The Federal Trade Commission (FTC) started the new year with a reminder that its focus remains on safeguarding the experience of children on gaming platforms. In January, it entered into a Stipulated Order and enjoined Cognosphere, LLC (Cognosphere) from violating the Children’s Online Privacy Protection Act (COPPA) and the FTC rules promulgated thereunder (which have recently been amended) and from violating section 5 of the FTC Act in relation to certain advertising practices associated with loot boxes.
Brief summary/takeaways
The FTC alleged that Cognosphere violated COPPA by marketing its game Genshin Impact to children under 13, collecting their personal information without parental consent, and failing to implement age gating or parental notification measures. The complaint also accused Cognosphere of misleading players about the odds of obtaining rare items in loot boxes and obscuring the real-money cost through a multi-tiered virtual currency system, violating section 5 of the FTC Act. As part of the settlement, Cognosphere agreed to implement age-screening measures, obtain parental consent for players under 16 to engage with loot boxes, and provide clear disclosures of loot box odds and costs. Although the settlement contained some onerous provisions, notably the prohibition of offering loot boxes to children and young teens without obtaining parental consent, the party-line votes of the commissioners submitted prior to the change in executive branch administration suggests that the primary takeaway from a section 5 perspective is that loot box mechanics must not misrepresent drop rates or create confusion about real-money expenditures.
Analysis
Cognosphere develops, operates, and distributes a popular video game, Genshin Impact. Genshin Impact is an action role-playing game that features an open world environment with action-based battle elements. The characters – called Heroes – are anime-styled and can be purchased via loot boxes. The Heroes are classified into different levels of rarity (4-Star and 5-Star) and many of these Heroes can only be obtained by opening loot boxes (Wishes). In order to open Wishes, players must acquire and spend virtual tokens (Wish tokens). Wish tokens can be acquired using virtual in-game currency: (1) Primogems – currency that is provided to the player when they begin the game and can be acquired through gameplay or engaging with influencers; and (2) Genesis Crystals – which can only be acquired by spending real money. Genesis Crystals can be used to purchase Primogems, which are then used to purchase Wish tokens. Players are required to create an account to play Genshin Impact.
In the complaint, the FTC alleged that Cognosphere marketed the game to children under the age of 13 (U13s) using a variety of mechanisms, including engaging social media influencers popular among children. The FTC alleges that Cognosphere collected personal information from U13s without obtaining parental consent or providing notice to parents and did not implement age gates or other screening measures to determine players’ ages.
According to the complaint, Cognosphere ran limited-time promotions called “Event Banners.” Each Event Banner featured an especially desirable “5-Star Hero,” which was exceedingly rare. In fact, players had about a 0.3% chance of receiving the featured Hero in one of these limited-time Event Banners. The featured 5-Star Hero was unavailable in any other Event Banner. Despite the 0.3% chance of receiving the featured 5-Star Hero, Cognosphere prominently characterized that players’ odds of winning the featured 5-Star Hero were “UP!” and subject to “Increased Drop Rates!” or a “massive drop-rate boost.”
There was a “Details” button under the advertisement. If a player clicked on the button they would be shown a picture of the featured 5-Star Hero along with text that read, “Percentage of 5-Star Item Drops: 50%.” The statement could reasonably be interpreted to represent that a player would be as likely to receive the featured character than not. There was a second “Details” button that, when clicked, would lead the player to another odds disclosure, stating that “[b]ase probability of winning 5-[S]tar character = 0.600%; consolidated probability (incl. guarantee) = 1.600%; guaranteed to win 5-[S]tar character at least once per 90 attempts,” and that the featured Hero has a “huge drop-rate boost.” Even that disclosure was ambiguous. According to the complaint, even if a player opened 90 loot boxes, a player would receive a less desirable, 5-Star prize not featured on the Event Banner half of the time. In such a case, the player would then have to open as many as 90 additional loot boxes to obtain the featured 5-Star Hero.
The FTC brought charges against Cognosphere alleging violation of COPPA and the COPPA Rule as well as violation of section 5 of the FTC Act. We address each part of the complaint below.
A. COPPA claims
1. Genshin Impact is directed toward children
The FTC alleged that Genshin Impact is a child-directed online service and, as such, must provide direct notice to parents and obtain verifiable parental consent prior to collecting personal information from U13s. In the complaint, the FTC alleged that Genshin Impact is directed toward children because (1) the game's subject matter, visual content, animation style, childlike characters/Heroes, and gameplay are similar to other games that appeal to younger audiences; (2) marketing campaigns and social media influencers were chosen because of their popularity with younger audiences; and (3) there are a substantial number of children who play the game.
The FTC alleged that various elements of Genshin Impact's animation style and graphics appeal to child audiences. These elements include anime-style cartoon graphics, characters in the game who have the appearance or speech of children (the FTC noted that the Genshin Impact mobile app utilizes an image of the childlike mascot of the game in its cover image), and bright, colorful animation. These visual elements, the FTC alleged, are known to appeal to children. Players also engage in stylized combat without blood or gore – another element popular in games with younger audiences. A number of the game’s Heroes also have the appearance of young children, and Cognosphere refers to them as a “Cute Force” with stylized hearts, pawprints, and clovers that are reminiscent of children’s art.
