UCPD,
66
as the European Com-
mission has previously stated.
67
The total number of ‘actual impressions’
(i.e., counting each unique user seeing the same ad multiple times as
multiple separate impressions) may be many times the ‘unique impres-
sions’that have been reported, but the former has not been disclosed by
TikTok. Interestingly, because some ads for the same game were iden-
tical or largely identical to other entries in the sample, these would have
been counted multiple times when calculating the total ‘unique im-
pressions’received in the UK. Because of the company’s chosen mar-
keting strategy of pushing the same ad multiple times as different entries
to potentially the same users, presumably, many of the same unique
users would have seen the same ad (ostensibly appearing as different
entries) multiple times. The most extreme example is Top War (Riv-
ergame, 2019), which advertised as 40 separate entries using similarly
misleading advertising that did not accurately reect actual gameplay
(as detailed below under Section 3.3.1). Some of these 40 ads were
identical to each other but not all. This means that for some games, their
supposed ‘unique impressions’value would not be accurate and would
instead be closer to their actual impressions because of repeated,
duplicate counting. In contrast, the ‘unique impressions’received by a
game that was advertised only once would be an accurate reection.
These are practical limitations to the interpretation of the data provided
by the TikTok repository that ought to be acknowledged. This means
that the impressions reported by the present study should be understood
as the minimum number of times these adverts have been viewed,
including potentially by the same users multiple times in cases where the
same advert was published as multiple entries. It does not accurately
reect true ‘unique impressions,’and the value for ‘actual impressions’
may well be many times higher.
The number of impressions received by ads relating to games with in-
game purchases and loot boxes (depending on whether they were
compliant or non-compliant with disclosure requirements) are pre-
sented in Table 3. In summary, in relation to all 130 ads for games with
in-game purchases, only 10.8 % of impressions were of ads that made
the requisite disclosures, whilst 89.2 % were of ads that contravened
regulations. Similarly, in relation to the 100 ads for games with loot
boxes, only 10.2 % of impressions were of compliant ads, whilst 89.8 %
were of non-compliant ads.
3.3. Otherwise socially irresponsible advertising
Finally, during data collection, it became obvious that some adverts
engaged in otherwise questionable practices that would likely be
deemed socially irresponsible and may contravene consumer protection
law, advertising regulations, or PEGI’s advertising rules.
3.3.1. Misleading advertising that did not represent actual gameplay
Besides omitting material information, other types of misleading
advertising would also contravene Section 3.1 of the CAP Code, which
generally prohibits misleading advertising. Specically, exaggeration
(except ones that are so obvious as to be unlikely to be taken literally by
consumers, or so-called ‘puffery’
68
) is prohibited. Section 3.11 states
that advertising ‘must not mislead consumers by exaggerating the
capability or performance of a product.’Applied to the video game
context, this means that the gameplay footage shown in the advert must
be broadly representative of actual gameplay. The advert should not
show gameplay
69
or imagery
70
that cannot be found within the game, as
doing so is exaggerating what the video game is capable of as a product.
The present study encountered many misleading adverts that pur-
ported to show supposed gameplay that was not representative of the
majority of actual gameplay. As shown in Fig. 1, one TikTok advert (ID#
1753834718906369: https://library.tiktok.com/ads/detail/?ad_id
=1753834718906369) for Top War even ironically self-referentially
highlighted how the ad was allegedly ‘exposing fake games’and pur-
ported to demonstrate how the gameplay that could be found within the
game was supposedly ‘actually like the ads’and ‘NOT fake.’To the
author’s understanding, the gameplay shown does actually exist as a
‘mini-game’in a minor part of the overarching game;
71
however, it is not
Table 3
Impressions received by TikTok adverts in the UK (N=130).
Category # of ads UK impressions
Ads disclosing loot box presence 7 33,100,000
Ads failing to disclose loot box presence 93 292,641,000
Total: ads for games with loot boxes 100 325,741,000
Ads disclosing in-game purchase presence 9 45,400,000
Ads failing to disclose in-game purchase presence 121 374,414,000
Total: ads for games with in-game purchases 130 419,814,000
65
Brian Ashcraft, ‘Genshin Impact’s miHoYo Rebrands For Global Audiences’
(Kotaku, 14 February 2022) https://kotaku.com/genshin-impact-mihoyo-hoyov
erse-brand-honkai-impact-3rd-1848532266 accessed 16 January 2023; HoYo-
verse, ‘Presenting the New Brand HoYoverse: Aiming to Provide Global Players
With an Immersive Virtual World Experience’(13 February 2022) http
s://www.hoyoverse.com/en-us/news/101566 accessed 16 January 2023;
Tallis Spalding, ‘Are MiHoYo And HoYoverse The Same?’(TheGamer, 20 July
2024) https://www.thegamer.com/are-mihoyo-hoyoverse-same-differences
-explained/ accessed 28 September 2024.
66
e.g., Nederlandse Reclame Code [Dutch Advertising Code], art 8.3(c).
67
European Commission (n 49) 105.
68
CAP Code, s 3.2.
69
ASA, ‘Ruling on Rivergame Ltd t/a Top War G22-1166092’(16 November
2022) https://www.asa.org.uk/rulings/rivergame-ltd-g22-1166092-rivergame
-ltd.html accessed 12 October 2023.
70
ASA, ‘Ruling on Funplus Interactive A17-398352’(20 December 2017) htt
ps://www.asa.org.uk/rulings/funplus-interactive-a17-398352.html accessed
30 September 2024; ASA, ‘Ruling on Funplus Interactive A18-463147’(6
February 2019) https://www.asa.org.uk/rulings/funplus-interactive-a18-1.ht
ml accessed 12 October 2023.
71
Leon Y Xiao, ‘What’s a Mini-Game? The Anatomy of Fishing Mini-Games’
(2023) https://doi.org/10.31219/osf.io/4g9ku accessed 21 October 2023.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
9
representative of the actual gameplay of the vast majority of Top War. A
previous ASA ruling found that adverts which showed only gameplay
that was technically available inside the game but formed only a small
part of that game and was not representative of the game overall was
still misleading.
72
In 2022, the ASA actually specically ruled on two complaints con-
cerning two TikTok adverts for Top War.
73
For having included ‘in-game
footage in the ads [that] was not representative of the product,’the ads
were determined to have ‘exaggerated the performance of the game and
were misleading,’and thus in breach of advertising rules (i.e., Sections
3.1 and 3.11 of the CAP Code). The advertiser was reminded not to
publish misleading adverts. However, the aforementioned TikTok
advert shown in Fig. 1 was last shown on 2 February 2023, according to
information provided by the ad library. This indicates that the previous
enforcement action taken by the ASA has not effectively deterred the
relevant video game company based in Beijing, China from continuing
to breach UK advertising regulations and act illegally. A referral to the
UK consumer protection regulators for criminal prosecution might be
apt as industry self-regulation has failed to encourage compliance in this
instance.
3.3.2. Offensive advertising that mistreated women and sexualised children
under 18
Besides misleading advertising, the CAP Code also prohibits adver-
tising that ‘contain anything that is likely to cause serious or widespread
offence’(Section 4.1 of the CAP Code). Specically, Section 4.8 pro-
hibits the sexualisation of children under 18, and Section 4.9 prohibits
the depiction of offensive gender stereotypes. The ASA has previously
enforced against video game adverts on Twitter because they were likely
to cause offence as they stereotyped, objectied, and demeaned
women
74
or portrayed characters who seemed to be under 18 years of
age in a sexual way.
