The dynamic development of the computer games market has led to a significant change in the monetization models used by game producers and publishers. The traditional sales model, based on a one-time purchase of a product by the consumer, has been largely replaced by solutions based on long-term user engagement and generating revenue through micropayments (microtransactions). Mechanisms known as loot boxes, consisting in the paid purchase of virtual packages with random content.

Although initially perceived as a means of enhancing gameplay, this mechanism is currently the subject of intense legal, economic, and social debate. It is increasingly being pointed out that the design of loot boxes utilizes psychological mechanisms similar to those that have been present in traditional gambling games for many years. The random nature of the reward, the uncertainty of the outcome, the “near miss” effect, the limited availability of certain items, and the use of dynamic animations intended to enhance the user’s emotional engagement all contribute to the blurring of the line between entertainment and gambling mechanisms.

Additional controversy stems from the fact that the vast majority of modern games using loot boxes are also aimed at minors. Unlike traditional gambling games, participation in these mechanisms does not require a specific age or meeting specific formal requirements. In practice, this means that random monetization mechanisms are also used by children and adolescents, who, due to their stage of psychological development, are particularly susceptible to the influence of behavioral design techniques and so-called dark patterns).

In recent years, the issue of loot boxes has ceased to be analyzed solely through the prism of gambling law. Regulations concerning consumer protection, digital services, and child safety in the online environment are gaining increasing importance. Discussions at the European Union level indicate that the future legal framework may be based not only on classic definitions of games of chance but also on instruments to combat manipulative practices and ensure a high level of protection for consumers using digital services.

At the national level, the problem remains equally relevant. Polish lawmakers have not yet decided to introduce a separate definition of loot boxes into the Gambling Act of 19 November 2009. This does not mean, however, that these mechanisms remain entirely outside the scope of existing regulations. In practice, administrative bodies assess each specific business model on a case-by-case basis, analyzing whether its design meets the statutory definition of gambling. At the same time, the development of the secondary market for trading in virtual items, particularly so-called skin gambling , is creating new interpretative challenges that the legislature did not anticipate when enacting the current regulations.

The changes introduced by the PEGI rating system in 2026 provided an additional impetus for reassessing the current regulations. The revised rules for classifying games with paid random mechanisms confirm the growing awareness of the risks associated with the use of loot boxes, especially for underage users. Although the PEGI rating is not a source of generally applicable law, its practical importance for the European market remains significant and may influence both the distribution of games and the future direction of legislative changes.

The purpose of this article is to analyze the current legal status of loot boxes under Polish and European Union law, taking into account recent regulatory changes, the practices of administrative bodies, and the experiences of selected European countries. Particular attention will be paid to whether the current regulations effectively protect consumers from mechanisms based on randomness and whether the current regulatory model meets the challenges of the modern digital economy.

The essence of loot boxes and their functioning models

The concept of a lootbox has not yet been defined in either Polish or European Union law. However, in the literature and by public institutions, it is generally accepted that a lootbox is a mechanism whereby the user obtains, for a fee or free of charge, a virtual package containing items whose contents remain unknown until opened. A characteristic element of this solution is randomness – the user has no influence on the item they receive, and the probability of obtaining individual rewards is determined by the game developer or platform operator.

At the definitional level, however, it should be emphasized that the term “lootbox” encompasses a wide variety of business models, the legal assessment of which cannot be uniform. Public debate often equates all mechanisms based on randomness with gambling, while from a legal perspective, individual solutions differ in both their economic structure and the degree of risk to the consumer. It is precisely this diversity that means that assessing the compliance of lootboxes with applicable regulations requires an analysis of the specific operational model, not just the presence of a random element.

The most classic model occurs in games where lootbox content is limited solely to cosmetic items, such as skins , animations, character outfits, or visual effects. These items do not affect gameplay or increase the player’s chances of success. They are intended solely for aesthetic purposes, allowing the user to personalize the appearance of their character or equipment. Such solutions were long considered relatively safe from a consumer protection perspective, but the development of secondary markets for trading virtual items has significantly changed their economic significance.

A good example is the Counter-Strike series, where weapon skins initially served only a visual purpose. Over time, however, a robust secondary market developed around these items, allowing them to be sold for real money. Consequently, the value of some virtual items began to reach several thousand, or even several dozen thousand, and in exceptional cases, several hundred thousand euros. In practice, this means that a randomly acquired item can have a tangible financial value, even though the game developer itself does not officially allow for its sale. The existence of an external market is one of the main arguments raised in the discussion on the classification of such mechanisms as potentially akin to gambling.

Loot boxes used in sports games, such as EA SPORTS FC Ultimate Team, are of a different nature. In this model, users purchase virtual packs containing player cards, coaches, or other team items. Unlike skins in games like Counter-Strike, acquired items directly impact gameplay. Acquiring rare players can increase a team’s competitiveness and improve player performance. Although the developer publishes information regarding the probability of receiving rewards in a given category, the user still doesn’t know the contents of a specific pack at the time of purchase, and the decision to purchase is based on a random mechanism.

Yet another model is found in so-called gacha games, extremely popular, especially in Asian markets and in the mobile gaming segment. This mechanism is based on randomization of characters, equipment, or other items necessary for further progression in the game. A characteristic feature of gacha systems is their close connection to long-term user monetization. Players are encouraged to repeatedly make micropayments to obtain exceptionally rare characters or items, the probability of obtaining which can be extremely low. The literature indicates that these solutions most fully utilize the mechanisms of behavioral economics and the psychology of addiction.

However, the most controversial are third-party platforms that enable the trading of virtual items and participation in games of chance that use items from video games as a form of currency. These services operate independently of game developers, leveraging the existing market for skins or other digital goods to organize mechanisms reminiscent of classic casino games. Users deposit funds or use their virtual items to participate in lotteries, roulette, duels, or other games based on chance. Unlike traditional loot boxes offered by game producers, the participant’s goal is not only to obtain a specific item but often to achieve a tangible economic benefit resulting from the possibility of reselling it.

