Andy Garcia · freelance dev
FRENES
Back to the blog
Games & Rules

PEGI Is Moving Existing Digital-Only Games With Loot Boxes Up to 16. Apple's Table Puts Them at 9+.

October 19, 2026 7 min read

On October 6, PEGI, the age rating system used in France and most of Europe, published a short note with a long reach. Digital-only games that are currently rated PEGI 3, 7 or 12 and feature paid random items, such as loot boxes, "will have their age rating updated to PEGI 16", with the descriptor Paid random items. The updates are performed "across all storefronts that use PEGI ratings", and PEGI adds that companies "will need to update their product listings and ensure that future marketing materials are up-to-date as well."

The rollout is under way. Connor Hinde, policy manager at the Games Rating Authority, which administers PEGI in the UK, wrote on LinkedIn that the GRA has begun applying the updated criteria to selected existing digital products. It covers games rated through the long-form PEGI Classic procedure and through the International Age Rating Coalition (IARC) system, and it "will continue to be rolled out progressively throughout October." GamesIndustry.biz reported his post on October 19.

I ship iOS apps and a strategy game, Doomsday: M.A.D., as an indie developer. The headline is about loot boxes. The part that matters to me is wider: in Europe, the shop design of a game and its age rating are now one decision, and a rating you already hold can change without you submitting anything.

What changed in June, and what changes now

PEGI announced the new criteria on March 12, for games submitted from June 2026. Its labels page now spells them out:

  • Paid random items: any offer where players "don't know exactly what they are getting prior to the purchase", bought with real money and/or exchanged for an in-game virtual currency, cosmetic or functional. PEGI 16, or PEGI 18 for social casino games.
  • Time-limited offers: purchases available for a limited time or in limited quantities. PEGI 12, or PEGI 7 if the game has built-in parental controls with spending turned off by default.
  • Cryptocurrency: NFTs or similar assets that are required to play, tradable, or central to the game. PEGI 18.
  • Pressure to play: daily quests, log-in streaks or event rewards that expire. PEGI 7, or PEGI 12 if players lose rewards or status when they do not return in time.
  • Unrestricted communication: chat that cannot be blocked or muted, with no moderation either. PEGI 18.

Until October, all of this applied only to new submissions. The October note is the retroactive part, and it is much narrower than the June list: one criterion, paid random items; one format, digital-only; one starting band, games rated 3, 7 or 12.

Why only loot boxes, and why only digital

PEGI director Dirk Bosmans gave the reasoning behind both limits to The Game Business in March, while PEGI was still working out what to do with older games.

On boxed games: "Ask any age rating board in the world and they'll tell you that with physical legacy products, don't touch them." A second print run with a different rating on the box would only confuse buyers.

On which criteria: "we've been tracking the presence of in-game purchases and paid random items for the last seven years, that gives us a very interesting database. That's different for the 'play-by-appointment' category. We have no information about which games from the past have certain mechanics like that."

So the scope follows the data. PEGI knows which older games sell paid random items, because it has been tracking them for seven years. It does not know which ones run daily streaks. As the October note is written, an older digital-only game with a punishing log-in streak keeps its rating. An older digital-only game rated 12 or below with paid card packs does not.

Digital is also where a rating can move quickly. IARC, the coalition behind the ratings shown on storefronts such as Google Play, PlayStation, Microsoft, Nintendo, Epic Games and Meta Horizon, issues ratings instantly from a questionnaire and says that "corrections, if needed, are promptly implemented using APIs with storefronts." Its FAQ is explicit that post-release changes are "far easier to accomplish in a digital environment than it would be with physical product sold in packages."

One mechanic, three ratings

Here is the part neither PEGI's note nor the GamesIndustry.biz report mentions. Apple's App Store, where my iOS apps ship, is not on IARC's list of participating storefronts. Apple generates its own rating from its own questionnaire. In its table for devices running iOS 26 or later, "Loot boxes" sit in the 9+ band, and that table applies in every region without its own requirements. Apple names a few regions that do have their own rules, Australia, Brazil and Korea among them. Australia moves loot boxes to 16+. France is not among the regions Apple lists with their own rules for iOS 26 or later.

In the United States, the ESRB said in March that it would not follow PEGI. Its spokesperson told The Game Business that ESRB already flags "In-Game Purchases (Includes Random Items)" as an interactive element, and that "there are currently no plans for ESRB to allow any factors outside of the content and context of a game to influence the age rating assignment."

Take a hypothetical digital-only cartoon puzzle game rated PEGI 7, with paid card packs, sold in France. Once its rating is updated, it shows PEGI 16 on Google Play and 9+ on the App Store, while its American listing keeps whatever age rating its content earned. Three systems, three answers, one mechanic.

The two big mobile stores agree on one thing. Apple's guideline 3.1.1 says apps offering loot boxes "must disclose the odds of receiving each type of item to customers prior to purchase." Google Play's payments policy asks for the odds "in advance of, and in close and timely proximity to, that purchase."

The size of the effect

PEGI built its criteria with the German board USK, which made similar changes in 2023. In PEGI's March release, USK's managing director Elisabeth Secker gave the German numbers: at least one new criterion applied to about 30 percent of games submitted since then, and around one in three of those got a higher age rating.

0.30 × 1/3 = 0.10. Roughly one submitted game in ten was rated higher in Germany because of criteria about how a game works, not what it shows. That is Germany's figure, not a PEGI forecast, but it gives the order of magnitude.

What a higher rating costs depends on the audience. PEGI's own page on parental control tools says that with them, parents can "select which games children are allowed to play (based on the PEGI age ratings)". A family that set a console to PEGI 12 will find a re-rated game above its line, whether or not anything in the game changed.

What I would check before shipping a monetised game in Europe

List every mechanic against PEGI's table, retention included. On a new submission, a daily reward alone moves a PEGI 3 game to 7. The Game Business reported in March that Pokémon Pokopia, rated PEGI 3, would have been PEGI 7 under the new system.

Decide what you sell, and how it is shown. PEGI's definition of paid random items turns on whether players know exactly what they get before paying, and it includes cosmetic items and items exchanged for virtual currency. A direct sale with visible contents falls outside that definition. The page does not distinguish currency players earn from currency they buy. On a borderline design, I would ask the PEGI Helpdesk before launch, not after a re-rating.

Use the levers the criteria give you. Spending turned off by default in built-in parental controls can take time-limited offers from 12 to 7. Rewarding players for coming back, rather than punishing them for staying away, keeps a streak at 7 instead of 12. Blocking, muting and moderation keep chat away from 18.

Treat a content update as a new submission. Google Play's content rating policy says that if you change your app's content or features in ways that affect the questionnaire answers, you must submit a new questionnaire. Adding a battle pass or a streak to a live game is that kind of change. I would assume the new answers are scored against the criteria in force at submission, not the ones the game launched under.

Audit the listing and the marketing. PEGI's note puts the update of product listings and future marketing materials on the company. Screenshots, trailers and press kits with a PEGI badge baked in are the easy ones to miss.

Keep one rating sheet across systems. Apple, PEGI through IARC, ESRB: one row per system, one column per mechanic, updated with every release that touches the shop.

A PEGI rating used to describe what a game shows. Since June, it also describes how the game sells, and since October, for paid random items, that reaches digital-only games already in the store. I would design the shop with the rating table open next to it.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk