A permission request every browser session also wouldn't be in line with the needs of the average end user, and would train them to hit accept on any prompt that arises, as if they didn't do that enough anyway.
Pretty sure Valve haven't actually removed lootboxes, they just show which common reward you will get if you are in Belgium, Rares are still random.
When you consider that the above is enough that Valve haven't been touched yet, it just feels like EA are digging their heels for the sake of it.
On the other hand, these are the same people who gave us BF2 and have been releasing a near identical game every year since the 90's so they may have just gotten lazy and not even noticed the law. Far too used to no effort money making that lot.