Two formal investigations into Activision Blizzard. A rewritten European age-rating system that just added its biggest category in over a decade. A market worth an estimated $23 billion a year, built largely on random-reward mechanics regulators now compare to gambling. In the first half of 2026, loot boxes went from a persistent industry irritant to the target of coordinated regulatory action across the European Union – and the fallout is already reaching American publishers, if not yet American shelves.

Italy’s competition authority opened two cases against Activision Blizzard in January over Diablo Immortal and Call of Duty: Mobile. Five months later, PEGI – the ratings body whose logos appear on nearly every boxed and digital game sold in Europe – rolled out its biggest classification overhaul since the system was created, making a PEGI 16 rating close to mandatory for any game that sells randomized paid items. Both moves sit inside a broader European Parliament push to rewrite how games can monetize minors. Here is what actually happened, why it happened now, and what it means for players and publishers well beyond Europe’s borders.

What Happened: Italy Opens Two Investigations Into Activision Blizzard

On January 16, 2026, Italy’s AGCM (Autorità Garante della Concorrenza e del Mercato, the national antitrust and consumer-protection authority) opened two formal istruttorie – case numbers PS13020 and PS13039 – against Activision Blizzard, the Microsoft-owned publisher. Both cases target free-to-play mobile titles: Diablo Immortal and Call of Duty: Mobile. The official announcement, published by AGCM itself, is unusually direct for a regulatory filing, describing “deceptive user-interface design aimed at inducing consumers to play more often, extend their gaming sessions and take up promoted offers,” according to the agency’s own press release.

TechCrunch’s coverage of the opening noted that AGCM is scrutinizing “misleading and aggressive” sales practices, including design elements meant to push extended play and repeated purchases – particularly among children. Game World Observer reported that the probe also covers whether Activision Blizzard’s parental-control defaults meet consumer-protection standards. As of publication, neither case has produced a ruling or a fine; both remain open investigations, and Activision Blizzard has not issued a public response.

The consumer group Codacons has publicly backed the probe, warning of gaming-addiction risk and threatening collective compensatory legal action on behalf of parents if the allegations are confirmed. The legal basis is Italy’s Codice del Consumo, specifically a “duty of professional diligence” clause that applies with extra weight in sectors, like gaming, where addictive design is a known risk.

“Dark patterns” is the industry term for interface design that nudges users toward decisions they would not otherwise make – not through force, but through friction, framing, and urgency. AGCM’s complaint against Activision Blizzard reads like a checklist of the genre: repeated push notifications built around fear-of-missing-out on time-limited rewards, virtual currency whose real-money value is deliberately hard to calculate, and bundle pricing structured so the “best value” option is also the most expensive in absolute terms.

The parental-control allegation is arguably the sharpest. AGCM says both games ship with in-app purchases, unlimited playtime, and open multiplayer chat all switched on by default – meaning a child using a parent’s device is one tap away from spending real money unless an adult has proactively gone in and turned protections on. The regulator also flagged the sign-up flow itself, alleging it steers users, including minors, toward accepting broad commercial-profiling consent as though it were a mandatory step rather than an optional one.

None of this is unique to Activision Blizzard – free-to-play monetization through cosmetics, battle passes, and randomized currency bundles is standard practice across mobile and console gaming. What makes this case notable is that a G7 competition authority is treating the design of the purchase flow, not just the existence of loot boxes, as the potential violation.

The Pricing Math Behind the Probe

One piece of evidence cited in Italian coverage of the case is concrete enough to check yourself: Diablo Immortal sells its premium virtual currency in bundles ranging from 60 units for €0.99 up to roughly 15,000 units (plus bonus) for €187.99. Run the math and the largest bundle works out to noticeably cheaper currency per unit than the smallest one – the kind of bulk-discount structure regulators say is designed to pull spending toward the highest tier, not just make purchases convenient.

