Presence, not residency, is the test

This is the most misunderstood point in the entire subject, so it goes first.

Your state of residence, your driver’s license, your mailing address, your tax home and your phone’s area code have almost nothing to do with whether you are allowed to place a wager. The legal question is where your body is at the instant the bet is placed. A New Jersey license authorizes gambling by a person physically located in New Jersey. It does not authorize gambling by New Jersey people.

The practical consequences run in both directions, and both surprise people.

Residency does matter for a few narrow things. Some operators use your registered address for tax reporting, for state-specific promotional eligibility and for identity verification, which is a separate process covered on our page about KYC verification at online casinos. But the wager itself turns on physical presence, verified in real time, every time.

Why geolocation exists: the federal law that forced it

Geolocation is not an operator preference or a fraud-prevention nicety that grew out of industry habit. It is the direct product of two federal statutes and the way states had to build around them.

The Wire Act and the interstate problem

The Interstate Wire Act of 1961, codified at 18 U.S.C. 1084, makes it a federal crime for someone in the gambling business to knowingly use a wire communication facility to transmit bets or wagers in interstate or foreign commerce. The statute is 65 years old and was aimed at bookmakers using telephones, but the phrase “wire communication facility” swallowed the internet whole.

The scope of that prohibition has been litigated and re-litigated. In September 2011 the Justice Department’s Office of Legal Counsel issued an opinion concluding that the Wire Act’s prohibitions reach only sports-related gambling. That opinion is the direct trigger for the first wave of state online casino laws: Nevada, Delaware and New Jersey all moved within roughly 18 months of it. In November 2018 the same office issued a new opinion reversing course and reading the statute to cover non-sports betting as well. That reversal was challenged, and in New Hampshire Lottery Commission v. Rosen, 986 F.3d 38, decided Jan. 20, 2021, the US Court of Appeals for the First Circuit held that the Wire Act’s prohibitions are limited to bets and wagers on sporting events or contests. The government did not seek Supreme Court review. The practical result is a controlling appellate holding that binds only the First Circuit, an unresolved question elsewhere, and an entire industry that has responded by making absolutely certain no wager ever crosses a state line.

UIGEA and the intrastate carve-out

The Unlawful Internet Gambling Enforcement Act of 2006, at 31 U.S.C. 5361 to 5367, does not itself make gambling legal or illegal. It attacks the money, barring gambling businesses from accepting payments connected to “unlawful Internet gambling.” What matters for geolocation is the definition of that term in 31 U.S.C. 5362(10)(B), which carves out an intrastate transaction where the bet “is initiated and received or otherwise made exclusively within a single State,” is expressly authorized by that state’s law, and where that state law includes “age and location verification requirements reasonably designed to block access to minors and persons located out of such State,” plus “appropriate data security standards to prevent unauthorized access by any person whose age and current location has not been verified.”

One consequence worth understanding: this is also why there is no national online blackjack pool. The Multi-State Internet Gaming Agreement lets member states share player liquidity, but it covers poker only. Blackjack is never pooled across state lines. Every hand you play at a licensed US site is a wholly intrastate transaction against a house located in your state’s regulatory perimeter, which is also why a New Jersey balance and a Pennsylvania balance at the same brand are two separate accounts with two separate wallets.

What the state rules actually say

The federal floor is general. The state rules are specific, and they are the ones operators are tested against.

Pennsylvania’s regulation at 58 Pa. Code 809a.7 requires an interactive gaming system to detect the physical location of a player upon login and “as frequently as specified in the Board’s technical standards” and the operator’s approved internal controls. If the system detects the player is in an unauthorized area, it “shall not accept wagers” and must disable gaming activity for that player until the player is back in an authorized location. The same rule requires the system to dynamically monitor location and block unauthorized access throughout the session, and, in an interesting wrinkle, requires operators to stop players who are physically inside a licensed casino from using their own laptops and phones to play the online product on the casino floor.

Michigan’s rule at Mich. Admin. Code R. 432.631 is built the same way. Operators and their platform providers must use a geofencing system to reasonably detect physical location, block unauthorized attempts, confirm the participant is within the permitted boundary when placing a wager, and dynamically monitor that location for the duration of the session. The Michigan Gaming Control Board approves all technical specifications for geofencing rather than fixing a number in the rule text, and its testing bulletins require an approved independent laboratory to confirm the platform resists replay attacks and device-level tampering with location data.