From a legal perspective, the differences between the presented models are crucial. Not every mechanism employing an element of randomness automatically leads to its classification as gambling. Factors that should be assessed include, first and foremost, the potential for financial gain, the existence of a secondary market, the method of financing participation, the possibility of withdrawing funds, and the actual impact of randomness on achieving a specific outcome. In practice, this means a case-by-case analysis of the specific business model, rather than adopting a uniform classification for all types of loot boxes .

This approach is also reflected in the practice of many European countries. Both administrative bodies and courts are increasingly moving away from abstract assessments of the lootbox mechanism itself, focusing instead on analyzing their actual operation and impact on consumer interests. Consequently, the current legal debate no longer revolves around the question of whether lootboxes as a category should be considered gambling, but rather which monetization models justify their inclusion in a specific regulatory regime.

Loot boxes and the definition of gambling in Polish law

Assessing the compliance of lootbox mechanisms with Polish law requires, above all, an analysis of the provisions of the Gambling Act of 19 November 2009. Although the legislature has not yet decided to introduce a separate definition of lootboxes, this does not mean that these mechanisms remain outside the scope of applicable regulations. On the contrary, in practice, their legal classification depends on whether the specific operating model meets the criteria for one of the games specified in the Act.

The basic premise of the Gambling Act is to subject activities in which the outcome depends on chance to a specific regime, and the participant gains the opportunity to obtain a specific financial or material benefit. The Act does not use the term “lootbox” because it was enacted at a time when modern computer game monetization models were practically nonexistent. This necessitates a functional interpretation, taking into account the economic nature of the mechanism in question, not just its name or the technical solutions adopted by the game developer.

A key element of most loot boxes is undoubtedly randomness. The user making the purchase neither knows the contents of the package nor has the ability to influence the outcome of the drawing. However, the mere presence of a random element is not sufficient to classify a given mechanism as gambling. In practice, the nature of the prize received by the participant and the ability to assign it a real economic value are equally important.

This is where a fundamental difference between classic loot boxes offered by game developers and the mechanisms used by third-party platforms for trading virtual items becomes apparent. If the item obtained through a draw has a purely aesthetic function and cannot be legally exchanged for cash or used outside of the game environment, the arguments for classifying such a mechanism as gambling are significantly weaker. The situation is different when the item is de facto a property that can be freely traded on the secondary market, yielding a real financial benefit.

In practice, the greatest controversy surrounds so-called skin gambling. In this model, users use items obtained in-game as a means of participating in subsequent games of chance organized by third parties. Skins, which were originally purely cosmetic, are beginning to function as a kind of digital currency with measurable economic value. This mechanism leads to a situation in which participants risk losing items of real-world value in exchange for the opportunity to win an even more valuable reward. This structure bears a much greater resemblance to classic gambling games than the traditional micropayment systems used by game developers.

At the same time, caution should be exercised before drawing too far-reaching conclusions. The mere existence of a secondary market does not automatically mean that every loot box should be classified as gambling. From a legal perspective, a case-by-case analysis of the entire business model is necessary, including, among other things, the method of acquiring virtual items, the possibility of their resale, the role of the game producer, the scope of control over the trade in digital assets, and the actual economic significance of the rewards. Consequently, two mechanisms utilizing an identical element of randomness may be subject to entirely different legal assessments.

This position is also reflected in the practice of Polish administrative bodies. To date, there has been no established practice of automatically classifying all loot boxes as gambling. Authorities focus instead on analyzing specific business models and assessing whether they meet the requirements of applicable regulations. This approach reflects the nature of the Gambling Act, which uses functional definitions, leaving authorities considerable scope for assessing individual factual circumstances.

In this context, the practice of entering certain online platforms into the Register of Domains Used to Offer Gambling Games in Contravention of the Act has become particularly significant. However, such an entry does not mean that all platforms utilizing the element of randomness conduct illegal activities. Each decision is preceded by an assessment of the specific operational model of the given service. Consequently, it cannot be assumed that the lootbox mechanism itself has been deemed illegal in Poland. It is not the abstract technical structure that is being assessed, but rather its practical application.

Under current law, it seems more appropriate to ask not whether loot boxes per se constitute gambling, but which of their numerous operating models demonstrate characteristics that justify the application of the provisions of the Gambling Act. This approach avoids oversimplification and better reflects the reality of the digital market, where solutions with widely varying levels of risk to consumers coexist.

At the same time, it should be noted that even if a given mechanism does not meet the criteria for gambling within the meaning of the Act, this does not mean there is a lack of legal oversight. Modern regulations increasingly refer to consumer protection instruments, counteracting manipulative practices, and ensuring the safety of children using digital services. Therefore, analysis of loot boxes cannot be limited solely to gambling law. Regulations regarding consumer protection, digital services, and designing interfaces in accordance with fair trading principles are gaining increasing importance, and in many cases, they may prove to be a more effective tool for protecting users than traditional gambling law instruments.

Loot boxes as a challenge to consumer protection law and the regulation of digital services

Although the debate surrounding loot boxes has for many years focused primarily on gambling law, a shift in regulatory direction is now becoming increasingly apparent, both at the national and European Union levels. Contemporary challenges related to random mechanisms in computer games concern not only the classification of specific models as gambling, but also the compliance of the practices employed with the principles of consumer protection, the protection of minors, and the fair design of digital services.

This change is primarily due to the development of the digital economy. The mechanisms used by game producers are increasingly based not on traditional product sales, but on long-term user engagement and gradual increase in spending through appropriately designed psychological solutions. This phenomenon is referred to in the literature as behavioral monetization, or monetization that leverages knowledge from cognitive psychology and behavioral economics. The goal of such mechanisms is not simply to facilitate a purchase, but to create an environment that encourages users to make subsequent purchasing decisions impulsively or emotionally.

