Leon Xiao

21 May

Delighted to share the visuals and mascot, a cute little mimic monster we've named Looty, for the upcoming Gam(bl)ing Conference (28–29 September 2026) in Hong Kong focusing on the convergence between video games and gambling.

Lately, we’ve done a lot of social media advertising research using Meta’s ad repository. Why haven’t we used the other platforms? Because they are either unavailable or lack important features and data, despite legal obligations imposed by the EU Digital Services Act. 🇪🇺

View full thread

The European Commission (rightfully) enforced against TikTok for poor implementation, but did not enforce against other platforms for literal non-implementation, which is arguably more concerning.

The EU must ensure these rules are properly implemented in all cases, and other countries should consider requiring the same to allow more transparency and public scrutiny of technology companies and realise the benefits the EU has already begun to demonstrate.

These deficiencies mean that most repositories cannot be reliably used at present. Only Meta’s is usable for many important research questions that are already supposed to be answerable per the legislative intent.

Obviously, significant implementation gaps remain, and the European Commission has not proactively enforced Article 39, unlike other DSA provisions, which have seen stricter enforcement. The few instances of Article 39 enforcement were also inconsistent and arguably political and unfair.

Indeed, 75% failed to provide country-based reach data, and only Meta provided reach broken down by demographic-based targeting criteria (age and gender).

Ad repositories are highly useful tools not just for researchers, but also for journalists, citizens, and even competitors, to better understand social media advertising.

Further, the repositories of Snap Inc. and X were unstable and failed to provide data consistently. Basic data (e.g., a copy of the ad, the identity of the advertiser, and the display period) were generally provided by most repositories.

However, as to more granular data, about half of the repositories failed to provide sufficient detail as to the precise user targeting criteria and the exact total number of users reached.

VLOPs and VLOSEs are required to provide a database of all advertising shown and transparency as to: who paid for each ad; which user demographics were targeted; and how many users were reached

Concerningly, seven services (including Amazon, Zalando, SHEIN, and three adult websites) failed to provide an online interface-based ad repository at all, as required. Zalando’s auditor, Deloitte, publicly reported that the platform had complied, but the relevant webpage has been—and remains—blank.

Xiaoyao Ren, Callum Deery, and I assessed 24 designated Very Large Online Platforms’ (VLOPs’) and Very Large Online Search Engines’ (VLOSEs’) compliance with their Article 39 obligations. Published in Computer Law & Security Review: doi.org/10.1016/j.cl....

doi.orgRedirecting

The Norwegian gambling regulator 🇳🇴, after being tasked with investigating #LootBoxes (with input from the consumer and media regulators and the Norwegian Film Institute) proposed various regulatory approaches for public consultation, all of which entail stricter regulation:

View full thread

Importantly, only enforcing existing information disclosure-based consumer law and relying on any anticipated loot box provisions in the forthcoming EU Digital Fairness Act at the regional level were deemed insufficient. National regulation is needed.

regjeringen.noHøring av Lotteri- og stiftelsestilsynets utredning om regulering av pengespill-lignende elementer i dataspillKultur- og likestillingsdepartementet sender med dette på høring rapporten om regulering av pengespill-lignende elementer i dataspill. Rapporten er utarbeidet av Lotteri- og stiftelsestilsynet, i sama...

The Norwegian Government is publicly consulting on next steps until January 2027. Do make your opinions known. The gambling regulator’s report and law reform proposals: www.regjeringen.no/no/dokumente... The government consultation: www.regjeringen.no/no/dokumente...

(3) do not amend the definition of gambling but explicitly clarify that paid loot boxes whose prizes are transferable between players are regulated as gambling, which would mean other paid loot boxes without transferable prizes will remain unregulated by gambling law (consumer law always applies).

The gambling regulator prefers either of the first two approaches because all paid loot boxes would be duly regulated, addressing the concerns. This is supported by research evidence that loot boxes with transferable prizes of “economic value” are not significantly riskier or more harmful.

(1) amend the definition of gambling by removing the existing requirement that the prizes must have economic value, which would regulate all paid loot boxes (including beyond video game contexts) as gambling;

(2) do not amend the definition of gambling but adopt a dedicated section just regulating paid loot boxes in video games; and

ah yes, the highly prestigious publishing venue of ORCiD.

contentforum.mycontentforum.my

Three loot box news items from September 2026. 1️⃣🇱🇹: Lithuania proposes to prohibit games with loot boxes from being directly offered to under-18s.

2️⃣ 🇲🇾: Malaysia consults on how to regulate loot boxes (24 October 2026 deadline): contentforum.my/wp-content/u.... Proposed requirements include: disclosing loot box presence, probabilities, and the ringgit equivalent price and allowing parents to disable loot box purchasing.

nysenate.govNY State Assembly Bill 2025-A9044BProhibits a person to offer or promote instant payout loot boxes to New York consumers.

