Marsh
Mallow, Roblox put out something about "Paid Random Items." That sounds like loot boxes. Does it touch us if we're not making a gambling game?
Mallow
It touches you the moment your experience sells any randomized reward for money. The definition is broad: a Paid Random Item is anything bought with Robux — or with an in-game currency you bought with Robux — that yields a random outcome. Mystery boxes, gacha pulls, random crates, surprise bundles. Lots of brand experiences use exactly these mechanics for engagement. So yes, likely relevant.
Marsh
Okay. What changed?
Mallow
Roblox didn't invent a new rule so much as clarify and tighten the existing one, and it's live now. Three pillars: (1) disclose the odds, properly. (2) every outcome must be worth something. (3) block players who legally can't buy these, via PolicyService. Miss any of these and you're a moderation candidate.
Marsh
Start with the odds. How specific do we have to be?
Mallow
Very. You must show numerical probability percentages for each individual outcome, before the purchase, and they have to sum to 100%. Not vague tiers like "rare / epic / legendary" — the actual number per item. And if you sell something that modifies the odds — a luck boost, a pity item — you have to disclose its effect numerically too, with the displayed odds updating dynamically as it applies.
Marsh
What if the odds are tiny, like 0.01%? Do I write out a hundred decimal places?
Mallow
No — there's a rounding allowance. You can round long decimals to roughly four-or-more places below the first non-zero digit, as long as you add a disclaimer that the totals may not add up to exactly 100% due to rounding. So a 0.0001234% drop is fine to round sensibly. Just be honest and label it.
Marsh
The second pillar — 'every outcome must be worth something.' Meaning?
Mallow
No "lose your payment" results. You can't have a box where one possible outcome is nothing — the player paid and got zero. Every slot in the random pool has to deliver some benefit, even a small one. This is the line between "randomized reward" and "gambling for nothing," and Roblox is enforcing it.
Marsh
And the third pillar — region blocking. How does that work technically?
Mallow
Through PolicyService. Your dev calls
PolicyService:GetPolicyInfoForPlayerAsync and checks the ArePaidRandomItemsRestricted flag for each player. If it's true, that player must not be able to buy the random item. There's a separate check, IsPaidItemTradingAllowed, for trading them — because being allowed to buy and being allowed to trade are different eligibility questions. Marsh
Which players get restricted?
Mallow
Roblox configures it centrally — you don't hardcode countries, you just honor the flag. But the announcement named the currently restricted regions: Australia, Belgium, Netherlands, the United Kingdom, and Brazil. Loot boxes are regulated like gambling in several of those. And Roblox warns the list can change as laws evolve — which is exactly why you read the flag instead of hardcoding.
Marsh
Why is Roblox doing this now?
Mallow
Regulatory heat. Loot boxes are under active legal scrutiny worldwide, and Roblox has under-age users at massive scale. Centralizing the rules — numerical odds, no-empty-outcomes, region gating — protects the platform legally and protects players. It's the same maturation story as the age-checks and the economy-transparency moves: Roblox de-risking itself to stay available everywhere.
Marsh
So for a brand experience, what's the actual checklist?
Mallow
Five items. (1) Audit: do we sell any randomized reward for Robux or Robux-currency? (2) If yes, do we display per-outcome numerical odds, before purchase, summing to 100%? (3) Does every possible outcome have value — no empty pulls? (4) Are we calling PolicyService and honoring ArePaidRandomItemsRestricted (and IsPaidItemTradingAllowed if items trade)? (5) Is any odds-modifying item disclosing its effect dynamically? Five yeses, or you fix it before it gets moderated.
Marsh
And if we'd rather just avoid the whole headache?
Mallow
Legitimate option. For many brand experiences, a direct-purchase model — you pay, you know exactly what you get — sidesteps all of this and reads as more trustworthy to a brand-safety-conscious legal team. Gacha drives spend, but it carries regulatory and reputational weight. For a brand, "transparent direct sale" is often the safer default unless randomness is core to the fun.
Marsh
…Executive summary?
Mallow
(1) Paid Random Items = any Robux-bought random reward; the rules are clarified and live now. (2) Show numerical per-outcome odds before purchase (summing to 100%, rounding allowed with a disclaimer); every outcome must have value; odds-modifiers disclose dynamically. (3) Gate ineligible players via PolicyService (ArePaidRandomItemsRestricted), trading checked separately; restricted regions include Australia, Belgium, Netherlands, UK, Brazil. (4) Audit your mechanics now, or consider a transparent direct-purchase model instead.
Marsh
So if we ever do a mystery box, the odds go on the label and nobody can ever pay for nothing. That's… just consumer protection. Fine by me.
