Legality of Video Game Loot Boxes

My (Southern Californian, non-lawyer) friends and I were discussing loot boxes/crates/sacks/whatever in video games, and they contend that it would be illegal to have different probability tables per individual.

I made the argument that a clever game designer could design a method to track a player's participation and spending habits in relation to loot box rewards, and then "juice" the reward structure to maximize addiction, but my friends claimed that was illegal.

So I'm here to ask: is it? Could I make a game where you could buy loot boxes, and then per individual pay out different reward structures based upon what was most likely to incentivize further purchases?

Bonus Question:

How are loot boxes legal in the first place? It's effectively gambling, except that the reward is digital instead of physical...