Of particular importance in this regard are so-called dark patterns, referred to in Polish literature as manipulative or deceptive design patterns. These design solutions exploit the workings of human perception and decision-making processes to induce behaviors that are beneficial to the entrepreneur, but not necessarily aligned with the consumer’s true interests. In the case of loot boxes, these can take a variety of forms – from counters counting down the time until the end of a promotion, through messages about the limited availability of specific rewards, to elaborate animations that enhance the emotional experience of opening the packages.

These mechanisms are not coincidental. Psychological research indicates that a reward system based on a variable ratio reinforcement schedule is one of the most effective ways to maintain long-term user engagement. This same mechanism has been used for many years in classic gambling games, where the unpredictability of rewards maintains a high level of motivation for subsequent attempts. In the case of loot boxes, this mechanism is transferred to the computer gaming environment and combined with an attractive audiovisual setting and the ability to immediately make another purchase.

From the perspective of consumer protection law, a crucial question is whether the use of such solutions could lead to a violation of traders’ obligations arising from provisions on fair market practices. It should be noted that contemporary EU regulations increasingly place greater emphasis not only on the content of information provided to consumers, but also on the design of digital interfaces. Therefore, the subject of assessment is increasingly not the product or service itself, but rather the architecture of the purchasing process and the impact of the interface on the user’s freedom of decision-making.

Underage users are particularly important here. Both the European Commission and the European Parliament have repeatedly stated that children using digital services require a higher level of protection than the average consumer. This stems from their limited ability to assess economic risk and their greater susceptibility to persuasive techniques used by businesses. In practice, this means that solutions acceptable to adult users may be deemed disproportionate or unfair if they are primarily targeted at children and adolescents.

The importance of this issue has increased following the entry into force of Regulation (EU) 2022/2065 on the Digital Single Market (Digital Services Act – DSA). Although this act does not explicitly regulate lootbox mechanisms, it establishes a number of obligations regarding the design of digital services and the protection of users from practices that may negatively impact their decision-making autonomy. In particular, the DSA emphasizes the need to ensure a high level of protection for minors and limit the use of solutions that exploit the vulnerabilities of specific user groups. This trend indicates that future assessments of the legality of lootboxes will increasingly be conducted not only through the lens of gambling law but also taking into account consumer protection standards applicable in the digital environment.

In parallel, the European Commission is working on a legislative package known as Digital Fairness, which aims to adapt EU consumer protection regulations to the realities of the digital economy. Issues under review include manipulative design patterns, interface design that exploits user vulnerability, and mechanisms that exert excessive psychological pressure during purchasing decisions. Although the legislative work has not yet been completed, the direction of the proposed changes clearly indicates that future regulations may also cover monetization mechanisms used in video games.

The European Parliament also highlighted the need to enhance the protection of minors in its resolution of 26 November 2025 on the protection of children online. The document indicated that mechanisms such as loot boxes, in-game currencies, and other systems based on chance should be subject to special scrutiny from the perspective of protecting children from addictive and manipulative digital practices. While the resolution is non-binding, it provides an important political signal indicating the direction of future legislative action at the European Union level.

A separate but crucial element of the modern user protection system is the PEGI age rating. Starting in 2026, this system will adopt a more stringent approach to games featuring paid random mechanisms, recognizing them as solutions requiring a higher age rating. While the PEGI rating is not a source of law and does not in itself determine the legality of specific monetization models, it reflects a growing consensus on the need to provide greater protection for minors from mechanisms that utilize randomness and behavioral design techniques.

The above circumstances lead to the conclusion that the future of loot box regulation will likely be shaped primarily by regulations concerning consumer protection and digital services, rather than solely by traditional gambling law instruments. While the Gambling Act focuses on the qualification of specific business models, contemporary EU regulations increasingly assess the design of digital services and their impact on the autonomy of user decisions. Consequently, assessing the legality of loot boxes in the future will require comprehensive consideration of both gambling law and regulations concerning consumer protection, digital services, and children’s rights.

Approach of selected European countries to regulating loot boxes – a comparative analysis

The lack of a uniform definition of loot boxes in European Union law has led individual member states to develop different models for regulating this phenomenon. These differences concern not only the legal classification of random-based mechanisms but, above all, the assessment of the risks loot boxes pose to consumers, especially minors. As a result, the European Union currently boasts both countries adopting a very restrictive approach and jurisdictions that prefer to analyze individual business models rather than create separate statutory regulations.

Belgium has taken the most stringent stance for many years. The Belgian Gaming Commission has determined that certain lootbox mechanisms meet the criteria for gambling if the participant pays a fee, the outcome depends on chance, and the reward represents a specific economic value. Consequently, some game producers have decided to remove paid lootboxes from the Belgian market or significantly limit their functionality. This solution was primarily preventative in nature and aimed at limiting children and adolescents’ exposure to mechanisms that utilize randomness as a monetization tool .

The Dutch experience was different. For many years, the Dutch supervisory authority took a similar stance to the Belgian one, deeming certain lootbox models to be in violation of gambling regulations. The dispute concerned one of the most popular monetization models used by Electronic Arts became the subject of years of administrative and court proceedings. However, the final rulings demonstrated that the classification of loot boxes cannot be based solely on the presence of an element of randomness, but requires consideration of the overall economic structure of the game, the method of trading virtual goods, and the actual potential for financial gain for the user. The Dutch experience thus highlighted the difficulties associated with applying traditional definitions of gambling law to new business models operating in the digital economy.

At the opposite extreme is the approach adopted in Poland. To date, Polish lawmakers have not decided to create separate regulations regarding loot boxes or introduce a statutory definition. This means that the assessment of individual models is based on applicable gambling regulations and an analysis of the specific factual circumstances. This approach provides administrative bodies with significant interpretative flexibility, but also limits predictability for businesses operating in the digital market.

The practice of Polish authorities indicates that a functional assessment of the specific business model is crucial. In the case of platforms enabling the use of virtual items as a means of participating in games of chance, authorities may apply the instruments provided for in the Gambling Act, including entry into the Register of Domains Used to Offer Gambling Games Contrary to the Act. However, this does not automatically mean that all loot boxes used in computer games are illegal. The Polish model is therefore based on an analysis of the economic impact of a given solution, not on an abstract assessment of the randomness mechanism itself.

