Cybersecurity Policy Report, Settlement reached over government allegations of deceptively priced loot boxes in video game, COPPA violations, (Jan 22, 2025)

By Seth Abrams, J.D., M.A.

Genshin Impact, a free-to-download video game which is allegedly marketed to children and teens, generates revenue from the selling of virtual currency and other content.

The FTC announced a settlement of charges with Singapore-based game developer Cognosphere Pte. Ltd. and its California-based subsidiary Cognosphere, LLC (together, “Cognosphere”) for both selling deceptive “loot boxes” within the video game, Genshin Impact, to children and collecting information on them in violation of the Children’s Online Privacy Protection Rule (“COPPA”). In a proposed stipulated settlement order, Cognosphere agreed to pay a $20 million monetary penalty and to make specific changes to address allegations outlined in the complaint brought by the DOJ on the FTC’s behalf. It also agreed to block children under 16 from making in-app purchases without parental consent (U.S. v. Cognosphere, LLC, FTC File No. 222 3152, No. 2:25-cv-00447 (C.D. Cal. Jan. 17, 2025)).

Background. Cognosphere does business in the United States as HoYoverse and it distributes Genshin Impact as a free-to-download game with in-app purchases. It has generated significant revenue through the sale of “in-game virtual currency and other content.” Loot boxes are available which enable the acquisition of a “five-star hero” within the game. Such characters can only be obtained by opening loot boxes, which players purchase using virtual currency. The complaint further alleges that the process of purchasing requires multiple exchanges into different types of currency, which creates a complicated system with “exchange rates in unusual denominations.” The complaint alleges that the in-app purchasing process “obscures the reality that consumers commonly must spend large amounts of real money [on loot boxes.]

In addition to unfairly marketing loot boxes to children, allegations were also made that Cognosphere failed to comply with the COPPA rule, which “requires online services and websites directed to children under 13 to notify parents about personal information they collect and to obtain verifiable parental consent before collecting and using any personal information collected from children.” The complaint alleges that the game is directed towards children and teenagers and that Cognosphere uses social media influencers geared toward this audience.

Levine comments. Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, stated that “Genshin Impact deceived children, teens, and other players into spending hundreds of dollars on prizes they stood little chance of winning.” He continued, “Companies that deploy these dark-pattern tactics will be held accountable if they deceive players, particularly kids and teens, about the true costs of in-game transactions.”

Complaint. The complaint alleged five counts against Cognosphere related to Genshin Impact. Count I alleges violation of the COPPA Rule and the FTC Act. Count II alleges misrepresentation of the Loot Box Odds which constitute false and misleading statements. Count III alleges misrepresentation of the cost of Loot Box Prizes, which again constitutes false and misleading statements. Count IV alleges unfair selling and offering a multi-tier virtual currency system to children and teenagers. Count V alleges unfair promotion and sale of loot boxes to children and teenagers.

Proposed relief. Under the proposed stipulated order, Cognosphere will be required to pay a $20 million penalty for its violations. It is also required to make changes to address the allegations outlined in the complaint. Cognosphere will be prevented from allowing children under 16 to purchase loot boxes without a parent’s affirmative express consent. It also will be prevented from selling loot boxes using virtual currency without providing for a real money purchase. Prohibitions also include misrepresenting loot box odds, prices, and features. Cognosphere is also required to disclose loot box odds and exchange rates for multi-tiered virtual currency and delete any personal data collected from children under 13 (unless parental consent is acquired.) Finally, Cognosphere is require to comply with COPPA, including its consent and notice provisions.

Concurring Statement. Commissioner Rebecca Kelly Slaughter issued a concurring statement in support of the complaint and the settlement. She noted that “this law-enforcement action is the first in the United States to address the growing scourge of [loot boxes] in video games.” She concluded by drawing an analogy to FTC v. R.F. Keppel & Bro., Inc., 291 U.S. 304 (1934), in which the Supreme Court found that a related sales tactic that “exploited consumers, children who are unable to protect themselves” was unfair.

Dissent. The vote to refer the complaint and stipulated order to the DOJ for filing was 5-0. However, Commissioners Andrew Ferguson and Melissa Holyoak dissented from the filing of Counts III - V. In a concurrence and dissent, Commissioner Ferguson first stressed Cognosphere’s severe violation of the COPPA rule, which justified the filing of the complaint. While he supported Count II of the complaint which alleged misrepresentation of the odds of getting a five-star hero, he disagreed with the conclusion that the loot box prize currency system was confusing under Count III. He also pointed out that parents could avoid the injury by “declining to give children access to a credit card, or by using parental control systems.” He concluded his statement by noting that the FTC Act does not “prohibit unsavory or unseemly business practices.” Instead, it “forbids only unfair or deceptive acts and practices.”

Attorneys: Marcus Smith, U.S. Department of Justice, for the U.S. Alexander Wyman (Latham and Watkins LLP) for Cognosphere, LLC.

Companies: Cognosphere, LLC

News: ConsumerProtection Privacy CyberPrivacyFeed DataPrivacy FederalTradeCommissionNews DataSecurity