Loot box odds disclosure

Loot box odds disclosure requirements come from three places: the app stores, consumer protection regulators, and a growing number of laws aimed at children. If your Godot game sells randomized items, such as loot boxes, gacha pulls, card packs or mystery chests, you have to show players the odds before they pay, and in some countries you can't sell them to children at all. This page sums up the rules as of October 2026 with a link to each source, shows what a clear disclosure looks like, and explains why PowerUp doesn't sell randomized items at all.

What counts as a loot box

The short version: the player pays, and what they get is decided by chance. Paying with coins that players buy with real money counts as paying. The US ratings board ESRB uses the label "In-Game Purchases (Includes Random Items)" for all of these, and names loot boxes, gacha, item or card packs, prize wheels and treasure chests. Apple's guideline talks about "loot boxes" or other mechanisms that sell randomized virtual items.

The store rules are written for randomized items players pay for, so a free drop at the end of a match is usually a different question. A paid key that opens a free chest isn't: the player is paying for the chance.

The rules, as of October 2026

The FTC's case against HoYoverse

The FTC said the maker of Genshin Impact misled players about their odds of winning sought-after five-star prizes and about how much it cost to win them. The settlement requires HoYoverse to show loot box odds and the exchange rates between its currencies, and to let players buy loot boxes directly with real money rather than only through currency. It is about that one company, not you, but it's the clearest statement so far of what the FTC expects from a game that sells randomized items in the US.

New York's case against Valve

New York's attorney general sued Valve over the paid loot boxes in Counter-Strike 2, Team Fortress 2 and Dota 2. The case leans on the fact that the random items can be sold online for money, on Valve's own market and on third-party sites. In May 2026 Valve asked the court to dismiss it, and as of October 2026 we found no ruling. The practical lesson for a small game: keep paid random items well away from anything players can cash out.

Children

Where these rules mention children, they point the same way: randomized purchases and kids don't mix. The FTC order needs a parent's consent for under-16s, the UK principles ask for controls that stop under-18s buying them without a parent's consent, Brazil bans loot boxes in games likely to be accessed by children and teenagers, and the EU authorities say they're paying particular attention to loot boxes that children can reach. If your game is likely to be played by kids, the simplest plan is not to sell randomized items to them at all.

What a clear odds disclosure looks like

If you do sell randomized items, a disclosure that meets the store rules has a few parts:

• Odds for every possible result, per item or per rarity tier. If items inside a tier aren't equally likely, give their odds too.
• On the purchase screen, before the buy button, not behind a link in settings.
• Real numbers. Percentages that add up to 100, not words like "rare".
• How the odds change, if they do: guaranteed drops after a number of pulls, duplicate protection, event rates.
• The real-money cost, including the exchange rate if the box is bought with coins.
• The same table the server rolls with. Keep the drop table on your server and send it to the client, so what players read is what actually runs. Keep a dated copy of every table you ship.

In Godot, turning a weighted drop table into lines for a label is short:

## Odds shown above the buy button. Fetch this table from your server:
## the odds players read must be the odds the server rolls with.
var drop_table := [
	{"tier": "Common", "weight": 700},
	{"tier": "Rare", "weight": 250},
	{"tier": "Epic", "weight": 45},
	{"tier": "Legendary", "weight": 5},
]

func odds_lines(table: Array) -> PackedStringArray:
	var total := 0
	for row in table:
		total += int(row["weight"])
	var lines := PackedStringArray()
	for row in table:
		var pct := 100.0 * int(row["weight"]) / total
		lines.append("%s: %.1f%%" % [row["tier"], pct])
	return lines

func _ready() -> void:
	$OddsLabel.text = "\n".join(odds_lines(drop_table))

Roll on the server, never on the device: a roll the client makes can be replayed or edited, and you can't prove later what the odds were.

What PowerUp does

PowerUp has no loot box or gacha feature. Everything in a PowerUp store has a stated price and gives a stated item or coin amount, and every reward in a season pass, quest, event or club tournament is listed before the player earns it. Because nothing is random, there's no odds screen in the SDK: there are no odds to show.

The publish gate makes this a rule rather than a habit. The console has a declaration for randomized paid content. Switch it on and the check "No randomized paid content is enabled" fails, so the game can't publish. A second check requires a direct real-money option for any randomized paid content. With nothing random on sale, it always passes. Both cite the FTC's HoYoverse order, and the first also cites New York's case against Valve.

Our own game, buggs.io, made by the same team, runs its store on PowerUp with that declaration off: everything for sale in it has a stated price.

PowerUp only sees what runs through it. If you build randomness into your game yourself, outside PowerUp, the rules on this page are yours to follow. For coin shops and the EU's rules on them, see EU rules for in-game currencies, and for age checks in US app stores, see app store age laws.