New Jersey’s Division of Gaming Enforcement, which certified the first US online casino geolocation deployments in 2013, works the same way: location must be established at login and re-established at a frequency set out in the operator’s approved submission, and the division tests the system’s accuracy and its false-accept and false-reject behavior before a site goes live. Our page on state gambling regulators covers who holds which authority in each live state.

The pattern across all seven live states, New Jersey, Delaware, Pennsylvania, West Virginia, Michigan, Connecticut and Rhode Island, is identical in substance: check at login, check again during play, refuse the wager if the check fails, log everything. Maine has passed an online casino law but has not launched, and Nevada, despite the obvious assumption, licenses online poker only and has no regulated online blackjack at all. The online casino bill tracker has the current status of everywhere else.

How casino geolocation actually works

No licensed US operator builds this in house. Geolocation is outsourced to a small number of specialist vendors whose software is itself submitted to gaming laboratories and approved by regulators as part of the platform. GeoComply is the dominant supplier and has been since the New Jersey launch in 2013; its compliance product processes location checks at a scale it describes in the billions per month across US gaming. Xpoint and LocationSmart are the main alternatives, and some operators run hybrid stacks. From the player’s side the vendor is mostly invisible: it shows up as a mobile app called a location validator, a desktop plugin, or a browser component that runs when you log in.

What matters is that none of these systems trusts any single signal. A single signal is trivially faked. The whole design is a layered stack in which the signals are collected together, cross-checked against each other, and scored. Disagreement between the layers is itself evidence.

GPS on mobile devices

On a phone or tablet, satellite positioning is the primary signal and the most precise one. Modern handsets read multiple constellations, GPS plus GLONASS, Galileo and BeiDou, and under open sky they resolve position to a few meters. The check does not just take the coordinates; it takes the reported accuracy radius that comes with them. A fix that says you are at a given point plus or minus 2,400 meters is a very different input from one that says plus or minus 8 meters, and near a state line that difference decides whether your wager is accepted.

GPS is also the weakest signal indoors. Concrete, steel, basements, interior rooms of large buildings and dense downtown blocks all degrade the fix or block it entirely. That is why so many failures happen in exactly the places people play from: a couch in the middle of an apartment building, a hotel room, an office.

Wi-Fi access point triangulation

This is the layer most players have never heard of, and the one that causes the strangest failures. Every Wi-Fi router broadcasts a unique hardware identifier, its BSSID or MAC address. Companies including Google, Apple and Skyhook maintain enormous crowdsourced databases mapping those identifiers to physical coordinates, built by collecting what phones see as they move through the world. Your device does not need to connect to a network to use this. It lists every access point in radio range, sends the list up, and the database returns a position computed from the known locations of those routers and their relative signal strengths.

Indoors, Wi-Fi positioning is usually more reliable than GPS, which is why it carries real weight in the stack. Its failure mode is specific and unforgiving: the database can be wrong. If a router was previously used in another state and its owner moved, the crowdsourced record can keep the old coordinates for weeks or months until enough new observations correct it. Your phone then confidently reports that you are 600 miles away, and the check refuses your wager while every other signal on your device says you are home. This is a real and reasonably common cause, and it has a real fix, covered below.

IP address analysis

Your public IP address is the coarsest of the layers and by itself proves very little. Commercial IP databases map address ranges to cities and regions with wildly variable accuracy, and cable and fiber providers routinely route traffic through regional hubs that sit in a different state from the customer.

IP is not used to establish your location so much as to contradict it, and to identify what your connection is. The vendors maintain very large catalogs of address ranges classified by type: consumer broadband, mobile carrier, data center, hosting provider, known VPN exit node, Tor exit node, proxy, smart DNS relay, and residential-proxy networks that resell access through compromised consumer devices. GeoComply’s GeoGuard product describes a database on the order of 310 million IPv4 and IPv6 addresses maintained for exactly this purpose, and claims roughly 98 percent accuracy at identifying VPN traffic. If your GPS says Pittsburgh and your IP belongs to a data center in Frankfurt, the mismatch is the finding.

Cell tower data

On a device with a cellular radio, the serving tower and its neighbors provide an independent position estimate that depends on neither satellites nor Wi-Fi databases. Tower positions are well mapped, and cell-based positioning typically resolves to somewhere between a few hundred meters and a couple of kilometers depending on tower density.

