Preferably by government. FTC, etc. Yeah, maybe self regulation so idiotic politics doesn't infect this area.
Loot boxes are one of the most enticing but also worst elements in games. The fact that you open a 'Mystery Box' by inputting money is literally casino. Loot boxes can be easily rigged to give you trash most of the time and 1 good thing every once in a while. Some people will spend $100s on these things just so they can get the dopamine hit of getting something good.
I used to think it was an interesting idea, but the more I look at it, the more I say f**k that. I don't want to buy loot boxes, I want to earn them. I don't want to add them to anything I make with regards to purchasing. There's a better alternative called the un-Loot Box or un-Mystery Box and it's about being transparent about what's in the box and refreshing it every once in a while. It will lower the amount of revenue, but at least you don't get called, in essence, a casino which is banned in certain countries.
I personally don't recall every buying into loot boxes with money, but if I did it was very little. I don't typically play games that have the feature. It just doesn't make sense to spend money on it.
If the loot box is free, who cares. If there is a mechanism that allows money to flow into buying and purchasing loot boxes, it needs to be regulated like a casino game, no exceptions.
I see that Apple has some guidelines for loot boxes in that they want applications to post the percentages and rarities and other metadata. I think Google might also have their own process.
Look, if it's a casino feature it needs to be verified and regulated.