75
Similarly offensive ads appeared in the present sample. As shown in
Fig. 2, one Meta advert (ID# 1040307840454210: https://www.fac
ebook.com/ads/library/?id=1040307840454210) for Azur Lane
(Shanghai Manjuu &Xiamen Yongshi, 2017) purported to show that the
gameplay involved the player being able to manually ‘Customize Your
Girl’by increasing or decreasing the character’s ‘Looks,’‘Tempera-
ment,’and ‘Intelligence’on a 5-star rating scale. Such stereotypical
depiction of women (or girls who are seemingly under 18) as sexual
objects would contravene Sections 4.1, 4.8, and 4.9 of the CAP Code. To
the author’s knowledge developed through gameplay for previous
research purposes, such a mechanic also either does not exist in the
game or is not representative of actual gameplay (and so the ad was
likely also misleading due to exaggeration and thus in breach of Sections
3.1 and 3.11 of the CAP Code). Even more egregious examples of
sexualisation and objectication, such as the Meta adverts for Kiss of
War (tap4fun, 2019) that showed female characters in compromising
positions, were also observed but are not discussed further as the point
has been made, and any further discussion would be gratuitous.
3.3.2. Encouraging minors to participate in simulated gambling and
glorifying gambling
Section 16 of the CAP Code is dedicated to regulating gambling
advertising with additional industry-specic rules. Those rules do not
apply to the advertising of simulated gambling or social casino games
that allow players to spend real-world money to participate in
Fig. 1. Screenshots of relevant moments during TikTok advert ID# 1753834718906369 for Top War showing how it is not representative of actual gameplay and
therefore misleading, but it ironically self-referenced this issue and then purported to claim that the gameplay is not ‘fake.’ © 2023 Rivergame.
72
ASA, ‘Ruling on PLR Worldwide Sales Ltd t/a Playrix G20-1061644’(30
September 2020) https://www.asa.org.uk/rulings/plr-worldwide-sales-ltd
-g20-1061644-plr-worldwide-sales-ltd.html accessed 30 September 2024.
73
ASA, ‘Ruling on Rivergame Ltd t/a Top War G22-1166092’(n 69).
74
ASA, ‘Ruling on GOAT Company Ltd A22-1162562’(28 September 2022)
https://www.asa.org.uk/rulings/goat-company-ltd-a22-1162562-goat-co
mpany-ltd.html accessed 30 September 2024.
75
ASA, ‘Ruling on Oasis Games Ltd A22-1161063’(28 September 2022) https
://www.asa.org.uk/rulings/oasis-games-ltd-a22-1161063-oasis-games-ltd.html
accessed 30 September 2024.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
10
traditional gambling activities but, importantly, do not allow them to
convert any winning back into real-world money.
76
This is because those
video games are not regulated as traditional ‘gambling’under the
Gambling Act 2005 because the legal, denitional criteria are not
satised by those games.
77
Specically, the winnable ‘prize’of virtual
currencies that cannot be converted into real-world money is neither
money nor money’s worth.
78
Importantly, people have lost signicant
sums of money on social casino games. One Australian woman experi-
enced gambling problems
79
and defrauded her employer of AU$940,000
to play on such a game.
80
Current regulations are not adequate. The
public is rightfully concerned, especially about children under 18
engaging with these games.
81
However, in the present sample, many adverts for simulated or social
gambling games that have a Google Play Store age rating of PEGI 18 or
an Apple App Store age rating of 17+(meaning that they are not suitable
for young people) did not clearly indicate the age restrictions imposed
on them. As shown in Fig. 3, one Meta advert (ID# 710027057632847:
https://www.facebook.com/ads/library/?id=710027057632847) for
Blackjackist (KamaGames, 2015), in which players can spend real-world
money to simulate playing Blackjack but cannot convert any winnings
back into real-world money, even glamorised gambling by implying that
gambling is linked to nancial and sexual success, both of which are
prohibited for traditional gambling advertising under Sections 16.3.4
and 16.3.8 of the CAP Code, respectively. Social casino game adverts are
held to a lower standard and not bound by social responsibility rules that
apply to traditional gambling adverts, despite the known potential
harms of social casino games. To be clear, these ads were not in breach of
current UK advertising rules but were socially irresponsible. Future
updates to the CAP Code should consider imposing additional rules on
social casino games to, inter alia, better protect children from gambling-
related harms.
3.3.4. Failing to display PEGI age rating information
Finally, games like Disney Speedstorm (Gameloft, 2022), Genshin
Impact (miHoYo, 2020), Just Dance 2023 (Ubisoft, 2022), Magic: The
Gathering Arena (Wizards of the Coast, 2019) (whose entry is missing the
PEGI loot box presence warning label despite containing loot boxes),
and RuneScape (Jagex, 2001) were manually rated by PEGI and thus
possessed both age ratings and content descriptors, including, impor-
tantly, that of ‘In-game Purchases’or even ‘In-game Purchases (Includes
Random Items)’(for loot boxes) indicating their presence. However,
these games were advertised without showing the PEGI age rating in-
formation (let alone the content descriptors), contrary to Article 11 of
the PEGI Code of Conduct on advertising (which explicitly includes ‘on-
line advertising’)
82
and Sections 4.6, 4.7, and 4.8 of the 2021 PEGI
Labelling &Advertising Guidelines.
83
Failing to show the age rating
information to better guide and advise parents and players is certainly
socially irresponsible, albeit not necessarily illegal under UK advertising
rules (it is debatable whether the PEGI age rating information, beyond
the presence of in-game purchases and loot boxes, is also ‘material in-
formation’whose omission would be misleading).
4. Discussion
4.1. Non-disclosure of in-game purchasing and loot box presence
Study 1 revealed that nearly all popular games containing loot boxes
that advertised on Meta-owned social media platforms failed to comply
with disclosure requirements imposed by UK advertising regulations.
Amongst 185 adverts studied, 165 adverts (89.2 %) did not disclose the
presence of in-game purchases, and 172 adverts (93.0 %) failed to
disclose loot box presence. Amongst 63 popular games studied, 53
games (84.1 %) did not ever disclose the presence of in-game purchas-
ing, and 57 games (90.5 %) never disclosed loot box presence. A small
minority of games (10 games (15.9 %) or 6 games (9.5 %), depending on
the disclosure in question) did comply at times. However, even amongst
these few games, about half did not make the legally required
Fig. 2. Screenshots of relevant moments during Meta advert ID# 1040307840454210 for Azur Lane showing how it stereotyped, objectied, and demeaned women
and is therefore likely to cause offence. ©2023 Shanghai Manjuu &Xiamen Yongshi.
76
Derevensky and Gainsbury (n 5); Gainsbury and others (n 5).
77
CAP (n 33) 85.
78
Gambling Act 2005, s 6(5).
79
Loretta Lohberger, ‘Woman Who Stole $940,000 from Vet to Gamble Online
Jailed’ABC News (9 December 2021) https://www.abc.net.au/news/2021-12-0
9/rachel-naomi-perri-jailed-over-vet-theft-to-gamble-online/100686998
accessed 30 September 2024.
