Sweepstakes Casino Legal States 2026: Operator Master Map (50 States + DC)

Nine US jurisdictions now ban or criminally target dual-currency sweepstakes casinos as of July 2026 (Montana, Connecticut, New Jersey, Nevada, New York, California, Indiana, Maine, and Iowa), and at least six more states carry pending 2026 ban bills. Legal sweepstakes casinos therefore do not have a single national legal status: they have 51 jurisdictional statuses, one for each US state plus the District of Columbia, each the product of a different combination of state gambling statute, attorney general posture, tribal-gaming compact context, payment processor risk policy, and enforcement history. Operators who treat the country as one market and discover the state-by-state structure after launch rebuild their geo-restriction, affiliate qualification, and reporting infrastructure under pressure. Operators who start with a master state map, and refresh it on a committed cadence, absorb regulatory change as a routine operational event rather than a strategic crisis.

This is the master state map. It covers all 50 states plus DC in a single decision matrix designed for operator use, organized by the five regulatory archetypes that actually drive the operator response: permissive, banned (statutory prohibition), restrictive (statutory exclusion), watchful (active AG scrutiny or pending legislation), and tribal-compact-friction. For each jurisdiction, the map records the regulatory archetype, the enforcement context if any is publicly on the record, the payment processor risk level, and the operator action. The deeper state-specific deep dives for California, Texas, New York, and Florida live in their own dedicated guides; this document is the pillar that wires them together and covers the rest.

Why operators need a single master state map (rather than 50 separate documents)

Operators typically accumulate from 30 to 50 disconnected state research memos before discovering that the portfolio cannot drive configuration. The result is a stack of files with different framings, different timestamps, different assumptions about the operator product, and different conclusions about what action to take. The portfolio is unactionable. Product teams configuring geo-restriction infrastructure cannot work from 50 separate documents. Affiliate program managers writing qualification rules cannot map them onto state-level postback logic. Finance teams modeling the impact of a possible state exit cannot reconcile estimates that were prepared at different points in time under different methodological assumptions.

A single master map solves the problem at the level where it actually has to be solved: as a normalized table that every internal team can reference, with a consistent timestamp, a consistent set of decision variables, and a consistent operator-action recommendation per jurisdiction. The deep state-specific guides remain valuable for the highest-volume markets where the operator needs more detail than a master map can carry. But the master map is the document that legal, product, payments, and affiliate teams all reference when configuring the stack and when responding to regulatory change.

For teams new to the US sweepstakes vertical, the master map sits downstream of the broader product framework documented in the sweepstakes casinos USA operator launch playbook and the online sweepstakes casinos operator field guide. Both establish the dual-currency mechanics, the FTC framework, and the AMOE design that the state-level analysis assumes. This document does not re-cover that foundation. It assumes the operator has a defensible sweepstakes product architecture in place and is now configuring the state-level geo and qualification layers around it.

How the legal landscape varies: the five regulatory archetypes

Five regulatory archetypes cover every US state from a sweepstakes operator perspective: permissive, banned, restrictive, watchful, and tribal-compact-friction. The archetype determines the operator action: it is the lens through which the specific statutory, enforcement, and compact details collapse into a configuration decision. Treating each state as a unique snowflake produces 51 unique configurations and an unmaintainable stack. Treating each state as an instance of one of five archetypes produces a stack that is normalized at the configuration layer and that can absorb a state moving between archetypes, as ten states did between May 2025 and July 2026, as a single configuration change rather than as a rebuild.

Banned states (2025-26 statutory ban wave): MT, CT, NJ, NV, NY, CA, IN, ME, IA

Seven statutory bans plus two enforcement statutes landed in the 14 months between May 2025 and July 2026, converting the largest sweepstakes markets in the country into hard-excluded jurisdictions. Montana's SB 555 (signed May 12, 2025) was first; Connecticut's SB 1235 and Nevada's SB 256 followed with October 1, 2025 effective dates; New Jersey's A5447 took effect at signing on August 15, 2025; New York's S5935A took effect at signing on December 5, 2025 and reaches service providers that support sweepstakes operators; California's AB 831 (signed October 11, 2025) took effect January 1, 2026 and removed roughly 17% of US industry revenue in one law; Indiana's HB 1052 (signed March 13, 2026) became effective July 1, 2026 with civil penalties up to $100,000 per violation; Maine's LD 2007 (signed April 6, 2026) takes effect in mid-July 2026; and Iowa's SF 2289 (2026) expanded gaming enforcement authority to reach the model. The operator action is uniform: hard exclusion at the platform and affiliate tracking layers, completed before the effective date, with documented exit evidence retained for enforcement inquiries.

