Image credit: Source: company disclosures.
Every legal online bet in the United States passes an invisible test before it is accepted: proof the bettor is physically inside a licensed state. That check is the rail the whole regulated market runs on, and for years effectively one company, GeoComply, ran more than 90% of it.
Geolocation compliance is the least-discussed critical system in US betting. Nobody markets it, no bettor thinks about it, and without it the state-by-state model is illegal. It is the load-bearing wall behind the industry, and in 2026 that wall is starting to show cracks.
Why every bet gets located
The requirement flows straight from how the US legalised betting.
When the Supreme Court struck down the federal ban in 2018, it handed the decision to each state, and legal wagering became a patchwork of individual markets. A licensed operator may take bets only from customers physically within a state that permits them, and a wager that crosses state lines runs into state rules and the federal Wire Act, as the standard explainers of the model lay out. There is no national licence. There is only fifty separate permissions, and a bet must be pinned to the right one every time.
That is a hard engineering problem dressed as a compliance checkbox. Confirming a phone is inside New Jersey and not across the river in New York, at the moment of the bet, at the scale of a Sunday slate, is the job. The industry solved it by outsourcing to a specialist, and the specialist became a chokepoint.
The scale of the chokepoint
GeoComply's clients "commanded more than 90% of the U.S. sports betting market," per Sportico. The company says it handles more than 2 billion transactions a month.
The event-day figures show what that means in practice.
- Super Bowl LIX in February 2025 drove a peak of 14,300 geolocation transactions per second just before halftime, and more than 724,400 new wagering accounts across regulated states over the weekend, GeoComply reported.
- Missouri's launch on 1 December 2025 generated over 2.6 million geolocation checks statewide in the first 24 hours, across 250,000-plus accounts and the state's eight licensed books, per Casino.org.
Every one of those checks is a gate. Fail it and the bet is refused. The same system also does the market's fraud work, catching VPNs, spoofing and proxy betting, and it doubles as a data source on illegal play. Note one common misattribution: the widely cited figure that Americans wager around $673.6 billion with illegal operators, roughly a third of the market, is the American Gaming Association's estimate, not GeoComply's.
The single point of failure
A rail that carries 90% of a market is also its single point of failure, and that is not hypothetical.
On a Thursday night in October 2020, a GeoComply internal network fault took online sportsbooks, casinos and poker offline for about an hour across New Jersey, Nevada, Oregon and Indiana. No bets, no deposits, no play, in the middle of an NFL night, because one vendor's datacentre stumbled. The company stressed it was an isolated internal issue, not a security breach. The lesson stood anyway: the industry had wired its entire compliance layer to a component with no redundancy.
For years operators accepted that because the alternative, building geolocation in-house, made no sense. This is the classic build-versus-buy calculation, and geolocation was the clearest "buy" in the stack. The result was a market that could not function if one private company had a bad hour.
The wall starts to crack
The concentration story is now changing, and 2026 is the turn.
GeoComply's legal moat sprang a leak first. It sued rival Xpoint for patent infringement, and lost: in November 2024 the US Court of Appeals for the Federal Circuit upheld a ruling that invalidated GeoComply's patent as insufficiently inventive, leaving Xpoint free to compete. A lower-cost challenger, Radar, has since entered the same lane.
The pressure showed up in GeoComply's own accounts. In April 2026 the company cut fewer than 80 staff, around 18% of its workforce, citing regulatory shifts, AI and the new competition, per Sportico. A vendor that spent years as the default is now defending share on price and patents at once. GeoComply itself was built on outside capital, taken to unicorn status by a 2021 Blackstone-led round and a later 2023 round reported north of $100 million, and that scale now has to justify itself against cheaper rivals doing the same job.
There is a deeper threat too. Prediction markets route around the entire model. Kalshi and its peers operate under federal CFTC oversight, offer event contracts nationwide, and do not run the state-by-state geolocation gate at all. If federally regulated contracts keep taking betting-shaped volume, they erode the very regime that made geolocation compliance mandatory in the first place.
The rail finally gets a second
Geolocation is the quiet infrastructure that made state-by-state betting possible, and depending on one provider for it was the market's accepted risk. Events like a record World Cup handle only raise the stakes on a rail that has to hold at 14,000 checks a second.
The shift now under way is toward redundancy the market should have wanted all along: a second serious geolocation vendor, price competition on a commodity compliance layer, and, at the edge, a federal betting model that does not need the rail at all. GeoComply built something genuinely load-bearing, which is exactly why a market this large should never have leaned its full weight on one wall. It is finally getting a second.
Related: US iGaming Legalization Is Stuck: Here Is Why | US Sportsbooks Project Record World Cup Handle as 2026 Tournament Opens | The iGaming Platform Is an Operator's Biggest Bet | Kalshi Sues Illinois to Block Prediction Market Betting Tax