An analysis of the solutions adopted in individual countries leads to the conclusion that what is becoming increasingly important is not simply classifying loot boxes as gambling, but rather protecting consumers from the psychological mechanisms that lead to excessive spending or compulsive behavior. Therefore, many countries are beginning to perceive the loot box problem as an issue that goes beyond traditional gambling law and requires the use of instruments appropriate to consumer law and digital market regulation.

This approach also aligns with actions undertaken at the European Union level. The European Commission and the European Parliament increasingly point out that the fragmentation of national regulatory models can lead to uneven levels of user protection in the digital single market. The global nature of game producers’ operations means that businesses operate simultaneously in multiple markets, adapting their business models to the most stringent requirements in force in individual countries. In practice, this means that future legal solutions will likely aim for greater harmonization of consumer protection standards at the EU level.

However, this doesn’t mean a complete ban on loot boxes is necessary. A much more likely approach would be to introduce requirements regarding the transparency of random mechanisms, the publication of actual reward probabilities, more effective age verification of users, and restrictions on the use of solutions that exploit the vulnerability of children and adolescents to persuasive techniques. Such a regulatory model would preserve the possibility of using micropayments as a legal method of financing computer games while simultaneously strengthening consumer protection.

From the perspective of Polish law, the experiences of other European countries have significant interpretative significance. They demonstrate that mechanisms operating at the intersection of gambling and digital services cannot be assessed solely through the lens of classic legal constructs developed for traditional casinos or lotteries. The development of the digital economy requires a more comprehensive approach, taking into account both the economic significance of virtual goods and the impact of interface design on consumer decisions. Consequently, the future model for regulating loot boxes will likely be based on a combination of instruments from gambling law, consumer protection law, and regulations governing digital services, rather than the exclusive application of one of these legal regimes.

Conclusions de lege lata and postulates de lege ferenda

The analysis leads to the conclusion that current Polish law does not allow for a uniform legal classification of all lootbox mechanisms. Despite the growing number of voices calling for the recognition of lootboxes as a form of gambling, the current legal status does not provide a basis for automatically subjecting this entire product category to the provisions of the Gambling Act of 19 November 2009. Each assessment requires consideration of the actual operation of the specific business model, the nature of the prize, the potential for further turnover, and the economic impact of user participation in the random mechanism.

This doesn’t mean, however, that the current regulations remain entirely insufficient. With respect to some models operating on the market – particularly platforms that use virtual items as a means of participating in games of chance or enabling their exchange for cash – current regulations may be applicable. The practice of administrative bodies to date demonstrates that the Gambling Act remains an instrument that helps counteract the riskiest forms of activity, especially when virtual goods begin to function as an equivalent of money or property.

At the same time, it’s important to note that the vast majority of modern loot boxes don’t pose a classic gambling law problem. Their primary purpose isn’t to organize games of chance in the traditional sense, but to create a monetization model that leverages psychological mechanisms that increase user propensity to make subsequent purchases. For this reason, the current regulatory debate is increasingly shifting from gambling law toward consumer protection law and the regulation of digital services.

It seems that this is precisely the direction that Polish lawmakers should also adopt. Attempting to classify all loot boxes as gambling would oversimplify the extremely diverse digital market. A much more rational solution seems to be creating separate regulatory obligations for mechanisms that utilize randomness, without the need for automatic application of the entire gambling law regime.

First and foremost, it seems reasonable to introduce full transparency into random mechanisms. Before making a purchase, users should be able to familiarize themselves with the actual probability of winning individual prizes, how the randomization algorithm works, and whether this probability remains constant for all participants. Such solutions already exist in some computer games, but currently they are primarily driven by voluntary decisions by businesses or requirements in specific foreign markets.

The second direction of change should be to strengthen the protection of underage users. In light of current psychological knowledge and the positions of EU institutions, there is little doubt that children are particularly susceptible to the influence of mechanisms based on a variable reward system. Therefore, it seems reasonable to consider limiting the ability of people under a certain age to purchase paid loot boxes or introducing mandatory parental control mechanisms to effectively manage minors’ expenses.

Regardless of the above, legislators should consider introducing more detailed regulations regarding third-party platforms enabling the trading of virtual items. It is this market segment that currently raises the greatest concerns from the perspective of consumer protection and compliance with the Gambling Act. In particular, situations in which items obtained in-game become a means of participation in subsequent games of chance or can be directly converted into cash require analysis. In such cases, the line between a digital service and gambling activity becomes significantly blurred, justifying the application of more restrictive oversight measures.

Obligations regarding marketing activities should also be a crucial element of future regulations. In practice, loot boxes are primarily promoted through influencers and online creators, whose audiences often include minors. While advertising collaborations in and of themselves cannot be deemed unacceptable, situations in which marketing messages exclusively emphasize the possibility of winning exceptionally valuable prizes, disregarding the actual probability of winning them, or employing techniques that could create unreasonable expectations among recipients regarding potential benefits, require special consideration. In this regard, both consumer protection regulations and regulations regarding the integrity of advertising messages may apply.

The issues presented demonstrate that the issue of loot boxes is not limited to gambling law. In fact, it exemplifies a much broader phenomenon involving the use of advanced digital design techniques to influence users’ economic decisions. Technological advancements increasingly render traditional private and public law frameworks inadequate for assessing new business models based on user behavior analysis and interface design that maximizes consumer engagement and spending.

Consequently, the future of loot box regulation will likely depend less on further expansion of the definition of gambling than on the development of European consumer protection standards in the digital environment. Regulations on the transparency of digital services, countering manipulative design patterns, and ensuring a high level of protection for children using the internet are becoming increasingly important . These instruments may become the primary tool for mitigating the risks associated with loot box operations in the coming years.

