iiinova — where your digital self keeps evolving

Leon Xiao @leonxiao.com · 17/09/2026

I don’t think so. Bank card, ID, biometrics; some personal data have to be handed over. Conceivably, could one download a completely local but reliable biometric assessment system that processes the data only offline?

010

Leon Xiao @leonxiao.com · 14/09/2026

3️⃣🇺🇸: The bill in New York seeking to prohibit loot boxes whose prizes can be converted into real money continues to be amended and progressed through the legislative process: www.nysenate.gov/legislation/....

nysenate.gov

NY State Assembly Bill 2025-A9044B

Prohibits a person to offer or promote instant payout loot boxes to New York consumers.

000

Leon Xiao @leonxiao.com · 14/09/2026

2️⃣ 🇲🇾: Malaysia consults on how to regulate loot boxes (24 October 2026 deadline): contentforum.my/wp-content/u.... Proposed requirements include: disclosing loot box presence, probabilities, and the ringgit equivalent price and allowing parents to disable loot box purchasing.

contentforum.my

100

Leon Xiao @leonxiao.com · 14/09/2026

Directly relying on my research on Belgium's failed ban on loot boxes, this proposal does not seek to prohibit minors from accessing loot boxes per se, only when they lack parental consent.

100

Leon Xiao @leonxiao.com · 14/09/2026

Instead, (non-self-declaration-based) age verification must be conducted, such that parents can make an informed decision as to whether the game should be allowed for their children: e-seimas.lrs.lt/portal/legal....

e-seimas.lrs.lt

XVP-1842 AIŠKINAMASIS RAŠTAS dėl Nepilnamečių apsaugos nuo neigiamo viešosios informacijos poveikio įstaty...

100

Leon Xiao @leonxiao.com · 14/09/2026

Three loot box news items from September 2026. 1️⃣🇱🇹: Lithuania proposes to prohibit games with loot boxes from being directly offered to under-18s.

221

Leon Xiao @leonxiao.com · 01/09/2026

In contrast, the Irish advertising industry self-regulator has found that a disclosure is not required on the face of the ad if a disclosure is provided on the linked app store product page. The Irish statutory consumer regulator has not opined either way.

100

Leon Xiao @leonxiao.com · 01/09/2026

For context, the UK and Dutch advertising industry self-regulators have agreed with the European Commission that the loot box presence disclosure must be on the face of the ad.

100

Leon Xiao @leonxiao.com · 01/09/2026

However, this unjustifiable delay of at least several years harms consumers who deserve the standard of protection already promised to them by previously adopted laws.

100

Leon Xiao @leonxiao.com · 01/09/2026

It is unfortunate that several EU member states have decided against proactively enforcing the UCPD to address video game-related concerns as a matter of policy, because they expect the DFA to deal with the problems.

100

Leon Xiao @leonxiao.com · 01/09/2026

Policymakers should cautiously approach the DFA: (i) properly enforcing pre-existing law could already achieve some proposed aims, and (ii) the DFA’s eventual enforcement is unlikely to be effective, so any expectations and reliance must be realistic.

100

Leon Xiao @leonxiao.com · 01/09/2026

Notwithstanding, I am not unsympathetic towards the view that the DFA risks overregulation and is similarly likely to be very difficult to enforce, just like the UCPD.

100

Leon Xiao @leonxiao.com · 01/09/2026

Contrarily, leading companies with European headquarters or significant local presence are hiding important information from consumers, even though their trade bodies were directly told by the European Commission to ensure compliance in 2022 (commission.europa.eu/document/dow...).

100

Leon Xiao @leonxiao.com · 01/09/2026

We thus discredit the video game industry narrative—currently being used to lobby against the forthcoming EU Digital Fairness Act (DFA)—that only a small minority of bad actors in foreign countries are harming EU consumers.

100

Leon Xiao @leonxiao.com · 01/09/2026

88.6% failed to disclose at all, and 9.0% disclosed without sufficient visual prominence. This rule is based on the European Commission’s interpretation of existing EU consumer law, the Unfair Commercial Practices Directive (UCPD).

100

Leon Xiao @leonxiao.com · 01/09/2026

The European Commission requires companies to disclose the presence of loot boxes in video game advertising. However, we found that only 2.4% of Irish social media ads for popular games containing loot boxes were compliant with EU consumer law: doi.org/10.1080/1360....

doi.org

Misleading omissions of loot box presence disclosures: widespread unfair commercial practices in video game advertising on social media in Ireland and the EU

Loot boxes, gacha, and other gambling-like in-game purchases offer random rewards for money and may cause consumer harm, especially to children. Interpreting and strictly enforcing pre-existing con...

