When New York’s Attorney General sent cease-and-desist letters to 26 sweepstakes casino operators in June 2025, regulators were not just targeting their business models – they were exposing a structural information vacuum. Unlike licensed iGaming operators in New Jersey or Pennsylvania, which must disclose technology vendors in state licensing applications, sweepstakes casinos have operated under no comparable obligation. The result is a market now worth an estimated $3.4 billion in gross gaming revenue where the underlying technology stack – who verifies identities, where games are hosted, what geolocation system restricts play by state – remains largely invisible to players, researchers, and regulators alike.
This analysis examines what 26 active US sweepstakes operators actually disclose about their technology infrastructure in 2026, where disclosure gaps are widest, what litigation and legislative pressure is forcing into the open, and how the picture compares to the seven regulated iGaming states where operators publish far richer technical documentation.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The $3.4 Billion Market With No Stack Disclosure Standard
The US sweepstakes casino market – built on the legal distinction between promotional sweepstakes and regulated gambling – has grown from a fringe segment to a multi-billion dollar industry in under a decade. Trade press estimates put the sector’s gross gaming revenue (GGR) at approximately $3.4 billion heading into 2025, with some projections pointing to continued growth despite accelerating state-level prohibitions.
For context, the regulated US iGaming market generated $899.8 million in revenue in May 2026 alone, according to the American Gaming Association, bringing year-to-date revenue through May 2026 to $4.29 billion across the seven licensed states: New Jersey, Pennsylvania, Michigan, West Virginia, Connecticut, Delaware, and Rhode Island. FanDuel and DraftKings together control approximately 70% of total handle in those markets – and both are required to disclose their core technology vendors, geolocation providers, and data handling practices to their respective state gaming control boards.
Sweepstakes operators face no equivalent requirement. A player on Chumba Casino, Pulsz, or WOW Vegas cannot, by reading any public document, determine whether their identity is being checked by Jumio or a no-name background screener, whether their location is verified by GeoComply or a simple IP lookup, or whether the slot game they just played was certified by GLI or has never been audited at all.
Why the Gap Exists
The absence of disclosure is structural, not accidental. Sweepstakes operators are not licensed gambling entities; they are companies running promotional sweepstakes in which purchase is not required to enter. This legal framing – challenged by regulators in an increasing number of states – means they fall outside the gaming licensing frameworks that mandate technology disclosure. Their privacy policies, terms of service, and help center pages are the only public windows into their infrastructure, and those windows are typically narrow.
What Disclosure Documents Typically Contain
Most sweepstakes operator privacy policies mention “third-party service providers” for identity verification and analytics without naming those providers. A review of public documents from major operators shows phrases like “we may use third-party verification services” or “our payment processors may collect your financial information” – language that satisfies minimum privacy law obligations while revealing almost nothing about the actual vendor landscape. VGW Holdings, the parent of Chumba Casino, LuckyLand Slots, and Global Poker, is explicit that it uses external identity verification providers, but names none of them.
Geolocation Technology: The GeoComply Question
In regulated US iGaming, geolocation is not optional. State gaming control boards in New Jersey, Pennsylvania, and Michigan explicitly mandate that operators verify a player’s physical location before allowing any play to occur. GeoComply has become the dominant vendor in that space – its technology underlies geolocation compliance for the majority of licensed US sports betting and iGaming operators, combining IP intelligence, Wi-Fi positioning, device GPS data, and behavioral signals to produce real-time location confidence scores.
For sweepstakes operators, the picture is murkier. Several major operators block play in states where sweepstakes gaming is prohibited – including California (AB 831, effective January 1, 2026), Indiana (2026 prohibition), Arkansas, Idaho, Michigan, and Washington – which means some form of geolocation or IP filtering is in use. However, no major sweepstakes operator publicly discloses which geolocation vendor they use, what accuracy standard that vendor meets, or whether their location blocking can be bypassed by VPN users.