It should therefore be assumed that effective regulation of this phenomenon requires a multifaceted approach, combining instruments of gambling law, consumer protection law, and digital market regulation. Only such a comprehensive solution will achieve the right balance between the freedom of game producers to conduct business and the need to ensure a high level of protection for users, particularly children and adolescents, who remain most vulnerable to the negative effects of random-based mechanisms.

Artykuł Lootboxes in Computer Games – Between Gambling Law and Consumer Protection. Regulatory Analysis Against the Background of Polish and European Union Law. pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

We are pleased to share that Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, one of Poland’s leading legal and financial publications, devoted to one of the most intriguing regulatory phenomena of the digital economy: loot boxes in video games.

“Loot boxes in video games: between gambling law and consumer protection – a regulatory analysis under Polish and European Union law”

The article goes far beyond the classic “are loot boxes gambling?” debate. By analysing the actual monetisation models used in modern games — particularly microtransactions involving paid acquisition of virtual packages with randomised content — we examine how these mechanisms interact with:

• Polish gambling law and the statutory definition of a game of chance,
• EU consumer protection rules,
• digital services regulation,
• taxation and compliance considerations,
• and emerging concerns related to behavioural design and dark patterns.

One of the key conclusions is that the regulatory importance of loot boxes stems not only from their possible resemblance to gambling mechanisms, but also from the fact that such systems are frequently used by inexperienced consumers, including minors, who may be especially susceptible to manipulative design techniques aimed at increasing engagement and spending.

This is precisely the type of cross-sector regulatory issue in which our team has extensive experience — combining expertise in technology law, highly regulated industries, digital services, compliance, consumer protection and EU regulatory frameworks. We are proud that this experience is reflected in publications appearing in professional journals such as Infor.

Read the article here: Infor – Loot boxes in video games: between gambling law and consumer protection

Artykuł Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, devoted to loot boxes in video games pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The phenomenon of fake reviews in the digital space has evolved from a marginal image issue to a central focus of market supervision authorities and EU legislators. The contemporary ontology of this phenomenon extends beyond primitive content fabrication to encompass any form of communication that, by distorting the actual consumer experience, misleads the recipient, directly influencing their decision-making process. Legally, a fake review is considered not only a completely false message, but also one that, by omitting important facts or manipulating context, creates a false impression of the quality of a product or the reliability of a seller. This practice is classified as unfair commercial activity if its nature causes or is likely to cause the average consumer to make a transactional decision they would not otherwise make, thus violating the fundamental principles of fair dealing.

The typology of activities considered unfair rests on several fundamental pillars, the most blatant of which is direct fabrication. This involves posting or commissioning the creation of false recommendations from specialized external entities, such as marketing agencies, which directly violates regulations on combating unfair market practices. Another mechanism is selective manipulation, in which a business intentionally manages the visibility of reviews by removing, concealing, or delaying the publication of negative reviews while favoring positive ones. Such action distorts the image of actual customer satisfaction and is considered misleading regarding the essential characteristics of a product or service. An equally significant aspect is feigned verification, i.e., declaring that reviews come from real buyers without implementing proportionate and reasonable steps to verify their authenticity, which constitutes a direct violation of the disclosure obligations imposed by the Omnibus Directive.

Contemporary market practices have also evolved more subtle forms of manipulation, such as astroturfing, which involves creating artificial social support through employees or store owners posing as independent consumers. These activities often involve the manipulation of user profiles, where images generated by artificial intelligence algorithms are used to authenticate fictitious accounts, creating false social proof. Each of these practices, regardless of their technological sophistication, is subject to strict scrutiny by competition and consumer protection authorities.

The role of the President of the Office of Competition and Consumer Protection and the responsibility of management boards

The President of the Polish Office of Competition and Consumer Protection (UOKiK) serves as a central regulator in the legal system, endowed with rigorous powers to counteract violations of collective consumer interests. The main disciplinary instrument at the authority’s disposal is an administrative fine, which can be imposed in the amount of 10% of the turnover achieved by the entrepreneur in the financial year preceding the year of issuance of the decision. The amount of the fine is not determined arbitrarily, but rather results from precisely defined criteria, which include, above all, the scale of the violation, its duration, and the degree of intentionality of the perpetrator. Importantly, this fine is intended to serve not only a repressive function but, above all, a preventive and deterrent one, discouraging other market participants from engaging in similar unfair practices involving the manipulation of reviews or misleading as to the authenticity of reviews.

The enforcement procedure in consumer matters is designed to ensure high effectiveness of supervisory activities. A business subject to a sanction is obligated to settle the fine within 14 days of the decision becoming final, which directly contributes to the state budget. A crucial procedural element is the prejudicial nature of the decisions of the President of the Office of Competition and Consumer Protection (UOKiK), which means that the authority’s findings regarding violations of the law are binding on common courts in compensation cases brought by injured customers. This legal structure significantly facilitates consumers in pursuing civil claims, as they do not have to prove the illegality of the store’s actions, focusing solely on demonstrating the damage suffered. The office’s activity in recent years, reflected in numerous proceedings against e-commerce leaders, confirms that protecting the transparency of reviews has become a regulatory priority, translating into real and severe financial consequences for violators.

The contemporary model of liability in consumer protection law departs from a concept focused solely on the business entity, shifting the burden of sanctions also to individuals who actually manage the enterprise. The President of the Office of Competition and Consumer Protection (UOKiK) has the authority to impose a personal fine of up to PLN 2,000,000 on a manager. This liability is triggered by demonstrating that the manager has intentionally allowed – through their actions or conscious omissions – the company to violate collective consumer interests. In case law, the degree of management involvement in decision-making processes regarding marketing and communications is crucial. This liability may therefore affect a management board member who approves a budget for obtaining reviews from external opinion farms or ignores the lack of implementation of verification procedures under the Omnibus Directive, despite being aware of such deficiencies.

