Grace Buczak
Associate Editor
Loyola University Chicago School of Law, JD 2027
The explosive growth of online sports betting in the United States over the past decade has created a complex regulatory frontier for digital wagering platforms. After the U.S. Supreme Court struck down the federal ban on sports gambling in Murphy v. NCAA, states have individually determined how and whether to legalize mobile sports wagering. This state-by-state patchwork, combined with the rise of innovative betting products, has generated compliance challenges in age verification, geolocation enforcement, consumer protection, anti-money laundering obligations, and advertising—issues that extend far beyond traditional in-person gambling regulation.
Licensing and the post-Murphy regulatory landscape
Before 2018, the Professional and Amateur Sports Protection Act (PASPA) effectively prohibited states from legalizing sports betting outside limited exceptions. The Supreme Court’s decision in Murphy v. NCAA held that PASPA’s restriction could not be enforced under the anti-commandeering doctrine, allowing states to legalize sports betting independently. In the wake of Murphy, both physical and digital sports wagering began expanding rapidly. By 2025, 38 states and the District of Columbia had legalized commercial sports betting, with many authorizing online mobile wagering options. Yet, the absence of a unified federal framework means that each state retains autonomy over licensing, operational requirements, and enforcement, creating complexity for operators who must maintain compliance across dozens of regimes.
State regulatory agencies administer licensing and oversight of online sportsbook operators. For example, the Illinois Sports Wagering Act tasks the Illinois Gaming Board with licensing digital sportsbooks and even empowers regulators to restrict advertising and promotional activity in certain contexts. Despite these structures, some online platforms have attempted to bypass state gaming laws entirely by arguing that federal oversight should preempt state authority. However, courts have generally upheld state authority in regulating intrastate gambling, reinforcing the power of state commissions. This ongoing tension between state and federal oversight continues to shape the legal landscape for digital sports betting.
Digital sportsbooks must ensure that users placing bets are physically located within the state where the operator is licensed. This requirement flows both from individual state statutes and federal law; the U.S. Federal Wire Act prohibits interstate gambling, meaning operators must take precise steps to avoid accepting bets from outside licensed jurisdictions. To meet this obligation, platforms incorporate layered geolocation technologies to confirm user location at the time of wagering. For example, an Illinois-based sportsbook cannot accept bets from a user physically located in Indiana without violating state and federal law. Failure to enforce jurisdictional limits can jeopardize an operator’s compliance status and expose it to enforcement actions or fines, as regulators have signaled across multiple states that cross-border wagering will not be tolerated without proper licensing.
Responsible gaming and consumer protection
Online sports betting operators also face compliance requirements designed to protect consumers and promote responsible gaming. Industry codes of conduct, like the Responsible Marketing Code for Sports Wagering, further guide operators on including responsible gaming messages and legal age reminders across digital channels, including apps and affiliated marketing. For instance, operators may be instructed to display mandatory pop-up alerts when a user has been betting for an extended period, or to provide clear, accessible links to self-exclusion and gambling help resources within their apps. Additionally, municipal authorities have begun to pursue litigation against operators for alleged exploitative practices. For example, the city of Baltimore sued major sports betting companies, claiming their promotional strategies and use of user data targeted vulnerable populations and fostered compulsive gambling behaviors, potentially violating consumer protection statutes.
Like financial institutions, sports betting platforms must implement anti-money laundering (AML) and know-your-customer (KYC) protocols to monitor suspicious financial activity and comply with both state and federal requirements. These practices are essential to prevent fraud, money laundering, and other illicit financial schemes from leveraging digital sports wagering infrastructure. Privacy compliance also intersects with consumer protection and data security expectations. While the U.S. does not have a single federal privacy regime akin to the EU’s GDPR, various state laws, such as the California Consumer Privacy Act (CCPA), impose obligations on the collection, storage, and use of personal data, heightening the compliance burden for nationwide operators.
Advertising and digital marketing compliance
Digital marketing and promotions are another area fraught with compliance risk. Operators must ensure that advertising content adheres to state rules about targeting and message content, including responsible gaming reminders and restrictions on reaching underage audiences. Studies have found that major gambling operators may fail to consistently include such messaging across social media platforms, raising questions about compliance with both industry codes and state statutes. States such as Illinois have adopted additional restrictions, such as banning sports betting advertising during live sports broadcasts and on college campuses, which places further constraints on operator marketing strategies.
The digital transformation of sports betting brings unprecedented regulatory complexity. Online sports wagering apps must manage a multi-layered compliance landscape shaped by state gaming statutes, federal law, consumer protection principles, anti-money laundering obligations, and public health-oriented responsible gaming requirements. Operators face mounting pressure to ensure that their compliance programs are robust, adaptive, and technologically sophisticated.