AGCM AllegationWhat It MeansExample Cited
Dark-pattern notificationsPush alerts built around fear-of-missing-out on time-limited rewardsRepeated prompts before an offer expires
Obscured currency valueReal-money cost of virtual currency is difficult to calculateMulti-tier currency conversion
Bundle pricingBulk purchases carry a lower effective unit price, pulling spend upward60 units/€0.99 vs. 15,000+/€187.99
Default parental controlsIn-app purchases, unlimited playtime, and open chat are on by defaultNo active parental setup required
Consent harvestingSign-up flow presents commercial profiling consent as mandatoryBlanket consent options pre-selected
Account-blocking powerAccounts can reportedly be blocked unilaterallyLimited disclosed appeal process

A near-identical pattern shows up on the other side of the Atlantic, in a case that predates this one: the U.S. Federal Trade Commission’s 2025 action against Genshin Impact developer HoYoverse, discussed in detail further down. That case turned on the same basic mechanic – tiered currency bundles and long odds on the best rewards – just enforced through a different legal framework.

PEGI’s Biggest Overhaul in a Decade: How Interactive Risk Categories Work

PEGI (Pan European Game Information) is the age-rating system used across most of Europe, roughly equivalent to the ESRB in the United States. On March 12, 2026, PEGI announced what independent legal analysis at Reed Smith called its biggest reform in more than a decade: a new set of “interactive risk categories” layered on top of the familiar violence-and-language content ratings, effective for all newly submitted titles from June 2026.

The headline change is simple to state and hard for publishers to ignore: any game that sells “paid random items” – PEGI’s catch-all term for loot boxes, card packs, gacha pulls, and prize wheels – now receives a minimum PEGI 16 rating, regardless of how tame its violence or language content is. Shacknews reported that games with entirely unrestricted communication features (no blocking or reporting tools) can be pushed as high as PEGI 18, alongside titles built around NFTs or blockchain mechanics.

PEGI RatingInteractive Risk TriggerPractical Effect
PEGI 3No interactive risk elements presentBaseline rating, unaffected by the reform
PEGI 7Rewards players simply for returning (daily quests, login streaks)New dedicated content descriptor added
PEGI 12Time- or quantity-limited purchase offers, or penalties for not returningEscalates from PEGI 7 when loss/penalty is involved
PEGI 16Sells “paid random items” – loot boxes, card packs, gacha pulls, prize wheelsNew minimum rating regardless of violence/language content
PEGI 18NFT/blockchain mechanics, or fully unrestricted in-game communicationHighest interactive-risk tier

Existing titles that have already been classified are not automatically re-rated – the new categories apply going forward, unless a content update triggers reclassification under normal PEGI practice. Germany’s own ratings board, USK, made a comparable move in 2023; roughly 30% of submitted games were evaluated under the stricter criteria that year, and about a third of those ended up with a higher age rating than they would have received previously. That is the closest available precedent for how much of the European game catalog PEGI’s 2026 reform is likely to touch.

A Simplified Look at the Rating Logic

PEGI has not published its classification system as literal source code, but the decision logic it described publicly is straightforward enough to sketch out. The snippet below is an illustrative simplification for readers who think in code, not an official PEGI algorithm:

# Simplified, illustrative model of PEGI's 2026 interactive-risk logic
# (not official PEGI source – for explanatory purposes only)

def interactive_risk_rating(game):
    rating = 3  # baseline

    if game.has_nft_or_blockchain or game.chat_fully_unrestricted:
        rating = max(rating, 18)

    if game.sells_paid_random_items:  # loot boxes, card packs, gacha, prize wheels
        rating = max(rating, 16)

    if game.has_time_or_quantity_limited_offers:
        rating = max(rating, 12)
    if game.penalizes_non_return:  # lost content/progress for not logging in
        rating = max(rating, 12)

    if game.rewards_daily_return and rating < 12:
        rating = max(rating, 7)

    return rating

The practical upshot: it takes exactly one loot box mechanic to lock a game at PEGI 16, no matter what else is in it – which is precisely why EA's biggest sports franchise became the reform's most-cited example within weeks of the announcement.

EA Sports FC's Jump From PEGI 3 to PEGI 16

The single most-repeated example of the reform's real-world bite is EA Sports FC, whose Ultimate Team mode sells randomized player-card packs – textbook "paid random items" under the new rules. Legal analysis at Esports Legal News confirms the franchise moves from a PEGI 3 rating to PEGI 16 once the interactive-risk categories take effect, despite the on-pitch football content itself remaining as family-friendly as ever.

