How Online Sweepstakes Casinos Work — and Why Geolocation Is Now a Legal Requirement

Sweepstakes casinos are platforms that offer casino-style games — slots, blackjack, poker, virtual sports wagering — without being classified as gambling under US law. The legal architecture that makes this possible rests on three pillars: federal sweepstakes law, the "no purchase necessary" principle, and a dual-currency model.

Under US law, a lottery or gambling activity requires three elements to be present simultaneously: consideration (something of value wagered), chance (a random outcome), and prize (something of value won). Traditional gambling has all three. Sweepstakes operators argue they remove consideration by providing a free alternative method of entry — breaking the legal definition of gambling even while offering functionally identical gameplay.

Federal guidelines and most state statutes recognize promotional sweepstakes as legal so long as participants can enter without making a purchase. The mail-in entry method — requesting free coins by post — is the canonical example of how sweepstakes casinos satisfy this requirement on paper, even when the vast majority of players enter by purchasing Gold Coins.

The mechanism through which sweepstakes casinos implement this legal framework is the dual-currency system:

Players can toggle freely between Gold Coin mode and Sweeps Coin mode in the same games. In practice, critics note that the free entry method — typically yielding a handful of Sweeps Coins per day — is so limited that meaningful play and prize accumulation requires purchasing Gold Coins. Courts and regulators in multiple states have cited this economic reality as evidence that the "no consideration" defense is largely illusory.

After years of operating in a legal grey area, sweepstakes casinos faced a coordinated regulatory response in 2025 that fundamentally changed the industry's risk profile. Multiple state legislatures passed formal bans, attorneys general issued hundreds of cease-and-desist orders, and the legal theory underlying the dual-currency model came under direct challenge in federal court.

States that didn't pass formal bans in 2025 often pursued enforcement through existing law. Louisiana's legislature passed a ban bill unanimously 39–0 — only for Governor Landry to veto it — at which point the Louisiana Gaming Control Board immediately issued 40 cease-and-desist letters to sweepstakes operators. Maryland and Mississippi legislators declined to pass bans but sent cease-and-desist letters through state gaming agencies. Arizona and Michigan collectively sent more than 100 cease-and-desist letters across 2025.

The message from regulators is clear: formal legislation is one path, but aggressive enforcement under existing law is another. Operators cannot rely on the absence of a state ban as safety.

The regulatory pressure on sweepstakes casinos has extended to the mobile distribution layer, with both Apple and Google tightening their policies in ways that directly affect how sweepstakes platforms can reach users on mobile devices.

On October 28, 2025, Google amended its Gambling & Games advertising policy with a single sentence that closed a loophole sweepstakes operators had relied on for years: "Examples of games that are not social casino games: Sweepstake casinos." Previously, sweepstakes platforms could advertise under Google's lighter social casino certification. Under the new policy, they are reclassified as online gambling products subject to strict licensing requirements.

For North American markets where sweepstakes casinos operate without gambling licenses, this reclassification effectively prevents them from advertising on Google Ads or reaching new users through Google's advertising network. Affiliates and media partners promoting sweepstakes products must now comply with the same standards as licensed gambling operators or risk account suspension.

Google Play's developer policies separately require that any app enabling users to win real-world monetary value must meet strict eligibility requirements including proper gambling licensing — a threshold most sweepstakes operators cannot meet because their business model is explicitly designed to operate outside the licensed gambling framework.

Apple's App Store guidelines under Section 5.3 take a more permissive but conditions-based approach. Real money gaming apps — and apps whose gameplay is functionally equivalent to real money gaming — are permitted on the App Store subject to three core requirements: they must have necessary licensing and permissions in each jurisdiction where the app is used; they must be geo-restricted to those permitted locations; and they must be free to download.

The geo-restriction requirement is particularly significant: Apple explicitly mandates that operators implement jurisdiction-level blocking as a condition of App Store distribution. This is not a recommendation — it is a distribution requirement. Apps that fail to adequately geo-restrict their availability to licensed jurisdictions are subject to removal.

Additional App Store rules prohibit using in-app purchases to buy currency for real money gaming, require sweepstakes official rules to be presented in-app, and mandate that Apple is clearly disclosed as not a sponsor.

Given the regulatory environment described above, effective geolocation is not optional for sweepstakes operators — it is a legal prerequisite for continued operation in permitted jurisdictions and a primary defense against liability in banned ones. Yet the dominant approach to geolocation — IP address lookup — is systematically unreliable in exactly the ways that matter most for compliance.

IP geolocation accuracy for mobile connections has fallen to 40–55% at the city level, driven by the widespread adoption of residential VPNs, carrier-grade NAT that places thousands of mobile users behind a single IP address, and cloud infrastructure that allows users to tunnel traffic through servers in any jurisdiction. A determined user in a banned state can defeat an IP-only check in under two minutes using a consumer VPN costing less than $10 per month.

Regulators are aware of this. New York's enforcement guidance specifically references VPN bypass as a compliance concern. California's Sweepstakes Gambling Task Force has cited IP manipulation in cease-and-desist correspondence. An operator whose geolocation consists of a single IP lookup is not demonstrating "best effort" compliance — they are providing regulators with documentation of a known-inadequate control.

A defensible geolocation compliance posture for a sweepstakes operator in 2026 requires multiple independent signals that are difficult to simultaneously forge:

Peabody Compliance was built specifically for regulated and compliance-sensitive industries where location verification must be tamper-resistant, auditable, and defensible under regulatory scrutiny. Our Multi-Signal Integrity (MSI) architecture fuses GPS metadata, IP intelligence, and device integrity signals into a single scored verdict, delivered in under 200 milliseconds.

For sweepstakes operators specifically, the platform addresses each of the compliance requirements identified above:

All verification sessions generate a cryptographically signed audit record with server-side timestamps, signal breakdown, and the final integrity score. These records are retained for two years on Business plans and five years on Enterprise plans — meeting or exceeding the record-keeping requirements of the major regulated jurisdictions including US state gaming authorities and Brazil's SPA framework.

The sweepstakes casino industry has entered a period of permanent regulatory pressure. The states that banned dual-currency operations in 2025 are unlikely to reverse course; the states currently considering legislation are more likely to pass bans than not, given the political momentum and the financial backing of state-licensed casino interests who view sweepstakes platforms as unlicensed competition.

The operators who survive this transition will be those who build verifiable compliance infrastructure — not because it eliminates legal risk entirely, but because it demonstrates the good-faith effort that regulators and courts use to distinguish compliant operators from bad actors.

Geolocation compliance has moved from a product feature to a legal necessity. The question for operators and their technology vendors is not whether to implement it, but whether their implementation is genuinely tamper-resistant — or merely box-checking.