The Biggest US Legal Challenge to Loot Boxes Didn't Come From New York. It Came From Washington State.

The Biggest US Legal Challenge to Loot Boxes Didn't Come From New York. It Came From Washington State.

In October 2016, a letter landed on Valve Corporation's desk in Bellevue, Washington. Not from the FTC. Not from the New York Attorney General. It was from the Washington State Gambling Commission, and it demanded that one of the most powerful companies in gaming explain how it wasn't running an illegal gambling operation.

That letter, sent by Chris Stearns, then Commissioner at the WSGC, kicked off the most significant US legal confrontation over virtual item gambling to date. If you've been following the loot box debate thinking the big showdown was between Valve and some east coast regulator, you've been reading the wrong story.

→ Related: No, Valve Didn't Confirm a New Steam Machine. Here's What's Actually Happening.

The Skin Economy That Built an Underground Casino

To understand why Washington State went after Valve, you need to understand what CS:GO skins actually became.

CS:GO weapon skins are cosmetic items. They don't affect gameplay. But Valve did something clever and, in hindsight, reckless: they built the Steam Community Market, a platform where players could buy and sell these skins for real money. A rare knife skin could fetch hundreds or thousands of dollars. Valve took a cut of every transaction.

So skins stopped being cosmetic. They became liquid assets with real-world value. And where there's liquid value, gambling follows. Every time.

As Luke Plunkett documented at Kotaku in a 2022 investigation, a whole ecosystem of third-party gambling sites grew around CS:GO skins. These sites used Valve's Steam API, the same interface that lets legitimate services verify item ownership, to let users deposit skins, bet them on coin flips, roulette wheels, and esports match outcomes, then withdraw winnings. The skins functioned exactly like casino chips.

Eilers & Krejcik Gaming estimated the CS:GO skin gambling market was worth billions annually at its peak. Whether the exact figure was $2 billion or $5 billion depends on who you ask, but the scale was staggering. And many of the users were minors. No age verification. No regulatory oversight. Just a Steam account and skins in your inventory.

I've been building software for over fourteen years, and I've watched platform APIs get used in ways their creators never imagined. But Valve's situation was different. The Steam API wasn't being exploited through some obscure vulnerability. It was being used exactly as designed. The gambling sites just found a use case Valve either didn't anticipate or chose to ignore.

The WSGC Drops the Hammer

On October 4, 2016, Chris Stearns and the Washington State Gambling Commission sent Valve a formal demand. As Taylor Soper reported at GeekWire, the WSGC ordered Valve to "stop facilitating the use of 'skins' for gambling activities" through its Steam platform.

The Commission's argument was blunt: Valve's platform was the infrastructure that made skin gambling possible. Without the Steam API to verify ownership and transfer items, the gambling sites couldn't function. The WSGC treated Valve not as a bystander but as a facilitator.

This was a big deal. Washington State is Valve's home state. The WSGC had direct regulatory authority. And unlike a federal investigation that could drag on for years, a state gambling commission can move fast and hit hard.

Valve's response, as reported by Kyle Orland at Ars Technica, was textbook legal deflection. Three arguments:

1. Valve doesn't operate gambling sites
2. Valve has no business relationship with gambling sites
3. The gambling sites violate Steam's Terms of Service

Translation: we built the highway, but we're not responsible for the bank robbers who drive on it.

The WSGC wasn't buying it. Their position was that Valve had the technical ability to shut down API access for gambling sites and had known about the problem for months, probably years, before doing anything meaningful about it.

This mirrors something I've seen over and over in platform engineering. When you build an API, you own the ecosystem it enables. Period. The lesson from the AWS us-east-1 outage applies here: when your platform is the foundation, your blast radius is everyone who builds on top of it. Valve built a marketplace API with real-money implications and then acted shocked when someone built a casino on it.

The Three-Part Legal Test That Changes Everything

The legal question underneath the Valve case sounds simple: is a loot box gambling?

As Adi Robertson reported at The Verge in 2018, US gambling law generally requires three elements: consideration (you pay something), chance (the outcome is random), and a prize with real-world value.

Loot boxes nail the first two. You pay money. You get a random item. The whole fight comes down to the third element: does that random virtual item count as a "prize with value"?

For CS:GO skins, obviously yes. Skins trade on the Steam Market for real dollars. Rare skins sell for thousands. The WSGC's entire case rested on this. These aren't just pixels. They're assets.