Permissive states (majority): sweepstakes allowed under FTC framework

The majority of US states fall into the permissive archetype. No state-level statute explicitly prohibits dual-currency casino-style sweepstakes, no AG has issued a formal enforcement position against the model, and the state does not have a tribal-gaming compact or regulated online casino regime that creates structural overlap. In these states, sweepstakes operators rely on the federal FTC sweepstakes framework and on general state consumer protection statutes, both of which the product satisfies through standard AMOE design, dual-currency ledger architecture, and disclosure compliance. Permissive states are the accessible market that pays the operator economics. They are also the states where the regulatory environment can change with a single bill, a single AG statement, or a single payment processor risk policy update, which is why the master map is reviewed quarterly rather than treated as static.

Restrictive states (Washington, Idaho): statutory exclusion

Restrictive states have statute-level or constitutional provisions that operators and counsel treat as direct prohibitions on sweepstakes casino operations. Washington is the cleanest case: the state gambling act explicitly prohibits online gambling, and the Washington State Gambling Commission has issued public guidance treating sweepstakes-style casino games as falling within that prohibition. Idaho has a constitutional and statutory framework that defines gambling broadly enough that sweepstakes casino operations cannot be carved out cleanly. Nevada, formerly the third member of this archetype, moved into the banned archetype when SB 256 took effect on October 1, 2025 with Category B felony penalties and extraterritorial liability for out-of-state operators. In each of these states the operator action is unambiguous: hard-exclude at the platform layer and at the affiliate tracking layer.

Watchful states (Michigan plus six pending-bill states): enforcement or legislation in motion

Seven states sit in the watchful archetype as of July 2026: Michigan, where the Michigan Gaming Control Board continues an active cease-and-desist program against sweepstakes operators serving Michigan residents, and the six states with pending 2026 ban legislation: Louisiana (whose 2025 ban bill was vetoed before successor legislation returned), Maryland, Minnesota, Tennessee, Virginia, and Oklahoma. Several of the pending bills copy New York's service-provider prohibition language, which would extend liability beyond operators to payment processors, platform suppliers, and affiliates. The former anchors of this archetype have moved on: New York's S5935A and California's AB 831 converted both states into the banned archetype in December 2025 and January 2026 respectively. The operator action in watchful states is hard exclusion for Michigan, and elevated-vigilance operation with a pre-built exit runbook for the pending-bill states, with each bill tracked to committee level through a dedicated monitoring cadence.

Tribal-compact-friction states (Florida, Oklahoma, others): structural overlap with reserved gaming categories

Tribal-compact-friction states have negotiated compacts between the state and federally recognized tribes that reserve specific categories of gaming to tribal operators. Sweepstakes casino operations are typically structured to operate outside the reserved categories, but the political economy of these states means the tribal sector has both incentive and political capacity to argue that the practical economic substance of dual-currency sweepstakes overlaps with reserved tribal gaming. Florida is the most prominent example, with one of the most extensive tribal-gaming exclusivity frameworks in the country. Oklahoma pairs the same compact backdrop with a pending 2026 ban bill, and the pattern helps explain why compact states convert to bans quickly once tribal operators back the legislation: Connecticut and California both carried tribal-compact friction before their 2025 bans. The operator action in tribal-compact-friction states is to operate cautiously, document the dual-currency mechanic clearly enough to defend its distinction from class III gaming, and maintain contingency infrastructure for a possible compact-driven legislative event.

The 50-state master map: operator decision matrix

The table below is the operator-decision master map. Every US state plus DC has a row. Each row records the regulatory archetype, the enforcement context where one is publicly on the record, the payment processor risk level, and the operator action. The "Verify with counsel" cells flag jurisdictions where the operator should not rely solely on the master map and should obtain state-specific counsel before launching commercial activity. The payment processor risk column captures the marginal risk relative to a generic permissive baseline: most permissive states carry low marginal risk; restrictive and watchful states carry elevated risk that can spill into payment processor account closure even without direct AG action.

The "verify with counsel" annotation across the permissive states is not boilerplate. It reflects the operator-side practical reality that even in a state without direct enforcement record, the legal posture should be confirmed by counsel familiar with that state's consumer protection framework before commercial activity is scaled. The cells flagged "see compliance guide" link to the dedicated state-specific deep dives: the California sweepstakes operator compliance guide, the Texas sweepstakes operator compliance guide, the New York sweepstakes operator compliance guide, and the Florida sweepstakes operator compliance guide. Operators with material revenue exposure in any of those states should treat the relevant deep dive as required reading alongside the master map.