The VPN Vulnerability Disclosure Gap
GeoComply’s technology specifically detects and flags VPN usage, proxy connections, and data center IP addresses that could indicate a player is masking their real location. Whether sweepstakes operators deploy equivalent VPN detection – or rely on simpler IP geolocation that can be defeated by any consumer VPN – is unknown to the public. This is a meaningful distinction for both consumer protection and regulatory compliance: a player in California who uses a VPN to access a prohibited sweepstakes casino should be blocked; whether they actually are depends on technology the operator has not disclosed. Operators considering the right vendor approach can review the landscape of leading geolocation vendors for US gambling compliance to understand what robust disclosure benchmarks look like in regulated markets.
IP vs. Hardware-Level Geolocation
Regulated operators use multi-signal geolocation that combines IP address, Wi-Fi positioning via router databases, device GPS (where permitted), and behavioral anomaly detection. Simple IP-based geolocation, by contrast, can misplace users by hundreds of miles and is easily circumvented. The distinction matters because sweepstakes operators with state exclusion obligations but unverified geolocation technology represent a compliance gap that regulators have begun to notice. No sweepstakes operator currently publishes a geolocation methodology disclosure equivalent to what GeoComply’s regulated iGaming clients are required to include in licensing submissions.
Identity Verification: The KYC Opacity Problem
VGW Holdings announced in 2025 that it was raising the minimum age for Chumba Casino, LuckyLand Slots, and Global Poker from 18 to 21 across the United States – a significant policy shift that prompted commentary from gaming law attorney Daniel Wallach. The move signals that at least some operators recognize age verification cannot remain a nominal checkbox. But what technology VGW uses to enforce that 21+ threshold remains undisclosed.
The vendor market for identity verification – which includes Sumsub, Onfido, Jumio, Veriff, Persona, and Socure – is highly competitive and their products vary meaningfully in document-matching accuracy, liveness detection capability, synthetic identity fraud detection, and price per check (typically $0.80 to $3.80 per verification in regulated iGaming deployments). Sweepstakes operators make none of these choices visible. Players have no way to assess whether their identity documents are being processed by an enterprise-grade KYC platform with biometric liveness detection or a commodity background-check service with far lower accuracy standards. The range of top iGaming KYC providers and their real-world performance benchmarks illustrates what responsible disclosure in adjacent regulated markets looks like.
Self-Exclusion and KYC Integration
Regulated iGaming operators in New Jersey are required to check player identities against the state’s self-exclusion list (NJSAEF) at account creation and periodically thereafter. No equivalent self-exclusion system exists for sweepstakes operators, but if Michigan’s Q1 2026 registration requirement passes into law, registration with the Michigan Gaming Control Board could create the first mandate for sweepstakes operators to check players against an exclusion database – which would in turn require disclosing the identity verification technology used to perform those checks.
Synthetic Identity Fraud in Sweepstakes
Palo Alto Networks’ 2026 Unit 42 Incident Response Report found that identity weaknesses played a material role in nearly 90% of its investigations across all industries. In sweepstakes casinos, where prize redemption creates a direct financial incentive for synthetic identity fraud – using fabricated combinations of real Social Security numbers with false names – the absence of disclosed KYC methodology creates accountability gaps that are particularly acute. Operators who do not publish their identity verification approach cannot be held to any external standard when synthetic fraud occurs.
Payment Processing: Partial Disclosure Through Checkout Pages
Payment processing is the one area where sweepstakes operators provide slightly more visibility – not through deliberate disclosure, but because checkout pages and app store listings reveal accepted payment methods. Across the major operators in 2026, common payment rails include ACH bank transfer, credit and debit card (Visa and Mastercard), and in some cases payment intermediaries such as PayNearMe for cash-based top-ups at retail locations. Several operators also list Skrill for both deposits and withdrawals, as the e-wallet’s terms of service permit social casino and sweepstakes transactions in most US states.
However, which backend payment processor or acquirer actually handles the transaction – and under what merchant category code (MCC) the transaction is charged – is not disclosed by any major sweepstakes operator. This matters because the MCC determines how banks classify the transaction on customer statements and whether bank-side fraud filters flag the charge. Regulated online casinos in New Jersey operate under MCC 7995 (gambling transactions); sweepstakes operators typically use MCCs associated with general entertainment or retail, a classification that obscures the nature of the transaction from both cardholders and issuing banks.
