Data Protection
FTC vs. Genshin Impact: Breaking Down the USD 20 Million Settlement
Table of Contents
Introduction
In January 2025, the U.S. Federal Trade Commission (FTC) announced that it had reached a USD 20 million settlement with Cognosphere (HoYoverse), the developer and publisher of Genshin Impact. The FTC charged that HoYoverse deceptively marketed its loot-box (gacha) system to minors, misled players about the odds of obtaining rare “five-star” items, and obscured the true dollar cost of in-game transactions via a multi-tiered virtual currency system.[1]
Under the terms of the settlement, the company is now prohibited from selling loot boxes to players under 16 unless it has obtained verifiable parental consent, must provide clear disclosures of loot-box odds and currency exchange rates, offer direct real-money purchase alternatives, and delete certain data collected from children that lacked proper parental consent.[2] These sweeping reforms reflect a regulatory shift: free-to-play games that depend heavily on randomised monetisation mechanisms are now under close scrutiny, particularly where children are concerned.
Equally significant is the FTC’s reliance on child-privacy law, specifically the Children’s Online Privacy Protection Act (COPPA). The complaint states that HoYoverse collected persistent device identifiers, user IDs, and other personal data from players under 13 without acquiring verifiable parental consent, in violation of COPPA.[3] Moreover, the data was shared with analytics and advertising partners, raising red flags about how minors’ data was monetised. By tying deceptive monetisation practices to children’s data concerns, the FTC crafted a multi-dimensional enforcement strategy that dovetails consumer protection and privacy law.
Loot Box Laws Explained: The FTC’s Legal Case Against HoYoverse
At the heart of the FTC’s case is Section of the FTC Act, which prohibits “unfair or deceptive acts or practices” in trade.[4] The Commission argued that HoYoverse’s loot-box mechanisms, virtual currency architecture, and marketing misled consumers about the real cost and probability of obtaining high-value items. Rather than directly charging in dollars, Genshin Impact requires players to buy ‘Genesis Crystals’ (or other currencies), then convert them through different in-game exchange rates before purchasing ‘wishes’ (loot-box pulls). The FTC says this layering purposefully obscured how much real money players were spending per attempt.[5]
The agency also alleged that marketing, including limited-time ‘Event Banners,’ and influencer promotions amplified a false perception of rarity or ease of obtaining five-star items. As Genshin Impact is free to download, the main monetisation hinge is these randomised purchases, meaning the deceptive presentation can lead to repeated microtransactions by vulnerable players.
By using Section 5, the FTC can demand both monetary penalties and injunctive relief (i.e. structural changes), which in the HoYoverse case includes age-verification, parental consent gating, and ongoing compliance monitoring. These remedies go beyond simple fines, compelling the company to redesign parts of the UX and data practices.
The second legal pillar of the FTC’s case, the Children’s Online Privacy Protection Act (COPPA), addresses how online services collect data from children under 13. The commission determined that HoYoverse collected persistent identifiers, including device IDs, IP addresses, and behavioural tracking data from under-13 players without obtaining ‘verifiable parental consent’.[6] The Commission further concluded that this data helped feed engagement metrics that influenced the structure of Genshin Impact loot boxes, reinforcing a cyclic framework where children’s data-informed systems encouraged those very children to spend. Under the settlement, HoYoverse must delete any improperly collected data systems to provide precise parental notifications and secure consent workflows.[7]
These legal foundations collectively demonstrate a broadening of regulatory strategy. The FTC did not classify Genshin Impact as ‘gambling.’ Instead, it relied on holistic consumer protection doctrines. This approach enables enforcement against deceptive features regardless of whether lawmakers update gambling or gaming legislation and sets a regulatory precedent for future investigations of similar mechanisms in digital entertainment.
Inside Genshin Impact’s Gacha Design
The FTC’s analysis of Genshin Impact loot boxes extended beyond legal categories and into the mechanics of game design itself. This marked a rare moment in which regulators scrutinised not only the economic structure of the monetisation system but also its psychological and user-experience dimensions. In doing so, the Commission addressed longstanding criticisms within the gaming community about gacha systems and the ways they engage cognitive biases, risky spending habits, and behavioural vulnerabilities among minors.
A key focus was the multi-currency conversion pipeline. According to the FTC’s findings, the multi-step process of converting real-world money into multiple forms of virtual currency rendered it unnecessarily difficult for players to understand the true cost of a single pull. Behavioural economists and game-design researchers have long noted that currency masking reduces a consumer’s perception of financial loss.
The Commission found that HoYoverse’s conversion chain, with its layered currencies and inconsistent conversion values, made it virtually impossible for minors to grasp their spending intuitively. Legal experts argued that this level of obfuscation aligns with traditional dark patterns, where interface design exploits cognitive blind spots to influence consumer decisions.[8] The FTC’s ruling effectively confirms this view, labelling these practices as deceptive within the meaning of federal law.