That gap – a 13-rating jump driven entirely by a monetization mechanic rather than any change to violence or language – is the clearest illustration of what PEGI's reform is actually targeting. Similar Ultimate-Team-style card mechanics appear across EA's broader sports lineup, including Madden NFL, and reporting on the reform has flagged Overwatch 2 and various racing titles with loot-box-adjacent economies as other franchises likely to see their European ratings climb once new entries or major content updates trigger reclassification.

The Political Runway: EU Parliament's Vote on Minors Online

Neither the AGCM case nor the PEGI reform happened in isolation. On November 26, 2025, the European Parliament adopted an own-initiative resolution titled "Protection of Minors Online" by a vote of 483 in favour, 92 against, and 86 abstentions, according to the European Parliament's own press release. The resolution explicitly calls for banning loot boxes and other gambling-like mechanics for minors, default-disabling addictive design features such as infinite scroll and autoplay for under-18 users, and setting a harmonized EU digital minimum age of 16 for social media and AI companion apps, with 13 as an absolute floor.

The vote itself is non-binding – it does not create new law – but it sets political direction and formally urges the European Commission to act. It followed an October 2025 vote by Parliament's Internal Market and Consumer Protection (IMCO) Committee that first called for a binding instrument to address gambling-like mechanisms aimed at children, making the November plenary vote a confirmation of direction that had already been building for over a year.

The Digital Fairness Act – and Industry's Self-Regulation Bet

The binding law that everything above is building toward is the Digital Fairness Act (DFA), a single instrument meant to cover dark patterns, addictive design, loot boxes, virtual currencies, influencer marketing, and unfair personalized pricing under one regulatory umbrella. A tracker maintained at digitalfairnessact.com shows the European Commission's formal proposal is expected in the second half of 2026, with full adoption unlikely before 2027 given the EU's standard trilogue negotiation process between Parliament, Council, and Commission.

That timeline gap is exactly why the PEGI reform matters as more than a ratings-label update. Video Games Europe, the industry's trade body, continues to back PEGI's voluntary self-regulation model – and doing so aggressively right now looks less like goodwill and more like a hedge. If publishers can show regulators that a self-governed, EU-wide age-rating fix is already working by the time the Digital Fairness Act reaches formal negotiation, they strengthen the argument that binding, harder-edged legislation isn't necessary. It's the same playbook the tech industry ran with data-privacy self-certification schemes before GDPR made the argument moot.

A $23 Billion Habit Under the Microscope

The regulatory attention has an obvious explanation: the money involved is enormous. Research from S&P Global, cited in reporting at The Next Web, estimates loot boxes generated roughly $23 billion globally over the past year, with European players alone accounting for around $12 billion of annual in-game content spending. For context, that European figure is larger than the annual box-office revenue of the entire global film industry in a typical year.

That scale is also why the regulatory response looks different this time than it did in 2018. A market this size, concentrated in mechanics regulators increasingly describe using gambling-adjacent language, is not something publishers can quietly wait out. It is large enough that even a modest compliance cost or design change – disclosing real odds, capping default spend, adding friction to repeat purchases – has a measurable effect on quarterly revenue for the franchises built around it.

Déjà Vu: Belgium, the Netherlands, and the 2018 Loot Box Wars

None of this is the industry's first brush with loot-box regulation. In April 2018, Belgium's Gaming Commission ruled that loot boxes in Overwatch, Counter-Strike: Global Offensive, and FIFA 18 constituted illegal gambling under national law, per background compiled on Wikipedia's loot box entry. Publishers faced fines of up to €800,000 and prison terms of up to five years – doubled if minors were involved – unless the mechanics were removed. Star Wars Battlefront 2 was spared largely because EA had already pulled its loot boxes following a separate launch-week backlash. The Netherlands' Kansspelautoriteit moved just days earlier, setting a compliance deadline of June 20, 2018.

What actually happened next is instructive: rather than redesign their monetization globally, several publishers simply geo-blocked or altered their games for the Belgian and Dutch markets specifically, leaving the underlying mechanics untouched everywhere else. The 2026 approach is deliberately structured to close that loophole – PEGI operates across essentially the whole EU single market at once, and the Digital Fairness Act, if adopted, would be enforceable EU-wide rather than country by country. A publisher can geo-block Belgium; it cannot practically geo-block the European Union.