80
Ben Butler, ‘“Social Casino”Apps: The Games Exempt from Australia’s
Gambling Laws –Because No One Can Win’The Guardian (16 November 2022)
https://www.theguardian.com/australia-news/2022/nov/17/social-ca
sino-apps-the-games-exempt-from-australias-gambling-laws-because-no-on
e-can-win accessed 1 March 2024.
81
House of Representatives Standing Committee on Social Policy and Legal
Affairs (Australia), ‘You Win Some, You Lose More: Online Gambling and Its
Impacts on Those Experiencing Gambling Harm [Inquiry Report]’(Parliament
of Australia 2023) ch 6 https://www.aph.gov.au/Parliamentary_Business
/Committees/House/Social_Policy_and_Legal_Affairs/Onlinegamblingimpacts
/Report accessed 30 September 2024.
82
Pan European Game Information (PEGI), ‘The PEGI Code of Conduct’(Pegi
Public Site, 2023) https://pegi.info/pegi-code-of-conduct accessed 18 July
2023.
83
This document is not publicly available, and the author has been asked not
to share it to ensure that PEGI remains the sole source. A copy may be sought
from PEGI.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
11
disclosures consistently (i.e., some adverts for the same game were
compliant, whilst others were not). This means that the disclosures were
not reliable: depending on which individual advert for the same game
the consumer saw, they may or may not have been made aware of the
presence of in-game purchasing and of loot boxes specically. Amongst
all adverts studied, just those of four games (6.3 %) consistently dis-
closed the presence of in-game purchases, and only those of three games
(4.8 %) always disclosed loot box presence.
The CAP Guidance clearly explained in 2021, more than two years
before the present study was conducted, that any advertising of video
games in the UK must disclose the presence of in-game purchasing and of
loot boxes in particular if relevant.
84
This requirement has also been
upheld and enforced by the ASA in two complaint rulings on 4 October
2023.
85
However, 95.2 % of popular video games (60 of 63 total) that
advertised on Meta-owned social media platforms (i.e., Facebook,
Instagram, and Messenger) failed to always duly inform consumers that
they contained loot boxes and thereby acted illegally in breach of
advertising regulations.
Following the present study, three complaints were made to the ASA
in October 2023 asking it to specically rule on and afrm the point that
the advertising of video games on social media platforms must disclose
the presence of in-game purchases and of loot boxes specically when
they are implemented. The ASA upheld these complaints on 20 March
2024 and ruled that Electronic Arts (in relation to Golf Clash (Playdemic,
2017)),
86
Jagex (in relation to RuneScape),
87
and Miniclip (in relation to
8 Ball Pool (Miniclip, 2010)
88
) broke advertising rules (specically,
Sections 3.1 and 3.3 of the CAP Code) by failing to disclose the presence
of generic in-game purchases and of loot boxes specically and thus
mislead consumers by omitting material information. These rulings
conrmed the illegality of the ads identied herein.
Study 2 was able to verify that, amongst the most viewed 920 TikTok
adverts (i.e., those that received the greatest numbers of impressions),
130 of them pertained to games with in-game purchasing (14.1 %), and
100 of them were for games selling loot boxes (10.9 %). This afrms the
common knowledge that social media is indeed a platform used by video
game companies to advertise and that these adverts were widely viewed
by many users across different countries. Disappointingly, like Study 1’s
results for Meta-owned platforms, only 9 ads (6.9 %) disclosed the
presence of in-game purchasing, and just 7 ads (7.0 %) disclosed loot box
presence as required. The vast majority (93.0 %) of the most viewed
TikTok adverts for games with loot boxes were therefore non-compliant
with UK advertising regulations. In total, these adverts received
292,641,000 impressions in the UK alone. Many users have therefore
been exposed to illegal adverts that failed to provide important and
mandated information disclosures.
More specically, TikTok’s advertising tool stated in early 2023 that
the platform could be used to reach about 20 million (presumably
active) UK users aged 18 and above (or at least supposedly of this age
group, as younger users may have exaggerated their age during account
creation).
89
No data have been provided on users between the ages of 13
and 18 (or those under 13 who technically cannot have an account but
may have lied about their age to create an account anyway), even
though they can also be targeted with adverts on TikTok.
90
Ofcom (the
Fig. 3. Screenshots of relevant moments during Meta advert ID# 710027057632847 for Blackjackist showing how it glamorised gambling by implying that gambling
is linked to nancial and sexual success and is therefore socially irresponsible. ©2023 KamaGames.
84
CAP and BCAP (n 42) 10–11.
85
ASA, ‘Ruling on Hutch Games Ltd [Concerning F1 Clash on the Apple App
Store] A23-1196857’(n 46); ASA, ‘Ruling on Hutch Games Ltd [Concerning
Rebel Racing on the Google Play Store] A23-1196862’(n 46).
86
ASA, ‘Ruling on Electronic Arts Ltd A23-1222185’(20 March 2024) https
://www.asa.org.uk/rulings/electronic-arts-ltd-a23-1222185-electronic-arts-ltd.
html accessed 7 April 2024.
87
ASA, ‘Ruling on Jagex Ltd A23-1216471’(20 March 2024) https://www.
asa.org.uk/rulings/jagex-ltd-a23-1216471-jagex-ltd.html accessed 7 April
2024.
88
ASA, ‘Ruling on Miniclip (UK) Ltd A23-1216455’(20 March 2024) https
://www.asa.org.uk/rulings/miniclip–uk–ltd-a23-1216455-miniclip–uk–ltd.
html accessed 7 April 2024.
89
Simon Kemp and Kepios, ‘Digital 2023: The United Kingdom’(DataReportal,
9 February 2023) https://datareportal.com/reports/digital-2023-united-
kingdom accessed 2 December 2023.
90
ibid.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
12
UK’s media regulator) reported in 2024 that 42 % of 3383 parents
surveyed stated that their child aged between 3 and 17 used TikTok.
91
The United Nations reported that there were 14.4 million children under
18 in the UK in 2023.
92
Accordingly, roughly estimating that there might
be another 6 million users in this younger, under-18 age group (i.e.,
assuming 26 million total TikTok users in the UK), this would mean that
each user was exposed to illegal video game adverts that failed to
disclose loot box presence more than 11 times on average.
Importantly, this calculation includes only the 93 most watched
illegal TikTok adverts included in the very limited present sample:
numerous other illegal adverts that failed to disclose loot box presence
as required were undoubtedly shown to consumers many more times. As
discussed above under Section 3.2, the impression numbers provided by
TikTok suffer from certain limitations. It ostensibly does not count
repeated viewings of the same ad by the same user as multiple impres-
sions. However, some companies chose to serve (nearly) identical ads as
separate advert entries, which might have been a strategy to ensure that
the same ad was seen by the same users multiple times. This meant that
some repeated viewings of effectively the same ad by the same users
were counted as multiple impressions for some adverts but not others.
Regardless, the impression number provided by TikTok undoubtedly
still underestimated how many actual (rather than unique) impressions
each advert received. Therefore, even not accounting for countless other
illegal adverts beyond the 93 included in the present sample, each user
may well have been exposed to far more than 11 illegal adverts for
games selling loot boxes on average.