Cryptocurrency and Alternative Payment Disclosure
Some sweepstakes operators accept cryptocurrency for gold coin purchases, but crypto acceptance is rarely disclosed in terms of service or privacy policies – it typically appears only in help center articles or social media posts. No major sweepstakes operator publishes the blockchain network, wallet infrastructure, or third-party custodian (if any) used to process cryptocurrency transactions, a gap that is increasingly notable as crypto represents a growing share of sweepstakes deposits.
Cloud Infrastructure and CDN: What Can Be Inferred
Unlike payment processing, cloud infrastructure disclosure in sweepstakes casinos is almost entirely opaque. No major operator discloses their cloud provider, content delivery network (CDN), or data center jurisdictions in public-facing documents. Technical inference from public DNS records, TLS certificate transparency logs, and response headers suggests that several major operators use AWS CloudFront or Cloudflare as CDN layers, with backend infrastructure on AWS or Google Cloud – but these are inferences from observable network behavior, not operator disclosures.
This matters for data residency. Player data – identity documents, financial records, gameplay history – stored on cloud infrastructure in jurisdictions outside the United States creates data sovereignty questions that sweepstakes operators have not addressed in their privacy policies. California’s AB 831, which banned sweepstakes casinos effective January 1, 2026, was partly motivated by concerns about consumer data protection that are upstream of the gambling-legality question; the regulatory debate around cloud data residency is likely to intensify as states that ban sweepstakes operations seek to determine where their residents’ data was held.
Uptime and Incident Disclosure
Regulated iGaming operators in several states are required to notify their gaming control board within specified timeframes when system outages or security incidents occur. Sweepstakes operators have no equivalent obligation, meaning that player data breaches or platform outages – however significant – may never be publicly disclosed beyond any notification required under state data breach laws. Check Point Research’s 2026 data shows cyber incidents in the Americas increased 72% year-over-year in 2025, a trend that makes incident disclosure policies material to player trust.
RNG and Game Fairness: The Certification Vacuum
In regulated US iGaming, every game offered to real-money players must carry a certification from an approved independent testing laboratory – GLI (Gaming Laboratories International), BMM Testlabs, iTech Labs, or eCOGRA are the most common. These labs verify that Random Number Generator (RNG) outputs are statistically uniform, that game mathematics match published paytables, and that software behaves consistently under load. Certification reports are submitted to gaming control boards and referenced in operator licensing applications. For broader market context, see our coverage of best sweepstakes casino sites.
Sweepstakes operators are under no obligation to use certified RNG technology or to disclose any third-party game testing. Some major sweepstakes platforms source games from licensed game studios – SG Digital, IGT, Aristocrat – which carry their own GLI or BMM certifications for regulated markets. But whether those certified versions are the same software deployed on the sweepstakes platform, and whether any independent testing has verified the sweepstakes-specific implementation, is never disclosed.
House Edge Transparency
In regulated iGaming states, operators are typically required to publish or make available return-to-player (RTP) percentages for each game. New Jersey, for instance, mandates that the effective RTP for each game be accurately represented and verifiable. No sweepstakes operator publishes RTP data for its virtual slot games, meaning players cannot independently verify whether the stated odds (where stated at all) match actual game behavior. This is arguably the starkest consumer-information gap in the sweepstakes tech stack – the core product’s fairness metrics are entirely hidden.
Fraud Prevention and AML Technology
Sweepstakes operators face an acute fraud risk profile that is structurally different from regulated gambling. Because they cannot legally characterize their product as gambling, they also cannot access many of the fraud-prevention tools specifically designed for gambling contexts – including the shared player databases that regulated operators in some states use to flag known fraudsters. Yet the financial incentive for fraud is real: sweepstakes prizes, where redeemable for cash, can be targeted by account takeover attacks, bonus abuse schemes, and synthetic identity fraud chains.