But here's where the broader loot box debate gets messy. Not every game has a marketplace. Overwatch loot boxes give you cosmetics you can't sell. Are those gambling? The items have no cash-out mechanism. Under the traditional legal test, probably not.

This distinction is everything. A company can sell randomized virtual items all day long, and as long as there's no way to convert those items back to cash, they likely clear the legal bar in most US jurisdictions. Valve's problem wasn't loot boxes. It was that they built a cash-out mechanism right into the platform.

The legal line isn't between random and non-random. It's between items you can sell and items you can't. That's the distinction regulators keep coming back to.

Same tension as Microsoft's Xbox strategy contradictions. Valve wanted an open marketplace to drive engagement. That openness is exactly what turned their platform into gambling infrastructure.

What Valve Actually Did (And Didn't Do)

After the WSGC pressure, Valve started sending cease-and-desist letters to over 20 third-party gambling sites, demanding they stop using the Steam platform for gambling operations. Some sites shut down. Others moved offshore or found workarounds.

Valve also tweaked the Steam API to restrict how third-party services could interact with user inventories. But they didn't shut down the marketplace. They didn't kill the ability to trade skins for real money. The economic plumbing that made skin gambling possible stayed intact.

The WSGC never formally prosecuted Valve. The whole thing ended in a standoff: Valve took just enough action to avoid a lawsuit, and the fundamental questions about platform liability went unanswered.

This is the part that frustrates me. 2016 was the moment US regulators had Valve dead to rights, in their own state, with a clear legal theory. And it ended with cease-and-desist letters and API tweaks. Not precedent. Not case law. Nothing that would stop the next company from doing the same thing.

The Global Ripple Effects

The Washington State case wasn't happening in a vacuum. It was the most prominent US action, but the global picture tells a bigger story.

Belgium's Gaming Commission declared loot boxes to be gambling in 2018, forcing EA to remove FIFA Ultimate Team packs from sale in the country. The Netherlands Gaming Authority hit EA with a €10 million fine over FIFA loot boxes. EA challenged it, and in March 2022 the Dutch Council of State actually ruled in EA's favor, overturning the penalty. The court found that individual loot box items didn't constitute a standalone game of chance under Dutch law.

That ruling was a huge win for the gaming industry and a gut punch for regulators. Even in Europe, where regulatory appetite is stronger, the legal definitions don't map cleanly onto how virtual economies actually work.

The UK? The Department for Digital, Culture, Media & Sport commissioned a report, held hearings, and ultimately didn't classify loot boxes as gambling. Australia has had similar debates with similar non-results.

Regulators everywhere see that something is off, but existing gambling laws weren't written for virtual items. And writing new ones means going to war with some of the most profitable companies in entertainment.

I've shipped enough features to know that the hardest problems are rarely technical. They're about incentives. Right now the incentive structure is stacked against regulation. Loot boxes generate billions. The companies profiting from them have armies of lobbyists. The regulators who might restrict them have limited budgets and laws that don't quite fit. That math doesn't resolve itself.

Where This Goes Next

The skin gambling fight isn't over. It's just entering a new phase.

CS2, the successor to CS:GO, still has a thriving skin economy. New games keep launching with similar mechanics. And a generation of players who grew up depositing skins on gambling sites are now adults who see this as completely normal.

The most likely path forward isn't a single landmark ruling. It's a patchwork. Some countries will ban loot boxes outright (Belgium already has). Others will require probability disclosures (China and Japan mandate this). The US will probably keep its state-by-state approach, with occasional congressional hearings that generate headlines and zero legislation.

If you're building games or platforms with virtual economies, the same strategic tensions Nintendo faces with IP monetization apply here. The question isn't whether regulation is coming. It's whether you design your economy to survive it.

The Washington State Gambling Commission drew the first real line in the sand for the US back in 2016. Nearly a decade later, the legal framework for virtual item gambling is still a mess of half-measures and unresolved questions. Chris Stearns and the WSGC were right that something needed to change. They just didn't have the legal tools to force it.

The next major case won't be about whether skin gambling is gambling. That's settled. It'll be about whether the platforms that enable it bear responsibility for what gets built on top of them. That question goes way beyond gaming. And the answer will shape how every digital marketplace operates for the next decade.

Photo by Ivan Akimenko on Unsplash.