Italy's Fine Framework and the eDreams Precedent

If AGCM does find Activision Blizzard in violation, the applicable penalty range comes from Italy's D.lgs. 26/2023, which implemented the EU's Omnibus Directive on consumer protection. Fines for unfair commercial practices run from €5,000 to €10,000,000, doubled for continued non-compliance, and can reach up to 4% of Italy-based turnover for cross-border operators – a threshold that scales the potential penalty to a company's actual size in the Italian market rather than a flat cap.

The clearest magnitude anchor available is recent: AGCM fined online travel agency eDreams €9,000,000 on January 27, 2026, for deceptive "Prime" subscription practices – a comparable dark-patterns case decided just weeks before the Activision Blizzard probe opened. If AGCM applies similar reasoning to a company the size of Activision Blizzard, a fine in the multi-million-euro range, well short of the 4%-of-turnover ceiling, looks like the realistic outcome rather than a symbolic slap.

Not the Same Fight: How This Differs From Roblox's Age-Verification Crackdown

It's worth being precise about what this story is not. Earlier in 2026, Roblox's stock dropped roughly 18% and wiped out about $6.7 billion in market value following backlash over mandatory facial age-estimation technology – a controversy about identity verification, not monetization design. The AGCM/PEGI story is about a completely different regulatory strand: how randomized paid purchases are designed and disclosed, not how a platform confirms how old you are.

The two stories share a root cause – intensifying European and global political pressure around child safety in gaming – but they are separate legal fights, with separate regulators, separate remedies, and separate companies at the center. Expect both to keep generating headlines through 2026 without merging into a single storyline.

What This Means for US Players and Publishers

There is no federal law banning or age-gating loot boxes in the United States as of 2026. The ESRB's approach is disclosure-only: a label reading "In-Game Purchases (Includes Random Items)", introduced specifically because ESRB research found that fewer than a third of parents recognized the term "loot box" even when they understood the mechanic. Unlike PEGI 16, the ESRB label does not restrict who can buy the game – it simply informs.

That does not mean the U.S. has been passive. The Federal Trade Commission has pursued enforcement case by case instead of writing a blanket rule. In its most consequential recent action, the FTC announced in January 2025 that HoYoverse, maker of Genshin Impact, would pay $20 million and block players under 16 from loot-box purchases without parental consent, settling charges that it violated the Children's Online Privacy Protection Rule (COPPA) and misrepresented loot-box odds and pricing. The FTC's own release noted players had roughly a 0.3% chance of winning a featured five-star character and might need to spend $360 to $540 to reliably obtain one – a bundle-economics pattern that looks a great deal like the one AGCM is now scrutinizing in Diablo Immortal.

Federal legislation has been tried and stalled before: Senator Josh Hawley's 2019 "Protecting Children from Abusive Games Act" would have banned loot boxes in games marketed to minors outright but was never enacted. State-level efforts are quieter but ongoing – New York's Assembly Bill A09044, active in the 2025-2026 session, would bar publishers from letting third parties repurchase loot-box contents, a narrower approach than PEGI's age-gate but part of the same broader pressure.

The practical spillover for American players may end up mattering more than any U.S. law. Because major publishers typically ship one global build rather than maintaining separate regional versions, design changes made to satisfy PEGI 16 or a future Digital Fairness Act – clearer odds disclosure, stricter default parental controls, friction on bulk currency purchases – often quietly ship worldwide rather than staying walled off in the EU. It's the same pattern that played out when GDPR's privacy defaults nudged U.S. products years before California's Consumer Privacy Act arrived.

Global Echoes: the UK, Brazil, and the Regulatory Patchwork

Europe isn't acting alone. The UK's Online Safety Act imposes age-verification duties on online services, including games, and UK regulators have signaled interest in extending similar under-16 protections to platforms with social and purchasing features. Brazilian consumer-protection authorities are separately moving toward restrictions on loot-box sales to minors, adding a major non-European market to the list of jurisdictions rethinking randomized-purchase mechanics in games. The result, as of mid-2026, is a genuinely global patchwork rather than a single unified standard.