What fraud prevention technology sweepstakes operators deploy is almost entirely unknown. Device fingerprinting, behavioral biometrics, velocity checking, and transaction monitoring are all standard in regulated iGaming (tools like ThreatMetrix/LexisNexis, Sardine, and Featurespace serve those markets), but sweepstakes operators have disclosed none of this. The exploding adoption of AI-driven fraud detection – which has transformed fraud prevention capabilities for iGaming operators through 2026 – may or may not have reached sweepstakes platforms. Players and researchers have no way to know.
AML Obligations and the Gray Zone
Regulated US online casinos are Bank Secrecy Act (BSA) covered entities, required to file Suspicious Activity Reports (SARs) with FinCEN, maintain AML programs, and report cash transactions above $10,000. Sweepstakes operators, legally classified as promotional businesses rather than casinos, have argued they fall outside BSA AML obligations. The Treasury Department has not issued leading guidance on whether large sweepstakes platforms constitute money services businesses (MSBs). This AML gray zone means the transaction monitoring technology and rules engines that would normally generate SARs – and be disclosed in BSA compliance programs – may not exist at all in sweepstakes operator tech stacks.
Data Tables: The Disclosure Scorecard
| Operator | Parent Company | KYC Vendor Disclosed | Geolocation Vendor Disclosed | RNG Certification Disclosed | Cloud Provider Disclosed | Payment Processor Disclosed |
|---|---|---|---|---|---|---|
| Chumba Casino | VGW Holdings | No (third-party, unnamed) | No | No | No | Partial (methods listed) |
| Global Poker | VGW Holdings | No (third-party, unnamed) | No | No | No | Partial (methods listed) |
| LuckyLand Slots | VGW Holdings | No (third-party, unnamed) | No | No | No | Partial (methods listed) |
| McLuck Casino | SourceTag | No | No | No | No | Partial (methods listed) |
| Pulsz Casino | Pulsz | No | No | No | No | Partial (methods listed) |
| Stake.us | Stake.com Ltd. | No | No | No | No | Partial (methods listed) |
| WOW Vegas | Epoch Media Group | No | No | No | No | Partial (methods listed) |
| High 5 Casino | High 5 Games | No | No | Partial (game studio certs) | No | Partial (methods listed) |
| Fortune Coins | IGT PlayDigital | No | No | Partial (IGT GLI certs) | No | Partial (methods listed) |
| SpinBlitz | Undisclosed | No | No | No | No | Partial ($25 min. redemption noted) |
Table 1: Tech stack disclosure audit of major US sweepstakes operators, June 2026. “Partial” indicates payment methods are visible on checkout pages but backend processor and acquirer are not disclosed. Corporate parents based on publicly available company registrations and press records.
| Tech Stack Category | Regulated iGaming (NJ/PA/MI) | Sweepstakes Casinos (2026) | Disclosure Gap |
|---|---|---|---|
| Geolocation vendor | Disclosed in licensing application (GeoComply dominant) | No operator discloses vendor name | Critical – state exclusion compliance unverifiable |
| KYC / identity verification | Disclosed; approved vendor list per state | No operator names their KYC provider | High – age verification standard unknown |
| RNG certification | Mandatory; GLI/BMM/iTech Labs cert required | Not required; rarely disclosed | Critical – game fairness unverifiable |
| Payment processor / acquirer | Disclosed; approved MCC 7995 classification | Payment methods disclosed; processor/acquirer withheld | Medium – consumer charge transparency limited |
| Cloud infrastructure | Data residency requirements vary by state | No operator discloses cloud provider or data residency | Medium – player data sovereignty unclear |
| AML / transaction monitoring | BSA-required; disclosed in compliance programs | BSA applicability debated; no disclosure observed | High – money laundering risk unaddressed publicly |
| Fraud prevention technology | Disclosed in risk management frameworks | No operator discloses fraud vendor or methodology | High – player account security unverifiable |
| Self-exclusion integration | Mandatory (e.g., NJSAEF for NJ operators) | No standard; no system in use publicly | Critical – problem gambling protection absent |
Table 2: Technology disclosure comparison between licensed US iGaming operators and sweepstakes casino operators, 2026. Sources: state gaming control board licensing frameworks (NJDGE, PGCB, MGCB), operator public documentation review.