That is too coarse to establish presence on its own, but it is excellent as a cross-check, because it is genuinely hard to fake without physically transmitting radio. It is also the layer that fails most interestingly at international borders. A phone in downtown Detroit can attach to a tower across the river in Windsor, Ontario. Cell-only positioning in that moment says Canada, and Canada is not Michigan.

Device sensors and integrity checks

The check does not stop at position. The vendor software inspects the device itself. It looks for whether the phone is jailbroken or rooted, whether developer options with mock-location permissions are enabled, whether the app is running inside an emulator or a virtual machine, whether known location-spoofing packages are installed, whether the reported sensor data is internally consistent, and whether the position is physically plausible given the last accepted position and the elapsed time. GeoComply markets this as detecting location jumping, proxy betting, account sharing and account takeover, and describes running hundreds of location, device-integrity and identity checks on every geolocation transaction.

The desktop plugin

Desktops and laptops are a harder problem. They usually have no GPS, no cellular radio and no useful sensor data, and a browser alone cannot be trusted to report location honestly. The industry’s answer is a small piece of software you install once and keep running: a downloadable geolocation plugin, or on some platforms a companion mobile app that validates your position and hands the result to your computer session.

The plugin does the work phone hardware would otherwise do. It enumerates the Wi-Fi access points in range, reads the network configuration, checks for VPN adapters and proxy settings at the operating system level, inspects for virtual machine artifacts, and packages the result in a form the casino can verify as untampered. Because it sits that close to the operating system, it is also the component most likely to be broken by a Windows or macOS update, blocked by corporate antivirus, or simply left running at an old version. An outdated plugin is one of the top causes of desktop failures and one of the easiest to fix.

Geofences and buffer zones

A geofence is the digital boundary the operator is licensed inside. In practice it is the state border drawn as a polygon, sometimes with additional excluded or included areas layered on top.

That is a buffer zone, and it is not a bug and it will not be fixed, because the alternative is accepting wagers the operator cannot prove were lawful. It bites hardest in exactly the places with the most players: Philadelphia and Camden facing each other across the Delaware River, the Detroit to Toledo corridor, the Delaware and Maryland line, and the whole of Rhode Island, which is small enough that a very large share of its population lives within a few miles of Connecticut or Massachusetts. If that is you, the fix is unglamorous: move toward the interior of the state and get a better fix.

Where tribal land complicates the map

The boundary is not always just the state line. Under the Indian Gaming Regulatory Act, at 25 U.S.C. 2701 and following, Class III casino gaming is authorized on Indian lands under a tribal-state compact, and that “on Indian lands” requirement has shaped how several online products are built.

The standard structure is a server-location theory: the wager is treated as taking place where the equipment that accepts it sits, so the servers are located on tribal land while the player sits elsewhere in the state. The Seminole Tribe of Florida’s 2021 compact was built on that model and was challenged as authorizing gaming off Indian lands. In West Flagler Associates v. Haaland, decided June 30, 2023, the US Court of Appeals for the DC Circuit rejected the challenge and left the compact in effect, and the Supreme Court later declined to hear the case. Connecticut’s online casino market runs on a related structure, with the Mashantucket Pequot Tribal Nation and the Mohegan Tribe holding online casino rights under amended compacts alongside the Connecticut Lottery Corporation. Michigan licenses both commercial Detroit operators and tribal operators under its internet gaming act, with equipment-location requirements that differ between the two.

For a player in a live state the effect is mostly invisible, because the geofence is still the state line. Where it surfaces is in states where a tribe’s online offering is authorized only for play on that tribe’s own lands, which produces geofences measured in acres rather than counties, and in a state such as Maine, where the licensing structure is tribal-exclusive and the market has passed into law but has not yet launched. Our page on tribal gaming and online blackjack works through the compact structures.

Re-checks during the session

The check at login is not the end of it. Both the Pennsylvania and Michigan rules quoted above require dynamic monitoring for the duration of the session, and every live state requires something equivalent. In practice the software runs a fresh location check on a timer while you play.

What happens to a blackjack hand when the check fails mid-session

This is where the subject stops being abstract. You have $50 on the felt, you have split aces, and the screen goes gray with a location error. What happens to the money?

Start with the principle the regulations actually state. Pennsylvania’s rule says a failed check means the system “shall not accept wagers” and must disable gaming activity until the player is back in an authorized location. It does not say the operator must unwind a wager it already accepted. That distinction is the whole answer. A wager accepted while you were verifiably inside the state was a lawful wager. Nothing about your later location makes it retroactively unlawful, and nothing entitles the operator to keep the stake.