JurisdictionRegulator / InstrumentApproachStatus (Mid-2026)
European UnionPEGI + Digital Fairness ActMandatory PEGI 16 age-label; binding law in progressPEGI reform live since June 2026; DFA proposal expected H2 2026
ItalyAGCMNational consumer-protection investigationTwo cases open against Activision Blizzard since Jan. 2026
BelgiumGaming CommissionLoot boxes classified as illegal gamblingIn force since April 2018
NetherlandsKansspelautoriteitGambling-law based compliance deadlineIn force since June 2018
United KingdomOnline Safety ActAge-verification duties on game/platform operatorsRolling implementation
BrazilConsumer-protection authoritiesProposed ban on loot-box sales to minorsIn progress
United StatesESRB (self-regulation) + FTC (case-by-case)Descriptive label only; COPPA-based enforcementNo federal law; FTC-HoYoverse $20M settlement, Jan. 2025

The contrast in the table above is the whole story in miniature: the EU is converging on a single, binding, age-gate-based standard, while the U.S. remains a mix of voluntary labeling and after-the-fact enforcement. Publishers operating globally now have to satisfy the strictest regime in whichever market they want to keep selling in – which, in practice, means designing for Europe's rules even in markets that don't yet require it.

Five Predictions: Where This Goes Next

  1. AGCM reaches a decision within 12-18 months, likely with a multi-million-euro fine. The eDreams case suggests a penalty well above the €5,000 floor but nowhere near the 4%-of-turnover ceiling – a result meant to sting without threatening Activision Blizzard's Italian operations.
  2. More national regulators open parallel loot-box cases once PEGI 16 creates a visible enforcement benchmark. AGCM's filing gives other EU consumer-protection authorities a ready-made template to point to.
  3. Publishers redesign monetization proactively rather than wait for the Digital Fairness Act. Video Games Europe's self-regulation bet only works if members visibly clean up defaults and disclosures before binding law arrives.
  4. U.S. pressure keeps building case by case rather than through a PEGI-style federal law. Expect more FTC actions modeled on the HoYoverse settlement, and renewed attention to stalled state bills like New York's A09044, rather than a Hawley-style federal ban gaining traction.
  5. Some EU-mandated defaults quietly go global. Clearer odds disclosure and stricter default parental controls, built to satisfy PEGI 16 and the coming DFA, are likely to appear in U.S. and worldwide builds too, echoing how GDPR shaped products well outside the EU.

Frequently Asked Questions

What exactly is a loot box?

A loot box is a purchasable, randomized in-game reward – a card pack, chest, or currency pull whose specific contents aren't known until after purchase. PEGI's 2026 reform uses the broader term "paid random items" to also cover gacha pulls and prize wheels under the same rule.

Why is Italy investigating Activision Blizzard specifically?

AGCM opened two cases in January 2026 targeting Diablo Immortal and Call of Duty: Mobile over alleged dark-pattern design, weak default parental controls, and unclear currency pricing – not because loot boxes themselves are automatically illegal in Italy.

What does a PEGI 16 rating actually restrict?

PEGI ratings guide retailers and platform storefronts on age-appropriate sales and parental controls across Europe; a PEGI 16 label signals the game is not recommended for, and in many storefronts restricted from being purchased by, players under 16.

Does the PEGI reform apply to games already on sale?

Not automatically. The new interactive risk categories apply to newly submitted titles from June 2026 onward. Previously rated games are only re-evaluated if a content update is significant enough to trigger reclassification under normal PEGI rules.

Is this the same issue as Roblox's age-verification controversy?

No. Roblox's crackdown centered on facial age-estimation technology used to confirm how old a user is. This story is about how randomized paid purchases are designed, priced, and disclosed – a related but legally distinct issue.

Are loot boxes regulated in the United States?

Not by a federal law. The ESRB uses a disclosure-only label rather than an age-gate, but the FTC has brought targeted enforcement, including a $20 million settlement with Genshin Impact developer HoYoverse in January 2025 over COPPA violations and misrepresented odds.

What happens if Activision Blizzard is found in violation?

Under Italy's D.lgs. 26/2023, penalties range from €5,000 to €10,000,000, doubled for continued non-compliance, or up to 4% of Italy-based turnover. A comparable recent case, eDreams, was fined €9,000,000 in January 2026.

When does the Digital Fairness Act become binding law?

The European Commission's formal proposal is expected in the second half of 2026. Given the EU's standard trilogue negotiation process between Parliament, Council, and Commission, full adoption is considered unlikely before 2027.