Recent changes: the 2025-26 ban wave changelog

Ten archetype moves hit this map between May 2025 and July 2026, the fastest regulatory repricing any US gaming vertical has absorbed since PASPA fell. The changelog below is the authoritative record of what changed and when; each entry stays listed for at least four quarters so anyone who cited an earlier version of this map can reconcile the differences.

How operators implement the geo-restriction layer

The master map drives platform configuration through three layers of geo-restriction. Each layer catches a different category of edge case, and together they make state-level exclusion robust against the failure modes that arise when only one layer is implemented. Operators who run only one layer (typically IP-based geo-fencing) consistently find that a non-trivial share of restricted-state activity slips through, either through VPN use, IP misattribution, or session-state edge cases. Operators who run all three layers turn restricted-state leakage into a measurable and small residual that the affiliate tracking system can catch as a final backstop.

IP-based geo-fencing

IP-based geo-fencing is the first layer and the easiest to implement. The operator integrates an IP geolocation service that maps each incoming request to a state-level location, and the application logic refuses to serve registration, login, purchase, or gameplay endpoints when the source IP resolves to a restricted state. The strengths of IP-based geo-fencing are coverage (every request can be checked), speed (the check runs in milliseconds), and operational simplicity (a single integration covers the whole platform). The limitations are also structural: VPN traffic and proxy traffic can defeat IP-based checks, IP geolocation databases have inherent accuracy gaps especially at state boundaries, and shared IP infrastructure (mobile carrier NAT, corporate VPN gateways) can produce false-positive blocking that frustrates legitimate non-restricted-state users.

Registration-state geo-validation

Registration-state geo-validation is the second layer. At account creation, the operator collects the user's residential address and validates that the state is not on the restricted list. This is the layer that catches users in non-restricted-state IP locations who attempt to register with restricted-state residential addresses. The validation can be tightened by requiring address verification through a third-party identity verification service or through KYC document review at higher purchase thresholds. The limitation of registration-state validation is that it relies on user-supplied data: a user can attempt to register with a false address, which makes registration-state validation effective primarily against unsophisticated edge cases and against legitimate users whose IP location does not match their residential state for benign reasons.

Per-session geo re-check

Per-session geo re-check is the third layer. At login, purchase, redemption, and other commission-eligible events, the operator re-checks the current IP geolocation against the restricted-state list and against the user's registration-time residential state. Discrepancies (a user with a non-restricted-state registration address logging in from a restricted-state IP, or vice versa) are flagged and can be configured to block the in-flight action, to require additional identity verification, or to be logged for review without blocking. Per-session geo re-check is the layer that catches the long-tail of edge cases: users who legitimately move between states, users who attempt to use restricted-state access through travel timing, and users who use a VPN to defeat IP-based geo-fencing at registration and then forget to keep the VPN active during normal use.

Affiliate program impact of geo-restrictions

State-level geo-restrictions produce two affiliate program requirements: commission qualification rules that exclude restricted-state activity from triggering events, and clear affiliate communication about which states are excluded. Operators who implement geo-restriction at the platform layer without extending it to the affiliate layer end up either paying commissions on restricted-state activity that should have been excluded (program economics leakage) or refusing commissions inconsistently across affiliates (program trust damage). The affiliate layer configuration is non-negotiable for a defensible sweepstakes operation.

Commission economics compound the compliance requirement. Sweepstakes programs pay CPA on first purchase, RevShare on net purchase revenue (the sweepstakes analog of the GGR-to-NGR deduction chain in regulated iGaming, with prize redemptions playing the role of the tax line), or hybrid structures combining both, and every model needs geo-validation wired into its qualification rules. State exits also concentrate fraud: when a ban takes effect, bonus abuse, multi-account registration, and self-referral schemes spike as players and opportunistic affiliates try to route around geo-fencing, so fraud screening thresholds should tighten in the quarter around every effective date. Player lifetime value models need state-level cohorts too, because a banned state's cohort truncates on the effective date while negative carryover terms decide who absorbs the resulting RevShare shortfall. None of this exists in single-license regimes like the MGA or UKGC markets; it is the specific operational tax of running a 51-jurisdiction map.