Another important factor in the FTC’s allegations was the role of influencer marketing. HoYoverse’s promotional strategies relied heavily on popular streamers, YouTubers, and TikTok creators who routinely broadcast ‘pull sessions’ to millions of young viewers.[9] These videos often caricature the excitement of rare drops, exaggerating responses and reinforcing the illusion that five-star characters are more common than they truly are.
This dynamic contributed to a misimpression of probability and created an unfair competitive advantage for the company in selling Genshin Impact loot boxes. As esports organisations and influencer networks increasingly professionalise, the FTC’s findings may prompt them to adopt compliance officers, standardised disclosure protocols, and mandatory training for sponsored creators.
Data collection formed the final component of the FTC’s analysis. HoYoverse’s use of persistent identifiers from under-13 users without parental consent was not merely a COPPA violation; the FTC argued that it tied directly into the game’s monetisation feedback loop. Behavioural data helped optimise the timing of events and pacing of reward cycles. When such data originates from children, it effectively converts minors into unwitting participants in commercial analytics systems.
The FTC emphasises that such practices create a harmful synergy in which children’s data affects design choices that, in turn, encourage those children to engage more heavily with monetisation mechanics.[10] In addition, the future COPPA enforcement may target not just collection but algorithmic use, potentially leading to a new era of algorithmic accountability in gaming similar to emerging standards in digital advertising and AI governance.
Following the settlement, HoYoverse will be required to implement significantly clearer disclosures, simplified purchasing flows, transparent odds presentations, and robust parental consent protocols. While the order applies directly to U.S. users, global studios are watching closely, anticipating that the settlement could influence international norms and marketplace expectations. Given the global distribution of Genshin Impact, non-U.S. regulators may treat the settlement as de facto guidance, compelling companies to harmonise compliance across regions rather than maintain fragmented legal regimes.
Industry-Wide Impact of the FTC’s Loot-Box Crackdown
The fallout from the settlement extends far beyond HoYoverse alone. Legal commentators widely anticipate that the FTC’s enforcement will reshape industry-wide practices around randomised monetisation. The Commission’s application of Section 5 and COPPA to Genshin Impact loot boxes provides regulators with a powerful template for intervening in similar systems.
This case could prompt other regulators to revisit their existing frameworks or adopt the FTC’s methodology, effectively exporting its standards through influence and precedent.[11] The settlement also may catalyse an industry shift, pushing companies toward sustainable monetisation structures that minimise regulatory risk.
For HoYoverse, the operational burden is significant. By 2025, the company must overhaul its age-verification system, requiring users to identify their age, and in the case of players under 16, obtain verifiable parental consent for any purchase involving randomised rewards. Accounts that cannot be verified may be suspended and ultimately deleted, resulting in the need for extensive backend restructuring, new data-handling pipelines, redesigned user interfaces, and parental control dashboards.[12]
Major publications have already reported on the rollout of these features, emphasising how they fundamentally alter the onboarding experience for U.S. players. The introduction of these mechanisms may also produce long-term shifts in player demographics, monetisation stability, and engagement patterns, as a friction introduced into the purchase process for minors could reduce overall spending volume.[13]
The broader gaming industry is poised for parallel reform. Many studios rely on monetisation schemes similar to Genshin Impact loot boxes, particularly mobile, gacha, and free-to-play developers whose revenue models centre on repeated purchases. These companies will gradually shift towards simplified pricing, reduced currency layers, transparent drop-rate disclosures, and direct-purchase options. Even companies not targeted by the FTC may choose to pre-emptively adopt these measures to reduce risk exposure.
The Genshin Impact settlement also catalysed discussion about how probability disclosures should be standardised across the industry, noting that some games already require hundreds of dollars for a statistically likely acquisition of a single rare character.[14] Publishers in the esports sector may also reconsider the competitive implications of randomised item acquisition, particularly in games where characters or equipment materially influence gameplay viability.
Conclusion
With a USD 20 million fine, the FTC has drawn a clear line for HoYoverse and the gaming industry on protecting minors in digital marketplaces. The Commission scrutinised Genshin Impact’s randomised rewards, data practices, marketing methods, and content aimed at children.
The decision that Genshin Impact’s loot boxes were deceptive under Section 5 of the FTC, combined with violations of COPPA for collecting children’s data without parental consent, sends a clear message to developers that they must take responsibility for how their games interact with younger players. HoYoverse now has to overhaul major parts of the game, from age verification to transparent pricing, in one of the largest compliance efforts seen in modern gaming.
Developers everywhere are being reminded that complex in-game currencies, unclear drop rates, and influencer hype are not just marketing but carry heavy legal risks. The FTC illustrates how influencers can unintentionally mislead younger players when showing off loot boxes. The ruling suggests that esports organisations and content creators will increasingly need to embed consumer protection principles into their promotional work.