Notably, the present study, as preregistered, acknowledged any form
of disclosure as compliant. However, it ought to be highlighted that most
of the disclosures found were visually obscure. For example, as shown in
the leftmost pane of Fig. 4, extremely small and fuzzy text that was
highly difcult, if not nearly impossible, to read was used by a Meta
advert for Bingo Blitz (Playtika, 2012) (ID# 338637368511655: http
s://www.facebook.com/ads/library/?id=338637368511655). Further,
a light-coloured font was set against a light-coloured background,
making the text unreadable without pausing and zooming in (which may
not have been permitted on the social media platforms the adverts were
originally shown, e.g., one normally cannot zoom in on a TikTok or
Facebook ad video as of December 2023). Finally, the relevant disclo-
sure only appeared very briey for about three seconds at the end of an
extended video advert of 30 seconds. Users are unlikely to carefully
watch an ad to the very end and therefore may well miss the disclosure.
Another Meta advert for NBA 2K24 (ID# 353454070447437: http
s://www.facebook.com/ads/library/?id=353454070447437) similarly
used a tiny font that made the text basically illegible, as shown in the
centre pane of Fig. 4. The relevant disclosure language of ‘NBA 2K24
includes optional in-game purchases and paid random items’also only
appeared at the end of six lines of terms and conditions that most readers
likely would not have read at all.
Finally, as shown in the rightmost pane of Fig. 4, a TikTok advert for
Apex Legends (Electronic Arts, 2019) (ID# 1757757696224289:
https://library.tiktok.com/ads/detail/?ad_id=1757757696224289)
used the PEGI loot box label (which should be commended because
following the industry standard would help consumers to more easily
nd and understand the relevant information across various games,
although that label itself should also be signicantly improved). How-
ever, the relevant graphic was again incredibly tiny and, importantly,
placed at one of the corners of the screen, which might well have been
blocked by other user interface (UI) elements (e.g., captions for the
video). For context, the making of Fig. 4 by the author has not reduced
the image quality. The poor quality is original. The original adverting
images and videos les are also preserved at the data deposit link and
can be reviewed to evidence how poorly rendered the relevant graphics
were.
When the mandatory disclosures are made so poorly (such that many
consumers would not in fact be able to read them and understand them),
it would be open to advertising and consumer protection regulators to
opine that such disclosures, despite technically having been made,
would nonetheless remain non-compliant with the disclosure re-
quirements because they were made so ineffectively. For example,
Article 7(2) of the EU UCPD (and national implementations thereof,
including, in the UK, e.g., Regulation 6(1)(c) of the CPUTR and Section
3.3 of the CAP Code, as detailed above) states that material information
that has been provided in a manner that is ‘unclear, unintelligible,
ambiguous or untimely’would still constitute a misleading omission,
even though the information was not completely absent or ‘omitted’per
se, but instead poorly provided. Section 3.10 of the CAP Code requires
that, to avoid advertising misleadingly, any ‘qualications must be
presented clearly.’That a video game contains in-game purchases and
loot boxes might be viewed as a ‘qualication.’The CAP’s guidance on
small print and footnotes states: ‘…whilst there is no specic font or size
that marketers should use for small-print, qualications included in
small-print should not be presented in a text size, font, or colour which
makes them difcult to read.’
93
Given that the presence of loot boxes has been held to be ‘material
information’that must be provided to consumers within the meaning of
both EU consumer protection law
94
and UK advertising regulations
(which enforce aspects of UK consumer law that remains identical
retained EU law following Brexit, as explained above),
95
it follows that
poor disclosure of material information would also be a misleading
omission, which would attract a penalty
96
and for which the company
may be held criminally liable.
97
In the UK, engaging in a commercial
practice which is a misleading omission under Regulation 6 of the
CPUTR is a criminal offence under Regulation 10 of the same and at-
tracts a penalty of either a ne or imprisonment of up to two years or
both.
98
Indeed, the European Commission was clear in relation to video
games that compliance with Article 7 of the UCPD requires that ‘the
main characteristics of the product must be clearly described’(emphasis
added).
99
The loot box presence disclosure examples shown in Fig. 4,
considering the context in which they were shown as described above,
were almost certainly ‘unclear’and/or ‘unintelligible.’It is also relevant
to consider that mobile phone screens are relatively small to begin with
(which further justies and requires larger graphics being used). A more
prominent form of disclosure would be for the PEGI loot box label and
age rating information to be displayed over a black background for at
least ve seconds (perhaps with an announcer also reading out the
relevant information) at the start of any video game advertising, similar
to what is done by the major companies with video game trailers. For
reference, Section 4.6.1 of the 2021 PEGI Labelling &Advertising
Guidelines requires that the age rating label must be shown for at least 2
91
Ofcom (Ofce of Communications) (UK), ‘Children and Parents: Media Use
and Attitudes Report 2024’(19 April 2024) https://www.ofcom.org.uk/medi
a-use-and-attitudes/media-habits-children/children-and-parents-media-use-an
d-attitudes-report-2024/ accessed 25 September 2024.
92
United Nations, ‘How Many Children Are There in the UK?’(UNICEF DATA,
2024) https://data.unicef.org/how-many/how-many-children-under-18-are-th
ere-in-the-uk/ accessed 25 September 2024.
93
CAP, ‘Small Print and Footnotes’(15 August 2023) https://www.asa.org.
uk/advice-online/smallprint-and-footnotes.html accessed 30 September 2024.
94
European Commission (n 49) 105.
95
CAP and BCAP (n 42) 10–11; ASA, ‘Ruling on Hutch Games Ltd [Con-
cerning F1 Clash on the Apple App Store] A23-1196857’(n 46); ASA, ‘Ruling on
Hutch Games Ltd [Concerning Rebel Racing on the Google Play Store] A23-
1196862’(n 46).
96
UCPD, art 13.
97
CPUTR, reg 10.
98
ibid, reg 13.
99
European Commission (n 49) 104.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
13
seconds at the start of the video in game trailers to ensure adequate
disclosure. (Whether the PEGI loot box label itself is ‘ambiguous’within
the meaning of Article 7(2) of the UCPD, given that it has been empir-
ically demonstrated that most consumers do not understand what the
label means and what potential harms it entails,
100
is another question.)
In March 2024, a complaint was made to the ASA regarding an
insufciently prominent loot box presence disclosure, rather than the
complete absence of one. This related to a more recently shown advert
that was not contained within the present sample. Again, in relation to
Golf Clash, Electronic Arts used a light grey font to ‘disclose’loot box
presence using tiny texts that were set against a fast moving background
and disappeared quickly after only two seconds. On 10 July 2024, un-
surprisingly, the ASA upheld this complaint and ruled that failing to
present material information clearly, despite technically having pro-
vided it, would still breach Sections 3.1 and 3.3 of the CAP Code pro-
hibiting misleading omissions.
101
Following this ruling, some ads that
were deemed compliant by the present study were conrmed to have not
been compliant due to the disclosure lacking visual prominence.