130

Leon Xiao @leonxiao.com · 01/09/2026

I discuss loot boxes, the non-enforcement of existing consumer and gambling regulations, and our studies using ad repositories provided by social media platforms as mandated by Article 39 of the Digital Services Act, which is excellent not just for research but also for journalism and enforcement.

000

Leon Xiao @leonxiao.com · 01/09/2026

I was invited to share our research through the newsletter of the European Centre for Algorithmic Transparency (ECAT) of the European Commission: ec.europa.eu/newsroom/jrc....

ec.europa.eu

JRCSEVILLE - Community research

110

Leon Xiao @leonxiao.com · 19/08/2026

It has been nine years since Star Wars Battlefront II. Consumers deserve the protection already promised to them by the Unfair Commercial Practices Directive.

001

Leon Xiao @leonxiao.com · 19/08/2026

I comment on failed regulations and litigation elsewhere, the application and enforcement of pre-existing EU consumer law, and importantly, why we should not just do nothing whilst waiting for the Digital Fairness Act (which has a clear potential to overregulate).

111

Leon Xiao @leonxiao.com · 19/08/2026

An IGN article in Deutsche about German 🇩🇪 and EU loot box regulation that comprehensively presents perspectives from (pro-regulation) policymakers, industry, academia, the age rating organisation, and clinical practice. Make your own judgment. Extensively researched by @achimfehrenbach.bsky.social.

101

Leon Xiao @leonxiao.com · 19/08/2026

The default option matters. When trying to promote open access, surely the default choice presented first should be the most open CC-BY, although one can see why a commercial publisher would be conflicted in suggesting CC-BY-NC-ND instead...

010

Leon Xiao @leonxiao.com · 12/08/2026

You come upon a fork in the path: junk mail edition 1. Get paid to publish a gambling affiliate link on your website (Did they even read what else is on that website? Almost tempted to say yes to study their procedure) 2. Claim an AI chatbot pretending to be me answering questions from parents?!

030

Leon Xiao @leonxiao.com · 11/08/2026

Big oof. OSF is removing file/data sharing capabilities: www.cos.io/osf-changes. I understand this is due to funding challenges. Need to find another repository. Bad news for #OpenScience.

000

Leon Xiao @leonxiao.com · 02/08/2026

My team actually cracked open and documented the disclosure features of those blind boxes and card packs that you see on display before me in the photo in the article.

010

Leon Xiao @leonxiao.com · 02/08/2026

Our research at the Creative Media Policy Observatory, School of Creative Media, City University of Hong Kong this past year would not have been possible without generous institutional funding and the support of my team (Callum Deery, Kuma Xiaoyu Xiong, Yuchen Huang, Elvis Lo, and Xiaoyao Ren).

100

Leon Xiao @leonxiao.com · 02/08/2026

As part of this new project, we will identify and report non-compliant cases to the Department for further action and create a free public website detailing global loot box regulation to better inform all stakeholders. Stay tuned!

100

Leon Xiao @leonxiao.com · 02/08/2026

Happily, the University Grants Committee (Hong Kong) recognises the importance of this issue and has, since the SCMP interview, announced that it will fund my project assessing loot box regulatory compliance in Hong Kong: cerg1.ugc.edu.hk/cergprod/scr....

cerg1.ugc.edu.hk

100

Leon Xiao @leonxiao.com · 02/08/2026

Indeed, the SCMP reports that said Department has “received 127 complaints related to loot boxes, trading cards and blind boxes between 2021 and 2025” and has undertaken to enforce against any breaches.

100

Leon Xiao @leonxiao.com · 02/08/2026

The Dutch advertising regulator (Stichting Reclame Code) has enforced it following my complaint. The Customs and Excise Department of Hong Kong, charged with enforcing this Ordinance, should do so as well.

100

Leon Xiao @leonxiao.com · 02/08/2026

The relevant Section 13E of the Trade Descriptions Ordinance is substantially identical to relevant provisions of UK and EU consumer law. The European Commission has authoritatively interpreted that section as requiring loot box probability and presence disclosures.

