There is a certain kind of tension that builds up in fields where the laws that are supposed to them grow too slowly. For years, this has been the tension in the mystery box sector of e-commerce, where people pay a set price for a random product that could be physical or digital, but is never known for sure. In peace. Making money. And feeling more and more nervous.
It’s not a secret that these sites do this. HypeDrop, Rillabox, Jemlit, and MysteryDrop are all well-known platforms that have real users, real revenue, and real marketing budgets. Without much trouble, you can find their paid videos on YouTube and TikTok. The question that keeps their legal teams up at night—are they running gambling businesses?—is harder to get a clear answer to from the government. As of the middle of 2026, the honest answer is: it depends on where you are sitting.
In 2018, Belgium made it clear that paid random-reward systems are illegal in the country, and it doesn’t matter if the prize is digital or physical. Instead of fighting it, a number of big video game companies quietly turned off loot boxes for users in Belgium. The mystery box vertical has mostly done the same thing with geo-blocks, but so far, the Belgian regulator has been focusing on bigger targets in the gaming industry. The legal framework is still in place. The close look might come later.
A different kind of lesson can be learned from the Netherlands case. In 2020, EA was fined €10 million by the Dutch government for FIFA Ultimate Team packs. Two years later, an appeals court threw out the fine, which meant that Dutch law could only be used for loot boxes that were part of a skill-based game. It’s not clear how this ruling applies to stand-alone mystery boxes, where the random-outcome mechanism is the whole product and not just a fancy part of something else. The Dutch government has made it clear that it knows the difference. People who work with Dutch traffic and see the 2022 reversal as a green light might be wrong.
It’s hard to say what the right rules are because the conversation has mostly been about loot boxes, which are in-game rewards that come with big video games. Weapon crates for Counter-Strike. Packs for Apex Legends. Because loot boxes were popular with younger people, they were politically visible in a way that separate mystery box sites were not. However, the rules that were made for loot boxes don’t just stop at the line of in-game purchases. It works like this: you pay money, and you get a random result that has real-world value that you can trade. Almost by definition, mystery boxes are better at what they say they are than most loot boxes.
The UK is in the middle, which makes it feel uncomfortable in its own way. The Gambling Act 2005 does not officially name loot boxes as gambling. The 2024 DCMS White Paper kept that stance and pushed harder for voluntary codes like parental controls, age disclosures, and clear odds. They haven’t said for sure that mystery boxes won’t be allowed, but they also haven’t said for sure that they won’t be allowed either. That lack of clarity is not a safe harbor for operators. It is a place to wait.
One gets the sense that the business world knows it can’t keep waiting forever. In 2020, the PEGI and ESRB rating bodies added disclosure labels for paid random-reward mechanics. This meant that consumers would be aware of them whether operators wanted them to be or not. There is no industry standard that is like the mystery box vertical. Different platforms put out their own probability disclosures that aren’t always very accurate. When there is this kind of inconsistency, regulators want to write the rules themselves.
China made rules about odds public in 2017, long before any Western regulators did. It’s important to note that Western regulators have since used that model as a guide. It is not unclear which way the travel is going. What’s still not clear is the speed.