Therefore, even more of the ads were breaking UK advertising rules than
reported herein. Interestingly, a previous draft of what later became the
ruling referenced Section 3.10 on presenting qualications clearly
because the ASA decided to add this additional alleged breach at its own
volition (the original complaint did not reference this section). However,
the ASA then decided to remove the reference to Section 3.10 of the CAP
Code after deciding it was not relevant after all. Nothing turned on this
point, so it was not pursued. However, upon reection, it is not under-
stood why Section 3.10 was later determined by the ASA to be irrelevant
when it should have been.
4.2. Non-compliance with the EU Digital Services Act by the ad libraries
The present ndings also revealed a number of deciencies with the
Meta and TikTok ad libraries in terms of compliance with the DSA. Most
importantly, Article 39(2)(a) mandates that ‘the content of the adver-
tisement, including the name of the product, service or brand and the
subject matter of the advertisement’must be provided by the ad li-
braries. This has not been properly done by the TikTok repository.
Although the full content of the advertising material (i.e., a video) has
been preserved, no information is provided as to what URL that specic
advert would have redirected the viewer to when interacted with. This is
the reason why the present study could not retroactively identify which
game a few adverts were even promoting (e.g., ID#
1751364793758754: https://library.tiktok.com/ads/detail/?ad_id
=1751364793758754), although actual users who saw the advert
obviously would have been redirected with a link to somewhere. The
failure by the repository to identify the actual product that is being
advertised appears to be an obvious breach of the DSA, and the failure to
provide the relevant redirect link means that only incomplete informa-
tion has been provided, which is a further breach. In contrast, the Meta
ad library provided the redirect link which made it possible to identify
what specically was being advertised.
Further, Articles 39(2)(b) and 39(2)(c) of the DSA respectively
require that ‘the natural or legal person on whose behalf the advertise-
ment is presented’and ‘the natural or legal person who paid for the
advertisement,’if different, must be disclosed in the repository. The
Meta ad library duly provided a ‘beneciary’and a ‘payer’eld to allow
this required information to be presented. Some adverts displayed the
correct information. For example, as shown in Fig. 5, a Meta advert for
RuneScape (ID# 331793519217340: https://www.facebook.com
/ads/library/?id=331793519217340) disclosed both the beneciary
and payer as ‘Jagex Limited,’the legal entity acting as both the devel-
oper and publisher for the game. However, other adverts failed to show
accurate information. For example, as shown in Fig. 6, a Meta advert for
Star Trek Fleet Command (DIGIT Game Studios &Scopely, 2018) (ID#
Fig. 4. Screenshots of Meta advert ID# 338637368511655 for Bingo Blitz (left); Meta advert ID# 353454070447437 for NBA 2K24 (centre); and TikTok advert ID#
1757757696224289 for Apex Legends (right) demonstrating how the in-game purchasing and loot box presence disclosures were not visually prominent. ©2023
Playtika; 2K Games &Sony; Electronic Arts.
100
Eamon Garrett and others, ‘Current Loot Box Warnings Are Ineffective for
Informing Consumers’(2022) 139 Computers in Human Behavior 107534.
101
ASA, ‘Ruling on Electronic Arts Ltd A24-1239057’(10 July 2024) https
://www.asa.org.uk/rulings/electronic-arts-ltd-a24-1239057-electronic-arts-ltd.
html accessed 20 July 2024.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
14
299004976183735: https://www.facebook.com/ads/library/?id=2990
04976183735) disclosed both the beneciary and payer as ‘Star Trek
Fleet Command,’which is the game title or alternatively the ofcial
social media account for the game title, neither of which would be the
‘legal person’whose identity must be provided per the DSA. In fact, the
game is developed by DIGIT Game Studios and published by Scopely.
The Irish DIGIT Game Studios is a subsidiary of the American
Scopely,
102
which in turn is a subsidiary of Savvy Games Group,
103
which ultimately is wholly owned by the Public Investment Fund, which
is the sovereign wealth fund of Saudi Arabia.
104
The disclosures required
by the DSA would not need to be so detailed and reveal all relevant
corporate structures. Nonetheless, the disclosure of the beneciary and
payer as only the game title is certainly insufcient and non-compliant.
At least the identity of the developer and the publisher should have been
published. The legislative intent that companies should be required to
provide more transparency about who is funding and beneting from
the advertising has been compromised. As a result, consumers experi-
ence more ‘sludge’
105
when, for example, trying to obtain redress
because they would need to conduct external research to nd out who is
responsible for the advertising.
Attempts to comply with this DSA requirement as to beneciary and
Fig. 5. Meta advert ID# 331793519217340 for RuneScape duly disclosed the ad’s ‘Beneciary’and ‘Payer’as ‘Jagex Limited.’ © 2023 Jagex.
102
Rebekah Valentine, ‘Scopely Acquires Digit Game Studios’(GamesIndustry.
biz, 9 May 2019) https://www.gamesindustry.biz/scopely-acquires-digit-game
-studios accessed 2 December 2023.
103
Brendan Sinclair, ‘Savvy Games Group Acquires Scopely for $4.9 Billion’
(GamesIndustry.biz, 5 April 2023) https://www.gamesindustry.biz/savvy-game
s-group-acquires-scopely-for-49-billion accessed 2 December 2023.
104
James Batchelor, ‘What Is Savvy Games Group and How Is It Trying to
Change Saudi Arabia’s Image?’(GamesIndustry.biz, 7 June 2023) https://www.
gamesindustry.biz/what-is-savvy-games-group-and-how-is-it-trying-to-cha
nge-saudi-arabias-image accessed 2 December 2023.
105
Richard H Thaler, ‘Nudge, Not Sludge’(2018) 361 Science 431.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
15
payer identity on the TikTok ad library also revealed certain short-
comings. For example, for a number of adverts, the ‘Ad paid for by’(or
payer) eld disclosed an obscure entity that could not be easily identi-
ed by a member of the public, such as ‘Madhouse-3’(ID#
1759802628232210: https://library.tiktok.com/ads/detail/?ad_id
=1759802628232210); ‘KA EC&Branding-01’(ID#
1754618969234433: https://library.tiktok.com/ads/detail/?ad_id
=1754618969234433); and ‘KA APP-01’(ID# 1754376902042673:
https://library.tiktok.com/ads/detail/?ad_id=1754376902042673).
These may well have been the account names for whichever entity paid
for the advert, but TikTok almost certainly has more information
internally about these opaque entities (e.g., legal registration details). As
it stands, the TikTok ad library has failed to satisfy Article 39(2)(c)
because no recognised legal entity has been publicly identied.
Finally, it must be highlighted that 154 out of the 1074 most viewed
TikTok ads (14.3 %) were removed for having violated TikTok’s terms of
service. These adverts were nonetheless viewed many times before they
were removed (otherwise they would not rank so highly in terms of
viewership). TikTok should put in place stronger content moderation
measures before ads are allowed to be published, because any ads that
breached platform rules should never have been published in the rst
place. There should also be better enforcement following publication so
that there should not be a signicant delay between publication and
removal causing millions of users to have viewed each instance of rule-
breaking advertising. For example, one such removed advert had at least
12 million unique impressions (ID# 1767328184045618: https://libra
ry.tiktok.com/ads/detail/?ad_id=1767328184045618). Article 39(3)
of the DSA imposes further obligations on ad libraries in relation to
adverts that have been removed (specically, disclosing the information
referred to in Article 17(3)(a)–(e)). In relation to the aforementioned
example of a removed ad, TikTok merely stated: ‘You are not able to
view this ad as it was removed from TikTok due to a violation of Tik-
Tok’s terms’and provided a hyperlinked button stating: ‘View rejection
reasons.’When clicked, a pop-up window further stated:
‘This content has been rejected
Rejection reason provided to advertisers
•The authorization for the TikTok post in this ad has expired.