RNG blackjack

Software blackjack is single-player and self-paced, so the round can simply be paused. The common behaviors, in rough order of how often you will see them:

• The hand is preserved and restored. Most modern platforms treat an interrupted round as an incomplete game, hold the state server-side, and present it to you again the next time you log in successfully. Your split aces are still sitting there waiting for a decision. This is the same mechanism that handles an ordinary disconnect or a dead battery.
• The hand auto-completes under house rules. Some platforms resolve the round automatically rather than holding it, playing out your hand on a default rule, usually standing on your current total, then dealing the dealer’s hand and settling. Any win is credited to your balance whether or not you can log in to see it.
• New wagers are blocked and the existing round is the last one. In every case, the practical result after the round resolves is the same: no new bet is accepted until a check passes.

What you should never see is the stake vanishing. If a location failure eats a bet and the hand never resolves and never returns, that is a complaint, not a rule, and the state regulator has a formal patron-dispute process for it. Our page on how to file a casino complaint covers the escalation path.

Live dealer blackjack

Live dealer is materially worse, and the reason is structural: the table does not belong to you. A live blackjack table in a studio operated by a supplier such as Evolution or Playtech is running a shared clock for every seated player, with a betting window measured in seconds and a decision timer that is usually somewhere around 12 to 15 seconds. The dealer does not stop because your device is re-checking its position.

So a re-check that takes even 10 or 20 seconds to complete, which is entirely normal when GPS has to reacquire or the plugin has to rescan Wi-Fi, can cost you the betting window on the next round, or cause your decision timer to expire. When a decision timer expires on a live table, the standard behavior is that the hand plays out on the default action, which on a blackjack table is to stand on your current total. If you were sitting on a 12 against a dealer 10 and intended to hit, the timeout stands you on 12 and you almost certainly lose a hand you would have played differently.

Bets already accepted for the round resolve as dealt, exactly as they would on a physical table if you walked away. Side bets already placed are settled from the cards. Insurance not taken in time is simply not taken.

The takeaway for anyone who prefers live dealer blackjack: if your connection is at all marginal, or you are near a state line, or you are on a laptop with a flaky plugin, the RNG tables are the forgiving choice and the live tables are the punishing one. It is worth sorting out your location setup before you sit down at a shared table rather than during a shoe.

Why geolocation fails, and the fix for each cause

Almost every failure has a specific, identifiable cause, and almost all of them are on the player’s side of the connection. Operators can and do misconfigure things, but that is the minority case.