3️⃣🇺🇸: The bill in New York seeking to prohibit loot boxes whose prizes can be converted into real money continues to be amended and progressed through the legislative process: www.nysenate.gov/legislation/....

Three loot box news items from September 2026. 1️⃣🇱🇹: Lithuania proposes to prohibit games with loot boxes from being directly offered to under-18s.

e-seimas.lrs.ltXVP-1842 AIŠKINAMASIS RAŠTAS dėl Nepilnamečių apsaugos nuo neigiamo viešosios informacijos poveikio įstaty...

Instead, (non-self-declaration-based) age verification must be conducted, such that parents can make an informed decision as to whether the game should be allowed for their children: e-seimas.lrs.lt/portal/legal....

Directly relying on my research on Belgium's failed ban on loot boxes, this proposal does not seek to prohibit minors from accessing loot boxes per se, only when they lack parental consent.

doi.orgMisleading omissions of loot box presence disclosures: widespread unfair commercial practices in video game advertising on social media in Ireland and the EULoot boxes, gacha, and other gambling-like in-game purchases offer random rewards for money and may cause consumer harm, especially to children. Interpreting and strictly enforcing pre-existing con...

The European Commission requires companies to disclose the presence of loot boxes in video game advertising. However, we found that only 2.4% of Irish social media ads for popular games containing loot boxes were compliant with EU consumer law: doi.org/10.1080/1360....

In contrast, the Irish advertising industry self-regulator has found that a disclosure is not required on the face of the ad if a disclosure is provided on the linked app store product page. The Irish statutory consumer regulator has not opined either way.

Published with Nicole Khoo in Information & Communications Technology Law: doi.org/10.1080/1360....

However, this unjustifiable delay of at least several years harms consumers who deserve the standard of protection already promised to them by previously adopted laws.

For context, the UK and Dutch advertising industry self-regulators have agreed with the European Commission that the loot box presence disclosure must be on the face of the ad.

Policymakers should cautiously approach the DFA: (i) properly enforcing pre-existing law could already achieve some proposed aims, and (ii) the DFA’s eventual enforcement is unlikely to be effective, so any expectations and reliance must be realistic.

It is unfortunate that several EU member states have decided against proactively enforcing the UCPD to address video game-related concerns as a matter of policy, because they expect the DFA to deal with the problems.

Contrarily, leading companies with European headquarters or significant local presence are hiding important information from consumers, even though their trade bodies were directly told by the European Commission to ensure compliance in 2022 (commission.europa.eu/document/dow...).

Notwithstanding, I am not unsympathetic towards the view that the DFA risks overregulation and is similarly likely to be very difficult to enforce, just like the UCPD.

88.6% failed to disclose at all, and 9.0% disclosed without sufficient visual prominence. This rule is based on the European Commission’s interpretation of existing EU consumer law, the Unfair Commercial Practices Directive (UCPD).

We thus discredit the video game industry narrative—currently being used to lobby against the forthcoming EU Digital Fairness Act (DFA)—that only a small minority of bad actors in foreign countries are harming EU consumers.

ec.europa.euJRCSEVILLE - Community research

I was invited to share our research through the newsletter of the European Centre for Algorithmic Transparency (ECAT) of the European Commission: ec.europa.eu/newsroom/jrc....

I discuss loot boxes, the non-enforcement of existing consumer and gambling regulations, and our studies using ad repositories provided by social media platforms as mandated by Article 39 of the Digital Services Act, which is excellent not just for research but also for journalism and enforcement.

de.ign.comGeht es Lootboxen nun an den Kragen?Verbraucher*innenschutz

An IGN article in Deutsche about German 🇩🇪 and EU loot box regulation that comprehensively presents perspectives from (pro-regulation) policymakers, industry, academia, the age rating organisation, and clinical practice. Make your own judgment. Extensively researched by @achimfehrenbach.bsky.social.

Achim Fehrenbach @achimfehrenbach.bsky.social

Could games with loot boxes soon get an 18+ rating in Germany? A closer look at the legal, political and psychological debate surrounding one of gaming's most controversial monetization mechanics. #lootboxes #agerating #darkpatterns #gambling #games de.ign.com/gesellschaft... @leonxiao.com @beuc.eu

I comment on failed regulations and litigation elsewhere, the application and enforcement of pre-existing EU consumer law, and importantly, why we should not just do nothing whilst waiting for the Digital Fairness Act (which has a clear potential to overregulate).

It has been nine years since Star Wars Battlefront II. Consumers deserve the protection already promised to them by the Unfair Commercial Practices Directive.

The default option matters. When trying to promote open access, surely the default choice presented first should be the most open CC-BY, although one can see why a commercial publisher would be conflicted in suggesting CC-BY-NC-ND instead...

12 Aug

You come upon a fork in the path: junk mail edition 1. Get paid to publish a gambling affiliate link on your website (Did they even read what else is on that website? Almost tempted to say yes to study their procedure) 2. Claim an AI chatbot pretending to be me answering questions from parents?!