Most people who talk about this tend to have no idea what laws already cover gambling.
I think that, in this case, loot boxes should be treated like slot machines as far as minimum payout goes; in Nevada (for example) this is minimum 75% by law- meaning that the house must ultimately return 75% of the value it takes in as winnings to its gamblers.
As these systems are effectively slot machines (put coin in, pull handle, get box), not much more needs to be done other than applying the law as written.
It might be tricky to establish a dollar value for the digital assets paid out, and would add overhead to assets distributed in this manner (how one would put a price on "asset that changes the way the game works" is, of course, an open question), but provided it's done properly should clamp down significantly on the anti-consumer aspects of these practices- which is, I suspect, the real reason everyone complains about this in the first place.
But that's false, on its face in fact- there was development and artist time involved in every step of the process, and that time has a value (and an auditable one, at that).
So now that we know what the value is, taking into account that the house can only pay out in those assets, we can in effect determine a maximum profit per asset (as far as the house-player transaction is concerned)- casinos close their doors when the house is no longer able to pay out, and it's no different here.
People don't seem to have a problem with this even though a minority of their games are ultimately slot machines (the simplest of which is the "time the light" game, but the coin stackers count as this as well given that they're literally right out of real casinos).
Interestingly, the fact that D&B lets you combine winnings with cash to simply buy prizes outright arguably puts them under the 'gambling' line from a legal standpoint (it works if the tokens have "no value", which is how arcades generally do it for this specific reason- combining points with your leftover cash makes this fig leaf vanish), but the fact that they let you do that in the first place is also a pro-consumer move.
But if you can exchange tokens for prizes, clearly the tokens do have value. 1 token = piece of bubble gum, 10 tokens = keychain, 5000 tokens = fluffy unicorn. Etc.
Basically, I don't see why the fig leaf would work in the first place...
So while things have value, anchoring that value to a dollar amount is a different story.
Nit:
> Must be 18 or over to enter the premises. Persons under the age of 18 may only enter the premises with a guardian who is at least 25 years of age. Each guardian may bring no more than 6 underage persons into the premises.