It should be emphasized that the responsibility of managers is autonomous and independent of any penalty imposed directly on the entrepreneur. This is intended to provide a strong incentive for management to build internal compliance structures and actively oversee the entity’s operational ethics. In the era of digitalization of trade, where algorithms and automation of marketing processes can generate violations on a massive scale, the personal financial risk of managers is intended to compel prioritizing compliance as the foundation of business strategy. Therefore, the systemic fight against false reviews is implemented not only through sanctions against corporate structures but also by disciplining those who actually shape companies’ market policies. This, according to the legislature, is intended to ensure long-term improvement in integrity standards in electronic trading.

The Omnibus Directive and the blacklist of market practices

The implementation of the Omnibus Directive into the Polish legal system significantly redefined transparency standards in e-commerce, introducing mechanisms that directly address the systemic manipulation of consumer reviews. A key instrument in this regard is the so-called blacklist of market practices, which constitutes a catalog of behaviors considered unfair in all circumstances, eliminating the need for supervisory authorities to conduct a case-by-case analysis of the consequences of a given action. Classifying these market torts as unfair practices aims to eliminate evidentiary difficulties, as their mere existence exaggerates the entrepreneur’s wrongdoing. This legal framework not only strengthens the consumer’s position but, above all, simplifies the evidentiary process, making the fight against e-commerce abuse more effective and predictable for market participants. The foundation of the new regulations is an absolute prohibition on manipulating the verification and authenticity of product recommendations, which imposes an active obligation on sellers to implement procedures to verify the origin of reviews.

Under the current wording of the regulations, it is considered an unfair market practice for a trader to claim that product reviews were posted by consumers who actually used or purchased the product, in situations where reasonable and proportionate steps were not taken to verify their authenticity. This practice violates the consumer’s right to reliable information, which is essential for making an informed decision about purchasing the product, and violating it constitutes conduct contrary to good practice. The law prohibits not only posting completely false reviews, but also commissioning third parties to create them, or transferring recommendations between products with different parameters, which is referred to as review hijacking. Other offenses listed in the catalog are treated equally severely, such as using false quality certificates without appropriate authorization or using surreptitious advertising, which involves using editorial content to promote a product without clearly identifying the paid nature of the communication. Aggressive techniques are also considered particularly burdensome, including mass spamming and forced selling, which involves demanding payment for products delivered to the consumer without their prior order.

The blacklist also eliminates techniques such as bait advertising and direct persuasion of children to purchase, which aims to protect the integrity of the consumer decision-making process from manipulation. This protection of minors stems from their particular vulnerability to advertising messages and their inability to critically assess the persuasive nature of commercial offers. Expanding the list to include a ban on posting or commissioning another person to post false reviews for the purpose of promoting products significantly complements the system, preventing brands from using agencies that fabricate social evidence. It is emphasized that any form of distortion of the actual image of a product’s popularity constitutes a violation of the collective interests of consumers, which entitles the President of the Office of Competition and Consumer Protection (UOKiK) to intervene under public law as soon as a threat to the interests of all market users arises.

A particularly significant and painful consequence of these unfair techniques for entrepreneurs is a specific civil law sanction in the form of an extended right of withdrawal from the contract. If an e-store engages in practices listed in the prohibited catalog or fails to comply with information obligations regarding review verification, the statutory return period granted to the buyers is extended from 14 days to a full 12 months. This mechanism is a direct consequence of the assumption that, in the absence of reliable information, the consumer could not have expressed a fully informed intention to purchase, which suspends the running of standard mandatory deadlines. Systematic combating of review fraud and the use of black market practices is therefore becoming not only a matter of business ethics but the foundation of legal security and stability for every entity operating in the e-commerce sector. Neglect in transparency can lead to mass claims for refunds, posing a real threat to the operational liquidity of the company.

Manipulation Architecture and Platform Obligations under the Digital Services Act (DSA)

The phenomenon known as dark patterns constitutes a sophisticated form of interference in the user’s decision-making process, based on the deliberate use of interface architecture to distort their autonomy of will. Manipulative design patterns are not merely a manifestation of aggressive marketing, but a systematic designer’s action aimed at inducing a specific cognitive bias in the consumer, which ultimately leads to a purchase decision they would not have made in conditions of full transparency. The psychological foundation of these actions is the use of heuristics, i.e., simplified rules of reasoning and automatic thinking, which in the fast-paced environment of e-commerce transactions make the user susceptible to subliminal suggestions. This phenomenon has evolved from simple forms of persuasion to advanced interface manipulation, where the line between inducement and fraud is deliberately blurred to maximize conversion at the expense of the interests of the weaker party in the legal relationship.

A particularly significant area of application of these practices is the system for presenting reviews and suggesting their authenticity, where manipulation takes the form of so-called interface interference. Businesses often employ patterns involving selective content display, which in practice means deliberately hiding negative reviews on subsequent pages of the website while simultaneously highlighting only enthusiastic reviews on the product’s home page. This practice violates the model of the average consumer, who has the right to expect that the image presented of a product’s popularity and quality is reliable and has not been subjected to arbitrary filtering. Manipulation in the sphere of social evidence also includes fabricating popularity indicators, such as false messages about the number of people viewing a given product at a given time or false offer duration counters, which create an artificial sense of scarcity in the user and pressure them to immediately close the transaction. Under the Polish Act on Combating Unfair Market Practices, these activities may be classified as misleading because they distort the actual market conditions, preventing a rational comparison of offers.

Another dimension of manipulation is the technique known as confirmation shaming, which in the sphere of opinion writing involves the use of evaluative and emotional language to coerce users into specific behaviors, for example, through unsubscribe buttons suggesting a lack of consumer awareness. These practices are closely related to the “roach motel model”, where the process of issuing a favorable review is simplified to the maximum extent, while editing, reporting an error, or deleting content requires navigating a complex subpage structure, which is intended to discourage users from correcting false information. In the legal context, such procedural barriers are considered burdensome impediments that violate good practice and the principle of commercial fairness. An analysis of case law and the positions of supervisory authorities indicates that an interface that deliberately hinders users from exercising their rights or changing their minds loses its neutrality and becomes a tool for harming consumer interests.