Cause	What is actually happening	Fix
Wi-Fi instead of cellular	Your router’s position in a crowdsourced database is wrong, stale, or missing, or your ISP routes your traffic through an out-of-state hub	On mobile, turn Wi-Fi off entirely and retry on cellular data. On a desktop or laptop, do the opposite and make sure the Wi-Fi radio stays switched on even when you are plugged into Ethernet, because the plugin needs it to scan for access points
Remote desktop or screen sharing software	VNC, Windows Remote Desktop, TeamViewer, Chrome Remote Desktop and even an active screen share in a video call are treated as remote-control vectors, because they are the classic way to have someone in a legal state operate a machine for you	Quit the software entirely, including background services and tray helpers, and end any active screen share. Reboot if the service restarts itself
A brand new router or a new IP address	A router that has never been seen before has no entry in the positioning databases, and a freshly assigned ISP address can take a day or two to appear correctly in commercial IP databases	Use cellular data for a couple of days while the databases catch up. If a wrong IP location persists for more than about a week, ask your ISP to correct the geolocation record for the address block
VPN or proxy running in the background	Your traffic exits from a data center IP the vendor already classifies as a VPN endpoint, so the IP layer contradicts every other signal	Fully disconnect and quit the VPN client, do not just toggle it off. Check for iCloud Private Relay on Apple devices, and for browser-level VPN features in Opera, Brave and some antivirus suites
Corporate or campus network	The network backhauls all traffic to a headquarters or a data center in another state, and often blocks the ports or domains the location check needs	Leave the corporate network. Use cellular data or your own hotspot. Corporate networks are not fixable from your side
Location permission denied	The browser, the app or the operating system is refusing to hand over position data, so the strongest signal is simply absent	Grant permission at both levels: operating system location services on, and the specific browser or app allowed. On macOS this is in Privacy and Security, on Windows in Privacy settings, on iOS and Android in the per-app location setting, which should be set to precise rather than approximate
Outdated or blocked desktop plugin	An operating system update broke the old version, or antivirus or a firewall is blocking it from reading network adapters	Uninstall, download the current version from the casino’s own download link, reinstall, restart the machine, and add an exception in your security software
Stale Wi-Fi database entry	A router that physically moved states still carries its old coordinates in the positioning database, so your device reports the old location with confidence	Disable Wi-Fi and use cellular or a wired connection. Report the failure code to the casino, which can escalate to the geolocation vendor to have the record corrected
Too close to a state line	The accuracy radius around your position overlaps the border, so the system cannot prove which side you are on	Move further inside the state. Go outside or near a window so satellite positioning can tighten the radius. There is no software fix for physics
Satellite internet	Satellite providers assign addresses out of regional pools, and the IP frequently resolves hundreds of miles from the dish, sometimes to another state entirely	Use cellular data for the gaming session, or a mobile device on its own connection. Satellite service is one of the hardest cases to resolve and support often cannot override it
Virtual machine or emulator	The plugin detects VM artifacts and refuses outright, because a VM is a standard spoofing vector	Play on the bare-metal operating system. There is no legitimate way around this and no reason to expect an exception
Spoofing apps installed for other reasons	Mock-location tools, GPS joysticks, developer options set to a mock location provider, or a rooted or jailbroken device trip an integrity check even when they are idle	Uninstall them. On Android, clear the mock location app setting in developer options and consider turning developer options off entirely
DNS filtering or ad blocking	A network-level blocker, a filtering DNS resolver or a privacy extension is blocking the vendor’s domains, so the check never completes and times out	Pause the blocker or allowlist the geolocation vendor’s domains, then retry. This one is invisible because the error message looks like a location failure, not a network failure
Two networks at once	The device is on Wi-Fi and cellular simultaneously, or on Wi-Fi and a corporate tunnel, and the signals disagree	Force a single connection. Turn one off, retry, and if it works you have identified the offender

The troubleshooting sequence, in order

Work through these in sequence rather than at random. They are ordered by how often they are the answer and how little effort they cost, so most people stop at step three.

What the error message is actually telling you

The wording differs by operator, but the messages fall into four families, and knowing which one you are looking at saves you from working the whole list.

What the message says	What it means	Where to start
“Unable to verify your location” or “we cannot determine your location”	The check ran and could not resolve a position with enough confidence. This is the signal-quality family	Go outside, switch to cellular, enable precise location
“You are not in a permitted location” or “restricted location”	The check ran, succeeded, and put you somewhere the operator is not licensed	If you believe you really are in the state, this points at a bad Wi-Fi record, an out-of-state IP, or a border buffer
“Plugin not detected,” “no token,” or “geolocation service not running”	The vendor software is missing, not running, out of date, or being blocked by security software. Nothing about your physical location is in question yet	Uninstall, reinstall the current version from the casino’s own download link, restart the machine, and add an exception in your security software
“Location check failed for security reasons,” or a message naming a VPN, proxy or remote connection	The integrity layer objected. Something on the device or the network looks like evasion, whether or not you intended it	Fully quit any VPN, proxy or remote-control software, including background services and tray helpers, then retry

All four produce a reason code in the underlying record. That code, not the friendly message, is what support needs.

Sweepstakes and social casinos

Sweepstakes casinos run location checks too, but the geofence is inverted. A licensed operator allows one state and blocks the other 49. A sweepstakes operator generally allows most of the country and blocks a short list of states where regulators or attorneys general have taken a position against the model, and that list has grown noticeably over the past two years. The checks are usually lighter-touch than a compliance-grade check at a licensed site, but the same causes break them, and the same terms clauses apply if you try to route around one. Our page on sweepstakes blackjack sites covers where the model currently stands.

VPNs: the straight answer

Players ask two different questions and get them tangled. The first is whether using a VPN to play from outside a licensed state is a crime. The second is what happens to you if you do it. The honest answers are very different from each other.

The criminal question

In most US states, ordinary players are not the target of gambling enforcement. State gambling statutes overwhelmingly aim at the operator, the bookmaker and the promoter, and prosecutions of individual online players are vanishingly rare in practice. A handful of states do write player-side offenses into their codes. Washington is the most cited example: RCW 9.46.240 makes knowingly transmitting or receiving gambling information over the internet a class C felony, a provision that has drawn attention for years precisely because of how sharply it is written. Whether an individual player has ever been prosecuted under it is a different matter, and the answer is essentially no.