The FTC also alleged that Cognosphere actively marketed Genshin Impact to U13s by engaging social media influencers to promote the game on various platforms. These influencers were known to be popular among children, as they were finalists for categories related to gaming and online media at the Nickelodeon Kids Choice Awards. Further, internal planning documents revealed that Cognosphere specifically recruited influencers known for producing content associated with games and activities that are popular with U13 audiences (such as Minecraft and Roblox). Cognosphere also paid many of these influencers to display Genshin Impact promotional videos while they engaged in other child-directed activities (e.g., playing games such as Minecraft and Roblox). The complaint alleges that influencers were encouraged to take part in certain in-game activities that appeal to U13 audiences, such as playing an in-game version of hide and seek.
Additionally, at least in some instances, Cognosphere had actual knowledge that U13s were actively playing Genshin Impact and engaging with the social networking features of the game. Through these social networking features, Cognosphere became aware that U13s were engaging with the platform based on communications and posts containing photos and videos.
For these reasons, the FTC determined that Genshin Impact is an online service directed toward children.
2. Cognosphere collects personal information from U13s without obtaining verifiable parental consent
Because Genshin Impact is directed toward children and Cognosphere had actual knowledge that U13s were playing the game, the game developer was required to provide direct notice to parents and obtain verifiable parental consent prior to collecting personal information from U13s. Players are required to provide personal information to register for an account to play Genshin Impact, and Cognosphere collects persistent identifiers from players’ devices while they are playing the game. Under COPPA, account registration information (including a screen name), contact information, and persistent identifiers are all considered personal information. They may not be collected from U13s without providing direct notice to parents and obtaining verifiable parental consent. Cognosphere did not implement an age screening mechanism in Genshin Impact to determine which users were U13s and which users were adults. Further, the FTC alleged that Genshin Impact did not provide disclosures in its privacy policy about its intent to appeal to children until after becoming aware of the FTC's investigation.
As Cognosphere failed to provide parents with direct notice of or obtain parental consent prior to its practices concerning the collection, use, and disclosure of children’s personal information, it did not comply with the COPPA rule.
3. Cognosphere discloses U13s’ personal information to third parties
The complaint also alleged that in addition to failing to notify parents and obtain their consent for the collection of personal information, Cognosphere failed to notify and obtain parental consent for the disclosure of the personal information of children to third parties. The personal data that was collected was shared with third-party analytics firms and advertisers, as well as device-related identifiers, to track player activities, purchases, settings, friends lists, and other in-game behaviors.
As Cognosphere failed to notify parents and obtain their consent to disclose such information, the complaint alleges that the game developer did not comply with COPPA.
B. Section 5 claims
The FTC alleged that Cognosphere misrepresented the odds of receiving prizes from in-game loot boxes. In connection with advertising and marketing of in-game digital merchandise, content, and paid virtual currency in the Genshin Impact game, Cognosphere represented certain odds that loot boxes (Wishes) would contain particular prizes. According to the complaint, in many instances the actual odds were “meaningfully lower” than advertised.
Under the stipulated order, which is a settlement of the charges, Cognosphere was required to disclose in close proximity to the representation of a “prominently featured or depicted” in-game item (a) the likelihood of obtaining the featured item; and (b) the range of potential total costs in U.S. dollars to obtain the featured item.
The complaint also alleged that the advertising and marketing of Cognosphere loot boxes misrepresented the real-money cost of obtaining loot box prizes. The problem appears to have been that by using a multi-tiered virtual currency exchange system, Cognosphere created confusion about exactly how much real-money currency was required to obtain a loot box. The FTC alleged that this confusion resulted in a deceptive practice.
The stipulated order required that if Cognosphere offered bundles or packages of virtual currency available for purchase, then at “any point of sale,” it would need to clearly and conspicuously disclose (a) the number of transactions that a bundle or package of virtual currency provides toward obtaining digital items via a loot box; and (b) the exchange rate in U.S. dollars or applicable fiat currency for the advertised virtual currency for one loot box transaction. The stipulated order also requires that there be a link on Cognosphere’s game website and game login page to a page that lays out details about loot boxes available in the video game, including the odds of receiving featured in-game items and the cost (or range of potential costs) of obtaining the featured in-game items if the player were to use only real money to purchase the featured item via a loot box. Again, this provision in the stipulated order does not relate only to children but, rather, applies to any game offered by Cognosphere that contains a loot box.
Most notable, the stipulated order prohibited Cognosphere from offering any digital content that is available via a loot box without also allowing consumers a means to directly purchase the items with real money via the loot box. Moreover, under the order, the means to purchase the digital items without in-game currency along with a clear statement of the cost in real money must be provided at the same time as the loot box is offered. What is striking about this provision in the stipulated order is that it is not limited to children and teens.