A fundamental change in the regulatory sphere was brought about by the entry into force of the EU Digital Services Act (DSA), which, in Article 25, explicitly prohibits online platform providers from designing, organizing, and operating interfaces in a way that misleads or manipulates service users. This regulation is overarching and complements the existing consumer protection framework by introducing a direct obligation to maintain neutrality in choice architecture and prohibiting structures that significantly impede users’ ability to make free and informed decisions. Violation of this prohibition entails not only civil law risks but also severe administrative sanctions, which can amount to a significant percentage of the business’s global turnover.

In the sphere of law enforcement, the key role is played by the model design of the average consumer, who is observant and cautious but lacks specialized knowledge of the psychological mechanisms used in interface design. This protection is preventative and abstract in nature, meaning the President of the Office of Competition and Consumer Protection (UOKiK) can intervene in situations where the mere existence of a manipulative pattern poses a real risk of distorting market behavior, without having to wait for measurable financial damage to a specific individual. Effectively combating dark patterns requires businesses not only to comply with the law but, above all, to shift to a design model focused on reliability, where all product information, including opinions, is presented free from coercive mechanisms. Ultimately, interface transparency is becoming a prerequisite for maintaining trust in the digital economy, and the use of sophisticated forms of manipulation is perceived as highly harmful to society, subject to strict assessment in light of the principles of social coexistence.

New obligations for marketplaces regarding moderation and transparency

The entry into force of Regulation 2022/2065, known as the Digital Services Act (DSA), represents a fundamental shift in the liability paradigm for intermediary service providers, particularly marketplaces. This regulation shifts the emphasis from passive content hosting to active oversight of the transparency and security of the digital system, introducing rigorous operational standards aimed at eliminating illegal content while respecting users’ fundamental rights. A key pillar of this reform is the formalization of moderation processes, which until now were often subject to arbitrary internal platform decisions and are now subject to strict procedural rigors contained in the notice-and-action mechanism. Under the DSA, each platform is required to provide easily accessible and user-friendly tools for identifying potentially illegal content, including fake reviews or infringing offers. The mere receipt of a report obliges the provider to promptly and objectively address it.

The evolution of moderation obligations is inextricably linked to the requirement for transparency in decisions, which is achieved through the justification mechanism provided for in the EU regulation. When a marketplace decides to remove content, limit its visibility, or suspend a user’s account, the user is absolutely obligated to provide clear and specific reasons for such action, which is intended to prevent abuse by blocking reliable reviews that are unfavorable to the seller. This system is complemented by a mandatory internal complaint handling system, which allows users to appeal moderation decisions free of charge within a period of at least six months. This constitutes an important procedural guarantee and allows for the correction of potential algorithmic errors. It is indicated that such a legal framework is necessary to counteract the fragmentation of consumer protection, which previously relied primarily on general national clauses that were unsuitable for the scale of operations of global digital entities.

A significant innovation introduced specifically for trading platforms is the “Know Your Business Customer” (KYBC) principle, regulated in the chapter on marketplace transparency. These entities are charged with collecting and verifying information about traders offering their products through their interfaces, including registration data, payment account numbers, and declarations of commitment to offer goods in compliance with EU law. This mechanism aims to eliminate the phenomenon of anonymous sellers, who often promote defective products using fabricated reviews and, after raising capital, disappear from the market, avoiding legal liability. The platform is obligated to suspend services for sellers who fail to submit the required documents, making the marketplace an active guardian of the legality of trade, rather than merely a passive intermediary in trade.

The scope of transparency obligations extends beyond relationships with individual users to include public reporting through the periodic publication of transparency reports. These documents must include detailed data on the number of orders received from national authorities, statistics on content moderation initiated by the platform itself, and information on the use of automated tools in verification processes. For very large online platforms, these rigors are even stricter, including the obligation to conduct annual audits and systemic risk assessments, including analysis of the interface’s vulnerability to manipulation that could negatively impact public safety or consumer protection. The systemic fight against disinformation and unfair market practices is therefore anchored in the full transparency of operational processes, which allows supervisory authorities to continuously monitor the effectiveness of implemented security measures.

Supervision of compliance with these obligations is based on a new institutional architecture, in which national digital services coordinators, working closely with the European Commission, play a central role. The enforcement system for the adopted regulations is based on fines of up to 6% of a provider’s global turnover, which compels compliance with specific cybersecurity standards. This control system is designed to ensure that marketplaces not only implement the required procedures but also apply them reliably and uniformly across the European Union, which is crucial for building consumer confidence in cross-border trade. The introduction of these standards ends the phase of full regulatory freedom for platforms, imposing on them real responsibility for shaping the environment in which the modern exchange of goods and services takes place.

Technological verification mechanisms and modern operating models

Authenticity Suggestion and Pressure Mechanisms

The evolution of digital market oversight has led to the development of mechanisms in which traditional legal instruments are increasingly being replaced by algorithmic jurisdictions based on advanced artificial intelligence systems. The phenomenon known as AI exclusion is a modern form of sanction that, for e-commerce entities, can prove more severe than traditional financial penalties imposed by administrative bodies. The foundation of this process is the integration of data on the credibility of reviews directly with positioning parameters in ranking systems, which means that transparency is no longer merely an ethical obligation but a condition for the technical visibility of an offer. Recommendation algorithms operating within platforms such as Google and Amazon constantly analyze behavioral and linguistic patterns to identify anomalies suggesting manipulation of social evidence. These systems are currently capable of recognizing the structure of texts generated by LLM language models, which are characterized by a specific repetition of phrases and a lack of emotional details typical of authentic consumer experiences. An additional risk factor subject to automatic verification is the so-called review growth rate, where a sudden jump in the number of positive ratings without correlation with actual website traffic or sales volume is interpreted by AI as a warning signal initiating restrictive procedures.