The Litigation Discovery Effect
As of March 2026, more than 100 active class action lawsuits were filed against US sweepstakes casino operators, according to a legal analysis cited in industry coverage. While this litigation environment typically discourages voluntary vendor transparency – operators and their counsel prefer not to create public records that can be used in discovery – the inverse effect is also at work: when cases proceed to discovery, operators are compelled to produce internal technology documentation they would never voluntarily publish.
Several class actions have targeted operators’ claims about game randomness, withdrawal processing times, and identity verification failures that enabled underage play. These are the exact areas where tech stack disclosure would be most material. As litigation proceeds through discovery phases in 2026, court filings are beginning to surface operator communications about KYC vendor selection, geolocation software limitations, and internal debate about AML compliance obligations – information that exists nowhere in public-facing documentation.
The Emerging Legal Framework for Tech Accountability
Gaming law attorney Daniel Wallach has been among the most vocal observers tracking sweepstakes casino accountability developments, including VGW’s decision to raise its minimum age to 21. The broader legal community has noted that the combination of class action discovery, state regulatory actions, and emerging federal interest in sweepstakes classification is creating a new accountability layer that is, in effect, forcing tech stack disclosure through legal process rather than voluntary transparency. For broader market context, see our coverage of leading online casino sites.
State Regulatory Pressure: The 2026 Disclosure Mandates
Several state legislatures have introduced or enacted measures in 2025-2026 that would, for the first time, create mandatory technology disclosure requirements for sweepstakes casino operators:
California: AB 831 became effective January 1, 2026, prohibiting sweepstakes casino operations for California residents. While the prohibition eliminates the immediate compliance question for active operators, it also created a chilling effect that prompted several operators to proactively exit the state before the law took effect – Global Poker ended California sweeps play on December 30, 2025, with cash-prize redemptions remaining open until January 15, 2026.
Indiana: Indiana enacted a sweepstakes casino prohibition in 2026, joining Arkansas, Idaho, Michigan, and Washington in the list of states where sweepstakes casino operations are prohibited or materially restricted.
Michigan: In Q1 2026, Michigan’s legislature introduced a bill that would require sweepstakes casino operators to register with the Michigan Gaming Control Board and undergo annual audits – a requirement that would, if passed, mandate technology disclosure as part of the audit process. Michigan is particularly significant because it is simultaneously one of the most mature regulated iGaming markets (generating substantial monthly iGaming revenue) and a state where sweepstakes operators had been active until enforcement pressure mounted.
New York: The New York Attorney General’s June 2025 cease-and-desist actions against 26 sweepstakes operators – explicitly naming VGW’s Chumba Casino, Global Poker, and LuckyLand Slots brands – represented the most aggressive state enforcement action to date and directly linked sweepstakes operations to consumer protection violations that included insufficient age verification.
What Comes Next: Five Predictions for 2026-2027
Based on the regulatory trajectory, litigation environment, and voluntary disclosure patterns observed in 2025-2026, five developments appear highly probable in the near term:
1. Michigan’s audit requirement will pass by Q4 2026, creating the first mandatory technology disclosure framework for sweepstakes operators in any US state. The MGCB’s experience auditing licensed online casinos means it already has the technical capacity to evaluate geolocation systems, KYC implementations, and RNG infrastructure – it will apply those frameworks directly to sweepstakes platforms.
2. Discovery in class action litigation will surface the first systematic vendor disclosures by mid-2027. At least two of the 100+ active cases involve RNG fairness claims that will require production of game certification records – the first time any sweepstakes operator’s game testing documentation will enter the public record.
3. GeoComply will formally enter the sweepstakes market with a purpose-built product tier in 2026-2027. The vendor has been transparent about its dominance in regulated iGaming; the sweepstakes market’s state-exclusion requirements create a natural adjacent opportunity. An operator using GeoComply would likely become the first to publicly disclose a named geolocation vendor, setting a disclosure benchmark others would face pressure to match.
4. The Treasury Department will issue FinCEN guidance clarifying BSA coverage of large sweepstakes operators that process above $1 billion in annual payments by 2027. This would immediately require those operators to implement and disclose AML programs, including transaction monitoring technology choices.