In two other counts specifically related to loot boxes that are directed to children, the FTC focused on the use of a multi-tiered currency system that is employed to enable children and teenagers to use real-money currency in the furtherance of loot box transactions. The FTC alleged that the practice of selling such bundles of virtual currency (regardless of disclosure) caused or is likely to have caused substantial injury to a particular type of consumer that they themselves were not reasonably able to avoid and such injury was “not outweighed by countervailing benefits to consumers or competition.” In short, the FTC alleged that the very fact that a multi-tiered currency system was offered to children and teens for the purpose of selling loot boxes was unfair.
The FTC also alleged that offering “rare” prizes that can be obtained only by opening loot boxes was an unfair practice. Notably, the complaint focused on prizes that are “rare.” Thus, the fact that there might be loot boxes that offer an array of in-game items of essentially the same incidence level may not be an issue for the FTC, even if directed to children. Further, the FTC alleged that the unfairness was tied to the fact that the “rare” items were only available via a loot box. The FTC did not allege that loot boxes available to children and teens offering items that could be earned or otherwise purchased outright would be unfair.
Taking into account both the multi-tiered currency system and the exclusive use of loot boxes to distribute rare in-game items by chance, the parties agreed that Cognosphere would be prohibited from offering or selling any digital content or merchandise via a loot box to anyone under 16 without parental consent. Such consent must be preceded by a clear and conspicuous notice to the parent of (a) the material aspects of the nature and terms of the video game; (b) the presence of a paid in-game currency that can be used to purchase loot boxes; and (c) all material terms related to the loot boxes, including that loot boxes involve chance and require multiple purchases to obtain a specific item, the odds of obtaining a particular digital item, and the range of total costs in U.S. dollars or applicable fiat currency needed to purchase the featured content.
C. Key takeaways
1. COPPA key takeaways
a. In determining whether an online service is directed toward children, the FTC considers not only the design and content of the game (such as characters, bright and colorful animations, etc.) but also marketing strategies, including the use of social media influencers who appeal to children. If influencers or marketers promoting a game also target platforms or audiences that are known to appeal to children (e.g., Roblox or Minecraft), a game may be classified as child-directed, even if it is not explicitly labeled as such. Promotion of games in child-oriented ways may provide evidence that a game is also child-directed.
b. If a game is not intended to be played by children, representations should be included in the privacy policy and terms of service that prohibit children from playing the game and providing personal information. Game developers should devise a process for monitoring and addressing instances where they become aware that children are using their service, such as through social interactions or user content. If underage users are identified, their accounts should be removed promptly or parental consent obtained before continued use.
c. If a game is likely to appeal to a younger audience, age screening must be in place at account registration and users’ age verified to determine whether parental consent is required. Neutral, clear, and simple questions should be used to determine age (e.g., “What is your date of birth?”), avoiding tactics that could encourage users to misrepresent their age.
2. Section 5 key takeaways
a. When a particular, rare item is highlighted, the risk increases.
b. The advertising for a loot box that features a particular, rare item must not misrepresent the odds of receiving the featured item or the amount of money that might need to be spent in order to obtain the featured item. Attempts to disclose the actual odds on a different page or not in close proximity to the depiction of the digital item are likely to be ineffective in avoiding deception.
c. Material aspects of a loot box mechanism, which must not be misrepresented, include (i) what the in-game items are; (ii) the likelihood of receiving any particular item; (iii) whether participation in a promotional offering creates an advantage; and (iv) the potential range of total cost for obtaining an item via a loot box.
d. When presenting bundles of virtual in-game currency for purchase that present a complicated relationship to the real-money currency used to purchase the virtual currency, the risk increases, especially if the game involves multiple tiers of in-game currency without a 1:1 relationship. To the extent loot boxes are offered using a virtual currency, the relationship between the virtual currency and the real-money value that is required for purchasing a loot box should be clarified and/or disclosed.
e. When offering a loot box to children or even to teens under 16, the risk level is higher because this population is less likely to understand the material terms of the offer, especially if the offer is complicated.
f. It is important to recognize that this settlement occurred prior to the change in administration. It is also important to note that both Republican commissioners dissented from most of the counts arising under section 5. In particular, the FTC’s insistence that Cognosphere not present loot boxes that offer digital items unless those items can also be purchased with fiat currency appears to be limited to this case. Andrew Ferguson, the incoming FTC Chair, stated that this part of complaint “infantilizes the American consumer beyond recognition.”
g. It would be a mistake to assume that the Congosphere case does not represent a warning to game publishers to be transparent and clear as to in-game loot boxes, especially when directed to children. Chair Ferguson expressed aversion to loot boxes. He said that, provided with adequate evidence, he “does not foreclose the possibility that targeting certain kinds of addictive activities to children and teenagers – such as virtual slot machines in the form of loot boxes – could violate section 5’s prohibition of unfair acts and practices.” Thus, even the Republican Chair of the FTC has cast shade on loot boxes directed to children under 16.
In-depth 2025-060