Affected regions
United Kingdom’
Procedurally, this removal notice failed to provide information on
how the investigation process was started, i.e., whether it was prompted
by a third-party report or was conducted by the platform at its own
volition, as required by Article 17(3)(b). Substantively, ‘a reference to
the contractual ground relied on and explanations as to why the infor-
mation is considered to be incompatible’with TikTok’s terms and con-
ditions, as required by Article 17(3)(e), have also not been provided. The
contractual ground has not been identied, and the reason provided is
also vague: it is unclear whose authorisation it is referring to, and why
the expiration of the authorisation must necessarily cause the content to
be removed, rather than preserved in the repository but no longer shown
as an advert as a superior alternative that better supports the public
Fig. 6. Meta advert ID# 299004976183735 for Star Trek Fleet Command insufciently disclosed the ad’s ‘Beneciary’and ‘Payer’as ‘Star Trek Fleet Command.’ ©
2023 DIGIT Game Studios &Scopely.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
16
interest. Many other removed adverts were also merely attached with
the same curt notice. The public has not been made duly aware of the
underlying reasoning for the content moderation decision as intended by
the legislators. Researchers and other stakeholders also would not be
able to use this data to systematically study and assess the platform’s
content moderation practices. Future work should empirically assess
compliance with other required aspects of the DSA and other regulations
affecting digital platforms, such as the General Data Protection Regu-
lation (GDPR) [2016] OJ L119/1.
4.3. Importance of access to industry data
It is hoped that the present study can serve as a proof of concept of
what research might be possible when laws, like the data disclosure
obligations contained in the DSA, are imposed on technology com-
panies. The academic literature on loot boxes
106
and other non-industry
stakeholders have argued that video game companies should publicly
share data relating to loot boxes (particularly on spending) to allow for
independent scrutiny that would help the public to better understand
whether the concerns surrounding loot boxes are warranted. No member
of the industry has yet acted socially responsibly by doing this, and the
public is justied to draw an adverse inference from that inaction.
However, the present study demonstrates that there are other ways to
access some relevant industry resources (i.e., the advertising materials
and associated information) even when these are not being directly and
voluntarily provided. Although the data relied upon by the present study
are not spending data, and have their own limitations as mentioned
above, these are data relating to loot boxes that have been disclosed by
the industry (and, crucially, not by choice!).
The present research was only made possible because of platform
rules and indeed EU law that required certain information to be pro-
vided. Researchers should take full advantage of all such available op-
portunities to hold the industry to account. Regulators should also
actively enforce the rules to ensure that what the legislators have
intended for companies to provide is indeed being provided in practice.
For example, TikTok should be required to improve its ad repository to
fully comply with the DSA as detailed above. EU lawmakers should be
encouraged upon seeing such academic studies enabled by data disclo-
sure and transparency obligations that they have imposed on companies
being conducted for the public benet. Indeed, it might be advisable to
demand companies, particularly those large and international ones with
abundant resources, to publicly share even more information in acces-
sible formats. Platforms and the companies behind them actually benet
from sharing such data publicly, because presuming that companies
want less illegal content on their platforms, the aims of all stakeholders
are, for once, aligned: i.e., better content moderation and the removal of
illegal content. Opening up content moderation opportunities to the
public could allow for more efcient identication and processing. This
is particularly true in relation to advertising regulators and so-called
‘trusted aggers’per Article 19 of the DSA (e.g., an NGO (Non-
Governmental Organisation) with a specic charitable goal of address-
ing a specic issue, such as online child sexual abuse) who too can make
use of the tools. Towards this end, platforms should endeavour to equip
their ad repositories and other similar resources with more features,
such as an easy way to export data so that independent scrutiny would
not have to resort to manual review of each webpage or crude data
scraping. Policymakers in other regions beyond the EU where similar
obligations have not yet been imposed should recognise the already
realised benets of EU law and consider emulating the EU requirements.
Indeed, in relation to spending data on loot boxes held by the in-
dustry, it is a misnomer to refer to such data as ‘industry’data. In fact,
these are personal data belonging to individual users that are simply
being collectively held by a member of the industry. The data protection
laws of many jurisdictions now allow individuals to require companies
to provide them with a copy of all the personal data that is held about
them (e.g., Article 15 of the GDPR; Section 40 of the New Zealand Pri-
vacy Act 2020; Section 1798.110 of the California Civil Code; and
Article 45 of the Personal Information Protection Law of the People’s
Republic of China). This would include an individual’s loot box
spending data. By mobilising a large group of players to make data re-
quests, it is possible to ‘liberate’that data from the industry and allow
them to be used collectively in the public interest. This is a valuable,
future channel of research, similarly enabled by data disclosure-related
legal obligations that have already been placed on companies, that
should be explored.
4.4. Limitations
The practical limitations with relying on data provided by social
media platforms that could not be independently veried have already
been noted. The specic limitations relating to the number of ‘impres-
sions’that have supposedly been received by each advert as disclosed by
TikTok have also been acknowledged. The present study was limited to
reviewing the adverts that were within the sample, i.e., the most recent
ads published on Meta platforms for Study 1 and ones with the greatest
number of impressions on TikTok for Study 2. Most games published
many other pieces of the advertising that may or (far more likely) may
not have complied. Three of the four games that were deemed as fully
compliant with either the requirement to disclose in-game purchases
generally or loot boxes specically in relation to their three most recent
adverts for Study 1 (i.e., Lost Ark (Smilegate, 2019), Monster Legends
(Socialpoint, 2013), and Star Wars: Galaxy of Heroes (Electronic Arts,
2015)) are known to have published other adverts that were not
compliant. Some of these adverts were published before the most recent
batch, thus potentially showing that the relevant companies have
improved their compliance behaviour more recently. However, Lost Ark
published at least one other non-compliant advert in the same batch as
the compliant ones studied thus revealing inconsistent compliance even
during the same publication period. Future research equipped with more
resources could conduct a more comprehensive review. Although Sec-
tion 3.3 highlighted certain other aspects of problematic video game
advertising beyond the (non-)disclosure of monetisation features, this
part of the research was not conducted in a systematic manner or pre-
registered. Future studies could examine other problematic elements of
video game marketing and social media promotions that might breach
advertising rules. Previous research has rightfully identied that
advertising on social media should not be treated as a singular
concept.
107
Companies advertise on different platforms in different
ways, and users engage with those adverts in varying manners across
different platforms. The present study examined only advertising on
Meta platforms and on TikTok because their respective ad repositories
provided affordances that allowed for this research to be done. Further
examination of how video games are advertised on other platforms, such
as YouTube and Snapchat, should be conducted. Perspectives from users
as to how they felt about this advertising and whether they may have
been inuenced have not been considered and should be addressed in
the future. Similarly, why the vast majority of companies were non-
compliant cannot be known. Further research should ask for their per-
spectives to ensure better policy implementation: were the advertising
regulations themselves perhaps insufciently ‘advertised’?