So the realistic criminal exposure for a player using a VPN is low in most places. That is the end of the good news, and it is also the part that VPN marketing quotes at you. It is not the risk that costs people money.

The contractual question, which is the one that actually bites

• Every wager placed in breach is treated as void, which means winnings from those wagers are cancelled rather than paid.
• The account is closed or permanently suspended.
• The balance can be forfeited, and many operators’ terms say exactly that in so many words.
• The operator can report the account to the state regulator and, in some cases, to industry-wide fraud databases that other licensees consult, which can affect your ability to open accounts elsewhere.

Our page on voided winnings and forfeited balances goes through how those clauses are written and what, if anything, you can do once one has been invoked. It is worth reading before you decide the risk is theoretical, because location breach is one of the two or three most common reasons players lose real money to a terms enforcement, alongside bonus abuse and account sharing.

Why detection at withdrawal is the trap

The most damaging misunderstanding is about timing. Players reason as follows: I logged in with the VPN, it let me in, I played for three weeks, therefore it works. That reasoning is wrong, and it is wrong in the most expensive possible way.

Login-time detection and withdrawal-time review are two different systems on two different clocks. The withdrawal review is where a reviewer goes back over the log with no time pressure and no tolerance for ambiguity. It runs at the same moment as identity verification and source-of-funds checks, which is why so many players discover all of their problems at once. A three-week history of sessions exiting from the same commercial VPN endpoint reads like a highlighted line in a report, because that is what it is.

The result is a familiar and grim sequence: play for weeks without incident, win, request a payout, get asked for documents, get the account frozen, get told the wagers were void under the location clause. The money never arrives, and it was never really yours. Our page on why casino accounts get closed covers what happens next.

To be explicit about what this page will not do: there is nothing here about which services evade detection, and there will not be. The point is that the detection question is the wrong question, because detection at withdrawal is the norm rather than the exception, and the outcome of being caught is losing the balance.

The legitimate VPN case

There is one honest use case worth naming. Plenty of people run a VPN permanently on their laptop or phone for ordinary privacy reasons and have no interest in gambling from the wrong state. If that is you, you still have to turn it off for the gaming session, and you should turn it off completely rather than trusting a split-tunnel exclusion rule. A split tunnel that leaks even the location check’s traffic through the tunnel produces the exact same log entry as deliberate evasion, and the reviewer at the other end cannot tell your motive from the record.

Offshore sites: no geofence, and a different trap

The reason a player in Texas or Georgia or California can reach an online blackjack table at all is simple: offshore sites do not run compliance geolocation. A site licensed in Curacao or Panama has no US state license to protect, no US regulator conducting audits, and no obligation under 31 U.S.C. 5362(10)(B) to block anyone. So it does not. You load the page, you sign up, you play. That absence of a geofence is not an oversight; it is the entire product. Whether that play is lawful for you is a separate question, covered on our page about whether offshore casino sites are legal.

States that recur across those restricted lists include the following, sometimes joined by Michigan, Pennsylvania, Connecticut and West Virginia. The reasons vary: some states have aggressive statutes, some have sent cease-and-desist letters, and some are excluded because the operator does not want to antagonize a regulator whose license it hopes to hold one day.

Two practical points follow. First, if you are going to play at an offshore site at all, read the restricted-jurisdictions section of the terms before you deposit a dollar, not after you win. It is usually near the top of the terms page under a heading such as “eligibility” or “prohibited jurisdictions.” Second, understand that this exposure is on top of the ordinary offshore risks, not instead of them. Our comparison of licensed versus offshore blackjack sites lays out the full trade.

What location data is collected, kept, and who sees it

A compliance geolocation check is a genuine privacy event, and it is worth knowing what it actually gathers.

GeoComply’s published privacy material describes collecting location through satellite, wireless network, internet connection and device performance data, states that it requires customers to send this data under a pseudonym rather than a name, and says it does not resell or cross-share the personal information involved. That pseudonymization is real and it matters, but it does not mean nobody can connect the record to you. The operator holds both halves, the pseudonym and your verified identity, and can join them at will.