Commission qualification under geo-fencing

Commission qualification rules should treat geo-validation as a first-class qualifier alongside minimum purchase amount, account uniqueness, and fraud screening. Every commission-eligible event (registration, first purchase, RevShare-eligible purchase activity, redemption-impacting events) carries a geo attribute, and the qualification logic refuses to fire commissions when the geo attribute resolves to a restricted state. The Track360 fraud detection infrastructure supports geo-validation as a qualification rule that runs at postback time, applied uniformly across all affiliates without manual exception handling. This is the configuration that lets operators run a uniform affiliate program nationally while excluding restricted-state activity at the commission engine level.

Affiliate communication on state exclusions

Affiliates need to know which states are excluded so they can configure their own targeting accordingly. Affiliates who unknowingly drive restricted-state traffic into the operator funnel experience high click-to-commission gaps that look like fraud or like operator misbehavior, both of which damage the operator partnership. The operator affiliate program agreement should specify the current restricted-state list, should reserve the operator's right to update the list with notice, and should make clear that commissions are not paid on traffic from restricted states regardless of conversion outcome. The affiliate-facing reporting interface should surface restricted-state-attributed click volume distinctly so affiliates can see what their state-targeting mix looks like and adjust the geo-targeting on their campaigns. Operators who hide this data behind aggregate reporting create partnership friction that is entirely avoidable.

Refresh cadence: how operators stay current as the landscape changes

The master state map is a living artifact. Pending legislation, new AG positions, payment processor risk policy updates, and state-level enforcement actions can all shift the archetype assignment or the operator action for any given state. The operators who treat the map as a one-time launch input consistently discover that their state configuration is out of date when a regulatory event arrives. The operators who treat the map as a recurring artifact, with a defined refresh cadence and a documented update workflow, absorb regulatory change as a routine internal process.

1. Quarterly counsel review: external counsel re-reads the full map every quarter, flags any state that has moved between archetypes, and documents the change in a versioned update note that the operator distributes internally.
2. Continuous legislative monitoring: a designated team or external monitoring service tracks pending bills in each state legislature, with weekly or biweekly summaries flagging any bill that could shift a state's archetype assignment.
3. AG enforcement watch: the same monitoring function tracks AG announcements, consent decrees, and enforcement actions across all states, escalating any item that affects sweepstakes operator posture.
4. Payment processor risk feedback: card processor and acquiring bank communications are reviewed for any state-specific risk policy updates, and the map's payment processor risk column is updated to reflect the current processor posture.
5. Event-driven updates: any single material event (a new bill passing committee, an AG complaint filed, a payment processor pulling a sweepstakes merchant account) triggers an out-of-cycle review of the affected state and surrounding states.
6. Version control on the map itself: the master map is stored as a versioned artifact with timestamps and change notes, so internal teams configuring the platform stack can always reference the specific version their configuration is built against.

The refresh cadence is the discipline that turns the master map from a static document into operational infrastructure. Operators whose map carries a January timestamp in October are running the platform against a fundamentally outdated configuration. Operators whose map is refreshed quarterly, updated event-driven, and versioned for internal reference are running the platform against current intelligence. The cost of the refresh cadence is modest. The cost of not running it is the cost of reacting to regulatory change with stale assumptions, which is consistently the most expensive failure mode in the US sweepstakes vertical.

Methodology & Sources

Three source classes feed this map: enacted bill texts, regulator publications, and Track360 platform analysis. The statutes of record are SB 555 (MT), SB 1235 (CT), A5447 (NJ), SB 256 (NV), S5935A (NY), AB 831 (CA), HB 1052 (IN), LD 2007 (ME), and SF 2289 (IA); regulator and enforcement context comes from bodies including the Washington State Gambling Commission, the Michigan Gaming Control Board, and the New York State Gaming Commission; program-level observations come from Track360 analysis of sweepstakes operator affiliate programs. Archetype assignments and payment processor risk ratings are Track360 editorial judgments applied consistently across all 51 jurisdictions; they are operator decision inputs, not legal advice, and the verify-with-counsel annotations mean exactly what they say. Federal sweepstakes framework context follows FTC business guidance on sweepstakes and contests and FTC endorsement disclosure requirements for affiliate marketing.

Last updated July 18, 2026. This map is reviewed quarterly (January, April, July, October), with out-of-cycle updates within one review cycle of any enacted ban, veto, effective date, or material enforcement action. If an enacted statute contradicts a cell in the master map, the statute wins and the map is corrected at the next review.

A 50-state map of legal sweepstakes casinos is not a document. It is operational infrastructure. The operators who treat it as a one-time launch input keep rediscovering the state-by-state structure under regulatory pressure. The operators who treat it as a versioned, refreshed, archetype-normalized artifact configure the platform and the affiliate program once and absorb every subsequent state-level change as a routine update.