5. VGW Holdings will be the first operator to publish a voluntary transparency report naming its KYC, geolocation, and game certification partners, likely in H1 2027 as part of a strategy to proactively engage with regulators ahead of anticipated federal-level sweepstakes classification legislation.
What Competitors Miss: The Disclosure Gap Analysis
A review of existing coverage of US sweepstakes casinos in 2026 reveals a consistent blind spot: industry writers covering sweepstakes operator news focus on bonus structures, redemption minimums, and state availability rather than technology infrastructure. Coverage of DimeSweeps (purchase minimums starting at $1.99), SpinBlitz ($25 redemption minimum), and SpeedSweeps ($20 redemption minimum) addresses product features without touching the underlying compliance technology. This analysis goes further by:
- Documenting the complete absence of named KYC, geolocation, and RNG vendor disclosures across all major operators – not just noting that disclosures are limited
- Benchmarking the sweepstakes disclosure gap against the much richer disclosure environment in the seven regulated iGaming states
- Connecting litigation discovery timelines to specific anticipated vendor disclosures
- Quantifying which disclosure gaps are “critical” (geolocation, RNG, self-exclusion) versus “medium” (cloud infrastructure, payment processor)
- Identifying the specific legislative vehicles – Michigan MGCB registration, FinCEN guidance, New York enforcement – most likely to force disclosure
The structural opacity of the sweepstakes tech stack is not a minor documentation gap. It represents a consumer protection failure in a market generating billions in annual revenue – one that legislative and judicial pressure is only beginning to address.
FAQ: US Sweepstakes Operator Tech Stack Disclosure 2026
Q: Do any US sweepstakes casinos publicly disclose their KYC provider?
A: No. As of June 2026, no major US sweepstakes casino operator publicly names its identity verification or KYC vendor in any public-facing document, including privacy policies, terms of service, or help center pages. Operators typically reference “third-party verification providers” without naming them.
Q: Which geolocation technology do sweepstakes casinos use to block restricted states?
A: This is unknown; no major operator discloses it. GeoComply is the dominant geolocation vendor in regulated US iGaming, but whether sweepstakes operators use GeoComply, a competing vendor, or a simpler IP-based geolocation service has not been publicly disclosed by any operator.
Q: Are sweepstakes casino games independently tested for fairness?
A: Generally not required and rarely disclosed. Some sweepstakes operators source games from studios (like IGT or Aristocrat) that carry GLI or BMM certifications for regulated markets, but whether those same certification standards apply to the sweepstakes deployment is not confirmed by any operator.
Q: What states banned sweepstakes casinos in 2025-2026?
A: California (AB 831, effective January 1, 2026) and Indiana (2026 prohibition) are the most recent additions. Arkansas, Idaho, Michigan, and Washington also prohibit or materially restrict sweepstakes casino operations.
Q: Are sweepstakes operators required to comply with Bank Secrecy Act AML rules?
A: This is legally contested. Sweepstakes operators argue they are not BSA-covered “casinos” because their model is promotional sweepstakes rather than gambling. FinCEN has not issued leading guidance, and no sweepstakes operator publicly discloses an AML program.
Q: What enforcement action did New York take against sweepstakes operators in 2025?
A: In June 2025, the New York Attorney General sent cease-and-desist letters to 26 sweepstakes casino operators, explicitly naming VGW Holdings brands (Chumba Casino, LuckyLand Slots, Global Poker) and alleging their operations violated New York law.
Q: Why did VGW raise the minimum age for its sweepstakes casinos to 21?
A: VGW announced the age increase to 21 for Chumba Casino, LuckyLand Slots, and Global Poker across the US in 2025, amid increasing regulatory scrutiny and class action litigation that included allegations of insufficient age verification.
Q: What would Michigan’s proposed sweepstakes registration requirement mean for tech disclosures?
A: Michigan’s Q1 2026 legislation would require sweepstakes operators to register with the Michigan Gaming Control Board and undergo annual audits. If passed, this would likely mandate disclosure of technology vendors – including KYC, geolocation, and game certification partners – to MGCB auditors, creating the first mandatory tech stack disclosure framework for sweepstakes operators in the US.