Retention is driven by gaming regulation, not by the vendor’s preference. State internal control standards require licensed operators to retain wagering records and the associated compliance records, including location checks, and to produce them to the regulator on demand, typically for a period of years rather than months. That is the point of the logging: an auditor from the Division of Gaming Enforcement or the Gaming Control Board must be able to reconstruct, long after the fact, that each accepted wager was accepted from within the state. There is no realistic way to opt out of that and still play at a licensed site.

Who sees it, in practice: the geolocation vendor, in pseudonymized form; the operator’s compliance, fraud and payments teams, in identified form; the state regulator on audit or in response to a patron complaint; the operator’s independent testing laboratory during certification; and law enforcement under subpoena or other legal process. It is not sold to advertisers by the compliance vendor, and it is not the same data stream as the marketing analytics the casino’s app also collects, which is governed by the operator’s own privacy policy rather than by gaming regulation.

Traveling, and why your account does not travel with you

Three separate things are commonly confused here.

Crossing a state line mid-session

If you are playing on a phone in a car or on a train and you cross out of the licensed state, the next re-check fails and wagering stops. On the Northeast Corridor between Philadelphia and New York, or on I-95 through Delaware, this can happen in the middle of a shoe with no warning beyond a spinner and an error. The session does not end gracefully; it stops accepting bets. The account is fine, the balance is fine, and everything resumes when you are back inside a licensed state. The unresolved hand is handled as described above, and this is a good argument for not playing live dealer blackjack in a moving vehicle.

The reverse also matters. Driving from Ohio into Michigan does not instantly unlock play; you have to be far enough in for the check to resolve cleanly, which is the buffer-zone problem again. Sitting in the first parking lot after the state line is often not far enough.

Playing while visiting a legal state

This works, and it is legitimate. If you live in Illinois and spend a weekend in Detroit, you can play at Michigan-licensed sites while you are there. Most of the seven live states let you register an account from outside the state, with verification handled remotely, though some operators still require you to complete registration while physically in state, so check before you rely on it. What you cannot do is bring the session home with you.

A few practical cautions for visitors. You must be 21 in every regulated state, with no exceptions. Bonus offers are frequently state-specific, so an offer you saw advertised may not exist for the state you are standing in. And identity verification for a new account can take longer than a weekend if your documents need manual review, which is a bad discovery to make on a Saturday night.

Why the account itself does not travel

This is the part people find genuinely counterintuitive. At most multi-state brands, your New Jersey account and your Pennsylvania account are separate accounts even though they share a brand, an app and often a login flow. They have separate wallets, separate balances, separate bonuses and separate loyalty tracking, and money does not move between them. That is not a design choice made for your inconvenience; it follows directly from each state license covering only intrastate activity, and from each regulator supervising only the funds held under its own license. A balance sitting in a state-supervised trust account for New Jersey players cannot simply be transferred into the Pennsylvania pool.

The corollary is that you may have to register separately in each state you play in, verify separately, and deposit separately. Self-exclusion is also state-specific: enrolling in one state’s exclusion program does not automatically enroll you in another’s, though many operators apply an internal block across their whole footprint once you self-exclude anywhere. Our state-by-state blackjack guide covers what is available where.

The checklist

Print this, or keep it in a note. It is the whole page compressed into the things you actually do.

Geolocation FAQ

The short version

Geolocation is not the casino being difficult. It is the load-bearing wall of the entire legal structure that lets a licensed US site deal blackjack at all, written into the UIGEA intrastate exception and into every state’s rules on top of it. Presence, not residency, is the test. The system reads GPS, Wi-Fi, cell towers, IP and device integrity together, and refuses when they disagree or when the answer is uncertain near a border. Most failures are a VPN, a Wi-Fi network or a permission setting, in that order, and most are fixed in under two minutes. And the one thing that genuinely costs players money is not the failed check; it is the decision to work around one, which turns a minor annoyance into a voided balance at the exact moment you try to cash out.

None of the above is legal advice, and the rules in this area move. Verify anything that matters to you with the state regulator that licenses the site you are playing at.

Play within your limits

A location error is frustrating, but frustration is a bad state to gamble in. If you find yourself pushing through a string of failed checks to get back to a table, that urgency is worth paying attention to on its own terms. Set a deposit limit and a session limit before you sit down, and use the cool-off and self-exclusion tools every licensed operator is required to offer. Confidential support is free and available 24 hours a day at 1-800-GAMBLER. Our responsible gambling resources list the state programs and support services worth knowing about.