Additionally, the settlement could serve as a model for global regulation of loot boxes. Importantly, the ruling does not hinge on gambling definitions, which have historically slowed regulatory progress. Instead, it relies on consumer protection principles, offering guidance that could encourage harmonised global standards for transparency and fairness in in-game transactions.
Ultimately, the FTC’s settlement with HoYoverse is about sending a clear message about ethical responsibilities that come with the huge influence modern game developers hold. It is a commitment to protecting minors in online spaces and a signal that, as digital marketplaces grow, regulators are paying close attention. For gamers, lawyers, and publishers alike, this settlement establishes important precedents that will shape the regulation and design of microtransactions.
[1] United States v. Cognosphere, LLC, Case No. 2:25-cv-00447 (C.D. Cal. Jan. 17). https://www.ftc.gov/system/files/ftc_gov/pdf/cognosphere_complaint.pdf
[2] Emma Smizer, ‘The Cost of Non-Compliance: Federal Trade Commission Fines HoYoverse $20 Million Over Genshin Impact Loot Boxes,’ (Lexology, 2025). https://www.lexology.com/library/detail.aspx?g=9932e693-cf87-4fdb-8398-b75817bb1c5a
[3] Federal Trade Commission, ‘Children’s Online Privacy Protection Rule,’ (FTC, 2025). https://www.ftc.gov/system/files/2012-31341.pdf
[4] Section 5 of the FTC Act, 15 U.S.C. § 45(a)
[5] Wesley Yin-Poole, ‘Genshin Impact Updates Shop to Show How Much You Need to Spend to Guarantee Pulling a Character — and Now Players Want HoYoverse to Sell the Characters Directly,’ (IGN, 2025)
https://www.ign.com/articles/genshin-impact-updates-shop-to-show-how-much-you-need-to-spend-to-guarantee-pulling-a-character-and-now-players-want-hoyoverse-to-sell-the-characters-directly
[6] Kanishka Singh, ‘Genshin Impact publisher settles US charges of violating children’s privacy,’ (Reuters, 2025)
https://www.reuters.com/technology/genshin-impact-maker-settles-us-charges-violating-childrens-privacy-2025-01-17/
[7] Nicole Carpenter, ‘Genshin Impact developer to pay $20M fine to US Federal Trade Commission over loot box violations,’ (Polygon, 2025).
https://www.polygon.com/news/511171/genshin-impact-ftc-settlement-gacha/
[8] Julia Solomon Ensor, ‘Level up: Tips for businesses from the FTC’s settlement with Genshin Impact developer HoYoverse,’ (FTC, 2025).
https://www.ftc.gov/business-guidance/blog/2025/01/level-tips-businesses-ftcs-settlement-genshin-impact-developer-hoyoverse
[9] Stacy Feuer, ‘A Kids’ Privacy Adventure: Exploring the FTC’s Privacy and Lootbox case against Genshin Impact,’ (ESRB, 2025).
https://www.esrb.org/privacy-certified-blog/a-kids-privacy-adventure-exploring-the-ftcs-privacy-and-lootbox-case-against-genshin-impact/
[10] Kanishka Singh, ‘Genshin Impact publisher settles US charges of violating children’s privacy,’ (Reuters, 2025)
https://www.reuters.com/technology/genshin-impact-maker-settles-us-charges-violating-childrens-privacy-2025-01-17/
[11] Federal Trade Commission, ‘Genshin Impact Game Developer Will be Banned from Selling Lootboxes to Teens Under 16 without Parental Consent, Pay a $20 Million Fine to Settle FTC Charges,’ (FTC, 2025).
https://www.ftc.gov/news-events/news/press-releases/2025/01/genshin-impact-game-developer-will-be-banned-selling-lootboxes-teens-under-16-without-parental
[12] Brent Koepp, ‘Genshin Impact’ Accounts Could Be Deleted if Users Don’t Verify Age Due to New U.S. Law,’ (VICE, 2025).
https://www.vice.com/en/article/genshin-impact-accounts-could-be-deleted-if-users-dont-verify-age-due-to-new-us-law/
[13] Nicole Carpenter, ‘Genshin Impact developer to pay $20M fine to US Federal Trade Commission over loot box violations,’ (Polygon, 2025).
https://www.polygon.com/news/511171/genshin-impact-ftc-settlement-gacha/
[14] Austin Wood, ‘$475 for one character in a video game: Genshin Impact adds new gacha disclaimers after FTC orders it to make costs and currencies less confusing,’ (GamesRadar+, 2025). https://www.gamesradar.com/games/open-world/thanks-to-the-ftc-genshin-impact-has-to-say-the-quiet-part-out-loud-obtaining-a-single-character-can-cost-up-to-usd475/