As someone with an enormous personal paid content library, I absolutely agree legislation is needed here.
Also randomized lootboxes should be subject to gambling laws, or at least regulated such that you can’t get duplicates or something reasonable like that.
On further thought, banning duplicates is just begging for trouble. It's a loophole you can drive a truck through. Just append a random throwaway property to every item and bam, "unique".
So yeah, regulate it as gambling. Don't let them advertise to minors. Don't allow them to knowingly let minors participate.
Also randomized lootboxes should be subject to gambling laws, or at least regulated such that you can’t get duplicates or something reasonable like that.