106
e.g. Etchells, Morgan and Quintana (n 19) 12; David Zendle and Paul
Cairns, ‘Loot Boxes Are Again Linked to Problem Gambling: Results of a
Replication Study’(2019) 14 PLOS ONE e0213194, 11.
107
Hilde AM Voorveld and others, ‘Engagement with Social Media and Social
Media Advertising: The Differentiating Role of Platform Type’(2018) 47
Journal of Advertising 38.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
17
5. Conclusion
Social media is a popular avenue for video game companies to
advertise. The present two studies assessed whether such advertising
was compliant with the UK advertising regulator’s requirement that the
presence of optional in-game purchasing and of loot boxes specically
must be disclosed if implemented. (This requirement also applies in the
EU and the EEA virtue of identical consumer protection law.) On Meta-
owned platforms (i.e., Facebook, Instagram, and Messenger), the adverts
were nearly all non-compliant with UK advertising rules (172 of 185;
93.0 %). Amongst 63 popular titles known to contain loot boxes, only
four games (6.3 %) consistently disclosed the presence of in-game pur-
chases and only three game (4.8 %) always disclosed loot box presence
in all adverts studied. This pattern of industry-wide non-compliance was
also observed on TikTok. The vast majority (93.0 %) of the 100 most
viewed TikTok adverts for games that sell loot boxes breached UK
advertising regulations by failing to disclose their presence. In total,
these 93 illegal adverts received 292,641,000 impressions in the UK
alone. Many users have therefore been repeatedly exposed to illegal
adverts that failed to provide important and mandated information
disclosures. Assuming that TikTok has 26 million users in the UK, this
was estimated to be at least 11 views of illegal and misleading ads per
user on average. This number relates only to the 93 adverts included in
the present sample and does not account for many other illegal adverts
that failed to disclose loot box presence that were undoubtedly shown.
Video game companies that sell loot boxes must ensure that their
advertising is lawful by prominently declaring the fact that their games
contain in-game purchases and loot boxes specically.
Various social media platforms should more actively enforce the
rules to ensure that non-compliant ads are not allowed to be published in
the rst place and are quickly removed if and when they slip through the
net. Prior approval of all ads before publication by the social media
platforms would be ideal (especially considering the current situation
that the vast majority of ads are non-compliant), as merely responding to
complaints by later removing ads that have already been published and
seen by many users (potentially millions) is unhelpful. After all, signif-
icant prots are being made by the social media companies through
advertising, and it would not be unreasonable to expect a share of that to
go towards ensuring compliance and consumer protection. Once the
compliance rate is higher, e.g., more than 99.0 % of ads are compliant,
then the platforms could consider moving back to a content moderation
system that responds post hoc. Advertisers that repeatedly submit or
publish non-compliant advertising should be banned from the platforms
(e.g., the company behind Top War, discussed above). Social media
platforms might not voluntarily impose these restrictions without reg-
ulatory intervention because they are conicted to act against their own
commercial interests of maximising advertising revenue and the number
of advertisers: the company behind the Top War adverts has undoubt-
edly paid the social media platforms most handsomely. Laws forcing
these platforms to do better content moderation may therefore be
necessary.
The UK advertising regulator, the Advertising Standards Authority,
should more proactively enforce the rules. Credit is due to the ASA for
proactively publishing the ‘Guidance on advertising in-game purchases’
in 2021 to highlight the issue and subsequently investigating and up-
holding various related complaints. However, those enforcement actions
should not have been exclusively triggered by external academic pres-
sure when non-compliance is so widespread. Due to the very high non-
compliance rate observed, it does not appear that the ASA has taken any
proactive enforcement actions on the issue at its own volition. The ASA
might consider actively engaging with the most prolic video game
advertisers to ensure that they are aware of the rules (and are not un-
intentionally not complying due to a lack of knowledge), e.g., by holding
webinars in collaboration with the UK industry trade association, Ukie.
Against companies that repeatedly refuse to comply with advertising
rules, despite polite reminders and public denouncements (i.e., upheld
ruling against them), the ASA must be prepared to actually use its legal
backstop and refer those companies for criminal prosecution by Trading
Standards and the Competition and Markets Authority. When the
weaker deterrence powers of industry self-regulation prove unhelpful,
much stronger pressures (such as the threat of a custodial sentence) must
be exerted by law. Indeed, Trading Standards and the Competition and
Markets Authority, which are the UK government regulators tasked with
enforcing consumer protection law, both already have the necessary
information to proceed with a criminal prosecution. Setting a judicial
precedent might further publicise the issue and more effectively
dissuade companies from not complying.
Although focused on UK advertising regulation, this empirical ex-
amination of the ad repositories of the Meta-owned platforms and of
TikTok also revealed how they did not fully comply with the EU Digital
Services Act more generally by failing to sufciently provide certain
mandated information. Such implementation challenges should be
promptly xed but, admittedly, are to be expected with complex legis-
lation requiring technical execution. The mere passage of laws and
imposition of obligations do not mean that the problems have been
solved by regulation. Whether companies are indeed complying with the
regulations must be continually monitored. More broadly, the present
study demonstrates that information disclosure obligations placed on
technology companies by EU law can be used to conduct academic
research for the public benet as the lawmakers intended. Researchers
should take advantage of all data access avenues that have been made
available. Regulators should strive to ensure that existing channels are
kept open by actively monitoring whether companies are complying and
taking enforcement actions as needed to ensure compliance. Policy-
makers should consider requiring additional disclosures to be made by
companies (particularly beyond the EU) in order to enable further
research in the public interest.
6. Postscript on impact: ASA rulings upheld, media features, and
parliamentary questions tabled
A total of four ASA rulings based on this study were upheld as
detailed above.
108
These both claried the regulatory position and
further publicised the problem, which may reduce non-compliance and
better protect the public through raising awareness.
This study and the associated ASA rulings were reported on by The
Guardian,
109
Sky News,
110
and video game industry media sources read
by both companies
111
and players.
112
Three written questions were tabled in the House of Lords by Lord
Foster of Bath in relation to the ndings of, and the recommendations set
108
ASA, ‘Ruling on Electronic Arts Ltd A23-1222185’(n 86); ASA, ‘Ruling on
Electronic Arts Ltd A24-1239057’(n 101); ASA, ‘Ruling on Miniclip (UK) Ltd
A23-1216455’(n 88); ASA, ‘Ruling on Jagex Ltd A23-1216471’(n 87).
109
Rob Davies, ‘Video Game Firms Found to Have Broken Own UK Industry
Rules on Loot Boxes’(The Guardian, 29 March 2024) https://www.theguardian.
com/society/2024/mar/29/video-game-companies-developers-loot-boxes-re
gulator-complaints-rules accessed 18 April 2024.
110
Narbeh Minassian, ‘Mobile Game Ads “breaking Advertising Rules”on So-
cial Media - as Clip Featuring Beckham Slammed’(Sky News, 25 July 2024) htt
ps://news.sky.com/story/money-blog-latest-consumer-skynews-13040934
accessed 5 September 2024.
111
Brendan Sinclair, ‘Study Finds Most Social Media Ads Ignore Loot Box Label
Requirements’(GamesIndustry.biz, 4 January 2024) https://www.gamesindustr
y.biz/study-nds-most-social-media-ads-ignore-loot-box-label-requirements
accessed 1 October 2024.