100

Leon Xiao @leonxiao.com · 02/08/2026

This article by Edith Lin features perspectives from lived experience, support services, prevention education, academic research, and enforcement across Hong Kong. 🇭🇰 I called for stricter enforcement of existing Hong Kong consumer law to mandate probability disclosures.

100

Leon Xiao @leonxiao.com · 02/08/2026

The South China Morning Post SCMP raises awareness of concerns around #LootBoxes and other gambling-like products and calls for further research: www.scmp.com/news/hong-ko....

152

Leon Xiao @leonxiao.com · 01/07/2026

These cases are fact-dependent: possibly a different story for a bus ad linking directly to the app store download page of a mobile game with loot boxes. May I suggest that it would just be safer to disclose, rather than try your luck with the second part of the legal test?

100

Leon Xiao @leonxiao.com · 01/07/2026

This is the first time that the ASA has not upheld at least one aspect of my complaint and wholly dismissed it. I am pleased to see further clarification of the rules. This is why we bring these test cases.

100

Leon Xiao @leonxiao.com · 01/07/2026

The ad did not provide an in-game purchase disclosure and thus omitted material information. However, the ad “was unlikely to cause the average consumer to take a transactional decision they would not otherwise have taken.” The second part of the legal test is often forgotten but also important.

100

Leon Xiao @leonxiao.com · 01/07/2026

For the reasons above, due to the specific nature of the in-game purchases in Borderlands 4 (non-repeatable DLCs) and the specific context in which this ad was shown (inevitably distanced from the purchasing decision), the ad was deemed NOT misleading.

100

Leon Xiao @leonxiao.com · 01/07/2026

These differentiate them from traditional in-game purchases where no such disclosures would be given once the player is inside the game to make the purchases in the in-game store.

100

Leon Xiao @leonxiao.com · 01/07/2026

4️⃣: Finally, the DLCs could only be purchased through a platform store and not inside the game itself, and PEGI’s “in-game purchases” would be shown on those platforms.

100

Leon Xiao @leonxiao.com · 01/07/2026

Thus, the ASA decided that this ad was significantly more distant from the actual purchasing decision of the game, when compared to ads in other contexts (e.g., a social media ad linking directly to an app store download page).

100

Leon Xiao @leonxiao.com · 01/07/2026

Further, the ad was on a bus, meaning that consumers were likely to only see it briefly, and sometimes at a distance while moving, so they would have to otherwise look up the game to purchase it.

100

Leon Xiao @leonxiao.com · 01/07/2026

3️⃣: The content of the ad and the context in which it is usually seen are also relevant. The bus ad did not include an explicit call to action to purchase and a price or directly link consumers to a point of purchase, such as via a QR code linked to its Steam page.

100

Leon Xiao @leonxiao.com · 01/07/2026

A disclosure would more likely be required for the latter and may not be required for the former. In this case, the in-game purchases were just non-repeatable DLCs: store.steampowered.com/dlc/1285190/....

store.steampowered.com

Steam DLC Page: Borderlands® 4

100

Leon Xiao @leonxiao.com · 01/07/2026

Those should be distinguished from repeatable purchases, like premium virtual currencies and loot boxes. A disclosure would more likely be required for the latter and may not be required for the former.

100

Leon Xiao @leonxiao.com · 01/07/2026

2️⃣: However, the nature of the “in-game purchases” in a game is relevant as to whether a presence disclosure is required. There are one-time purchases, like DLCs that provide additional story missions.

100

Leon Xiao @leonxiao.com · 01/07/2026

1️⃣: As a matter of principle, traditional DLCs bought through third-party platform stores are “in-game purchases” within the meaning of advertising regulations, because consumers would consider them as additional purchases they might make after purchasing the game itself.

100

Leon Xiao @leonxiao.com · 01/07/2026

An ad for Borderlands 4 on a bus was NOT required to disclose the presence of in-game purchases, due to specific circumstances, per the Advertising Standards Authority (ASA): www.asa.org.uk/rulings/take....

120

Leon Xiao @leonxiao.com · 24/06/2026

Abstract submissions for the Gam(bl)ing conference are flooding in. Don't forget to submit yours before the 26 June deadline this Friday (we won't check until after the weekend... 😉): tinyurl.com/thegamblings...!

tinyurl.com

051

Leon Xiao @leonxiao.com · 18/06/2026

... Riot Games (R$15 million), Ubisoft (R$10 million), Valve (R$10 million), Konami (R$8 million), and Nintendo (R$5 million).

010