The consequences of an online store being classified by AI systems as posing a high risk of manipulation are immediate and often irreversible in the short term. This mechanism, known in market practice as shadow banning or de-indexing, leads to a drastic decline in visibility in search results and the blocking of offers in advertising systems, effectively cutting the entrepreneur off from key customer acquisition channels. Under the provisions of the Digital Services Act, providers of very large online platforms are required to maintain particular transparency regarding the parameters used in recommendation systems. Article 27 of the aforementioned regulation requires platforms to clearly define in their regulations the key parameters determining information ranking, which aims to limit algorithmic arbitrage and enable entrepreneurs to understand the reasons for a potential decline in their market exposure. It is worth noting that modern risk assessment systems may be classified as high-risk systems within the meaning of the Artificial Intelligence Regulation, which imposes strict requirements on their creators regarding human oversight and the prevention of algorithmic discrimination.

In parallel to restrictive systems, a paradigm known as agentic commerce is developing, in which purchasing processes are carried out by autonomous AI assistants acting directly on behalf of the consumer. In this model, traditional product reviews cease to serve as persuasive texts for humans and become raw input data for machines that filter the market in search of offers with the highest level of verified trust. A key element of this new commerce architecture is the so-called trust layer, built on protocols such as the Universal Commerce Protocol promoted by Google or the Agentic Commerce Protocol developed by OpenAI. These systems are guided not only by price or availability of goods but above all by the certified credibility of the seller’s data, automatically rejecting offers from entities that lack a clear digital traceability of their recommendations. The collaboration of AI assistants with secure payment systems, such as the Agent Payments Protocol, creates a closed ecosystem in which offers at risk of manipulation are excluded at the initial algorithmic selection stage, before they are even presented to the user.

In the era of agent-based commerce, the role of modern shopping assistants is becoming dominant, forcing businesses to redefine their credibility-building strategies. The Context Protocol model and other open-source solutions enable the exchange of context between various AI models and commerce systems, allowing information about unfair practices by a single store to be instantly shared across the entire assistant network. The doctrine suggests that this systematic approach to eliminating abuse is a natural response to the technological ease of fabricating content online. For an e-commerce store, losing its trustworthy status in the eyes of Google or OpenAI algorithms means the modern equivalent of server shutdown, as AI assistants, protecting the interests of their users, will systematically bypass offers that generate manipulative signals. Thus, the fight for authenticity is no longer a mere compliance issue but an existential foundation in the new, automated e-commerce environment, where barriers to entry into the trust layer are becoming increasingly difficult for entities employing pressure mechanisms and suggesting false authenticity.

Compliance as a Service and the Digital Feedback Path

The rapid evolution of the e-commerce market and the increasing professionalization of unfair market practices have forced entrepreneurs to abandon a reactive reputation management model in favor of proactively building a digital immune system. The scale of the challenge facing modern e-commerce is illustrated by analyses of the systematic erosion of trust in the digital sector, pointing to the prevalence of fake reviews and consumer concerns about the mass implementation of generative artificial intelligence for opinion fabrication. This state of affairs creates decision paralysis, where an overabundance of unreliable information, instead of supporting the purchasing process, becomes an insurmountable barrier.

The economic impact of the lack of reliable content verification is directly measurable and translates into tangible operational losses for businesses. The literature emphasizes that exposure to manipulated reviews drastically reduces purchase intentions and brand trust, generating measurable financial losses. The information vacuum filled with false enthusiasm also leads to a phenomenon known as post-purchase dissonance, in which a product that fails to meet expectations is returned to the seller as a complaint or contract withdrawal. Consequently, the lack of investment in transparent review processes generates hidden logistical and operational costs that, in the long run, may outweigh the gains achieved through the temporary increase in conversions driven by manipulation.

In response to increasing regulatory rigor, including the Omnibus Directive, the Digital Services Act (DSA), and the AI Act framework, an operational model known as Compliance as a Service (CaaS) has emerged in market practice. It involves fully outsourcing compliance processes to specialized technology providers who take over the burden of monitoring and verifying content in accordance with current regulations. CaaS allows for the automation of data oversight, which is essential in an environment where the volume of incoming reviews precludes manual oversight without risking accusations of disproportionality. In this approach, compliance ceases to be merely an administrative cost and becomes a component of a strategy for building brand value by guaranteeing the authenticity of every customer touchpoint.

The foundation of the Compliance as a Service model is the maintenance of clean data and the generation of an indisputable digital trace of the review’s provenance. Every published review should be accompanied by a log containing metadata regarding the specific transaction, a unique order number, and delivery status, creating auditable proof of authenticity that can be presented during inspections by supervisory authorities such as the President of the Office of Competition and Consumer Protection. This digital reconstruction of the review process provides the most effective legal shield for businesses, eliminating the risk of allegations of unfair market practices. In the era of algorithmic jurisdiction, where ranking systems favor content supported by digital evidence, having a certified trace of data provenance is becoming a prerequisite for maintaining the market visibility of an offer.

Parallel to technical verification, modern review management systems integrate mediation mechanisms that allow for the amicable resolution of disputes before they are publicly expressed. Market experience suggests that implementing structured review processes allows for the amicable resolution of a significant portion of consumer disputes, effectively preventing the publication of negative reviews resulting from logistical errors. This approach aligns with the principles of reliability and good market practices, building customer relationships based on dialogue rather than solely on the one-way transmission of ratings.

Transaction verification is now becoming the market standard, replacing open, abuse-prone review sections with a system of unique invitations sent only after a purchase is completed. The literature emphasizes that restricting the review process to those who actually purchased the product is the simplest and most effective way to comply with the obligations imposed by the Omnibus Directive. This not only minimizes the risk of severe financial penalties, but above all, provides AI shopping assistants with reliable input data, which, in the new agent-based commerce paradigm, will determine the viability of each entity in the e-commerce ecosystem.

Artykuł Faking reviews in e-commerce – analysis of new legal regulations, algorithmic mechanisms and market practices in the e-commerce sector pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.