112
Liv Ngan, ‘EA, Jagex, and Miniclip Broke Loot Box Advertising Rules’
(Eurogamer, 20 March 2024) https://www.eurogamer.net/ea-jagex-and-minicli
p-broke-loot-box-advertising-rules accessed 1 October 2024.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
18
out in, the present study to ask for the UK Government’s assessment and
response; however, the Government answers were not particularly
insightful.
113
Intellectual property notice
The author acknowledges that the copyright of all images, screen-
shots, and videos of video games, websites, and advertising materials
used in this research are retained by their respective copyright holders.
The author uses these copyrighted materials for the purposes of
research, criticism or review under the fair dealing provisions of copy-
right law in accordance with Sections 29(1) and 30(1) of the UK
Copyright, Designs and Patents Act 1988. The access, extraction, pub-
lication, and use of materials from the Meta and TikTok ad libraries for,
inter alia, academic research and criticism purposes in the public interest
are reasonably assumed to be lawful, particularly considering that
publication has been limited only to relevant materials. If copyright
and/or database rights subsist in the ad libraries, then, having
acknowledged the relevant sources, the author uses such data under
relevant fair use/fair dealing and ‘permitted acts’provisions of copy-
right law and database rights regulations, as applicable.
Positionality statement
In terms of L.Y.X.’s personal engagement with loot boxes, he has
played and continues to play video games containing loot boxes (e.g.,
Hearthstone (Blizzard Entertainment, 2014) until 2018 and Genshin
Impact (miHoYo, 2020) from 2020), but he has never purchased any loot
boxes with real-world money, besides negligible spending for research
purposes to conrm the presence of paid loot boxes.
Funding information
L.Y.X. is supported by a PhD Fellowship funded by the IT University
of Copenhagen (IT-Universitetet i København), which is publicly funded
by the Kingdom of Denmark (Kongeriget Danmark).
Declaration of competing interest
In relation to the past three years, L.Y.X. is providing paid consul-
tancy for Public Group International Ltd (t/a PUBLIC) (Companies
House number: 10608507), which has been commissioned by the UK
Department for Culture, Media and Sport (DCMS) to conduct indepen-
dent research on understanding player experiences of loot box pro-
tections (October 2024 –Present). L.Y.X. undertook a brief period of
voluntary work experience at Wiggin LLP (Solicitors Regulation Au-
thority number: 420659) in London, England in August 2022. L.Y.X. has
contributed and continues to contribute to research projects that were
enabled by data access provided by the video game industry, specically
Unity Technologies (NYSE:U) (October 2022 –Present). L.Y.X. has been
invited to provide advice to the UK Department for Digital, Culture,
Media and Sport and its successor (the Department for Culture, Media
and Sport; DCMS) on the technical working group for loot boxes and the
Video Games Research Framework. L.Y.X. was the (co-)recipient of three
Academic Forum for the Study of Gambling (AFSG) Postgraduate
Research Support Grants (March 2022, January 2023, &July 2024) and
a Minor Exploratory Research Grant (May 2024) that were derived from
‘regulatory settlements applied for socially responsible purposes’
received by the UK Gambling Commission and administered by
Gambling Research Exchange Ontario (GREO) and its successor (Greo
Evidence Insights; Greo). L.Y.X. has accepted funding to publish aca-
demic papers open access from GREO and the AFSG that was received by
the UK Gambling Commission as above (October, November, &
December 2022, November 2023, &May 2024). L.Y.X. has accepted
conference travel and attendance grants from the Socio-Legal Studies
Association (February 2022 &February 2023); the Current Advances in
Gambling Research Conference Organising Committee with support
from GREO (February 2022); the International Relations Ofce of The
Jagiellonian University (Uniwersytet Jagiello´
nski), the Polish National
Agency for Academic Exchange (NAWA; Narodowa Agencja Wymiany
Akademickiej), and the Republic of Poland (Rzeczpospolita Polska) with
co-nancing from the European Social Fund of the European Commis-
sion of the European Union under the Knowledge Education Develop-
ment Operational Programme (May 2022); the Society for the Study of
Addiction (November 2022 &March 2023); the organisers of the 13th
Nordic SNSUS (Stiftelsen Nordiska S¨
allskapet f¨
or Upplysning om Spel-
beroende; the Nordic Society Foundation for Information about Problem
Gambling) Conference, which received gambling industry sponsorship
(January 2023); the MiSK Foundation (Prince Mohammed bin Salman
bin Abdulaziz Foundation) (November 2023); and the UK Gambling
Commission (March 2024). L.Y.X. has received honoraria from the
Center for Ludomani for contributing parent guides about mobile games
for Tjekspillet.dk, which is funded by the Danish Ministry of Health’s
gambling addiction pool (Sundhedsministeriets Ludomanipulje) (March
&December 2023); from the Fundaci´
o Pública TecnoCampus Matar´
o-
Maresme [TecnoCampus Matar´
o-Maresme Foundation] for a guest lec-
ture (November 2023); and from the YMCA (Young Men’s Christian
Association) of Greater Toronto Youth Gambling Awareness Program for
a presentation, which is funded by the Government of Ontario, Canada
(March 2024). A full gifts and hospitality register-equivalent for L.Y.X. is
available via: https://sites.google.com/view/leon-xiao/about/gi
fts-and-hospitality-register. The up-to-date version of L.Y.X.’s full
conict-of-interest statement beyond the last three years is available via:
https://sites.google.com/view/leon-xiao/about/conflict-of-interest.
Data availability statement
The raw data, a full library of the video adverts studied, and relevant
screenshots are publicly available in the Open Science Framework at
https://doi.org/10.17605/OSF.IO/6ZSUA.
Acknowledgement
Thanks to Laura L. Henderson, Elena Petrovskaya, and Deirdre Leahy
for helpful and critical comments on earlier drafts of this manuscript.
Data availability
The raw data, a full library of the video adverts studied, and relevant
screenshots are publicly available in the Open Science Framework at
https://doi.org/10.17605/OSF.IO/6ZSUA.
113
Lord Foster of Bath and Lord Parkinson of Whitley Bay, ‘Question for
Department for Culture, Media and Sport, UIN HL3447, Tabled on 20 March
2024, Answered on 12 April 2024’https://questions-statements.parliament.
uk/written-questions/detail/2024-03-20/hl3447 accessed 3 May 2024; Lord
Foster of Bath and Lord Parkinson of Whitley Bay, ‘Question for Department for
Culture, Media and Sport, UIN HL3448, Tabled on 20 March 2024, Answered
on 3 April 2024’https://questions-statements.parliament.uk/written-question
s/detail/2024-03-20/hl3448 accessed 3 May 2024; Lord Foster of Bath and
Lord Parkinson of Whitley Bay, ‘Question for Department for Culture, Media
and Sport, UIN HL3734, Tabled on 15 April 2024, Answered on 29 April 2024’
https://questions-statements.parliament.uk/written-questions/detail/2024-04-
15/hl3734 accessed 3 May 2024.
L.Y. Xiao Computer Law & Security Review: The International Journal of Technology Law and Practice 56 (2025) 106069
19
