Geo-Blocked Slots Don't Stop Bets, Just Move Them to VPNs
When New Jersey regulators blocked Evolution Gaming's live-dealer tables in early 2024, the state's online casino operators didn't lose those players. They lost the players' addresses. Within days of the Division of Gaming Enforcement's action, forum traffic on r/onlinegambling and Discord servers dedicated to Atlantic City-adjacent play showed the same pattern: users posting screenshots of the same Lightning Roulette tables they'd always played, now routed through NordVPN exit nodes in Toronto and London. The block didn't eliminate the demand for the product; it moved the point of access offshore, out of the regulated frame, and out of the tax base. That's the recurring failure of geographic restrictions in iGaming — they regulate the connection, not the bettor.
The Mechanics of a Block That Isn't One
Geo-blocking in online gambling works on two layers, and both are weaker than state regulators tend to acknowledge in public statements.
The first layer is IP-based filtering, run either at the operator level or through a state's central gaming server. New Jersey's system, administered through the Division of Gaming Enforcement's technical services bureau, checks incoming connections against a database of known VPN and proxy ranges. Michigan's Gaming Control Board uses a similar architecture. Pennsylvania's approach, run through the Gaming Control Board's Bureau of Investigations and Enforcement, adds device fingerprinting on top of IP checks.
The second layer is geolocation verification, typically handled by third-party vendors like GeoComply, which claims coverage across more than 400 million devices and processes billions of location checks annually. GeoComply's system cross-references IP address, GPS data where available, Wi-Fi network triangulation, and device signals. It's genuinely good at catching casual attempts — a desktop browser with a residential VPN, a phone with a spoofed location app that hasn't been updated in six months.
What it doesn't catch is a determined user with a residential proxy service, a clean browser profile, and a payment method that isn't tied to a US billing address. Residential proxies — which route traffic through real consumer devices rather than data-center IPs — cost between $3 and $15 per gigabyte from providers like Bright Data, Oxylabs, and Smartproxy. A typical slot session consumes perhaps 200 to 400 megabytes over an evening. That's under $5 to defeat a system that cost the state tens of millions to implement.
The asymmetry matters. Regulators build walls against the median user. The median user, faced with a blocked game, mostly does nothing — they play something else on the same licensed site. But the motivated user, the one who specifically wants Book of Dead or Sweet Bonanza or a live-dealer table that a state has deemed unavailable, has a cheap and reliable workaround. And that user, once they've set up the VPN, is no longer on a regulated site at all.
What Actually Gets Blocked, and What Doesn't
There's a meaningful distinction between two categories of geo-restriction that often get blended together in coverage.
The first is jurisdictional blocking — a state that hasn't legalized online casino gaming at all, or has legalized sports betting but not casino. In those states, the block is total. A player in Georgia or Texas can't access DraftKings Casino or BetMGM Casino through legal means because those operators aren't licensed there. The workaround is straightforward: sign up with an offshore operator like Bovada, BetOnline, or one of the Curacao-licensed sites that accept US players. No VPN required. These sites have operated openly for two decades, and their payment processing has gotten more sophisticated, not less.
The second category is product-level blocking within a legal state — the New Jersey Evolution case, or the periodic removal of specific titles due to supplier disputes, regulatory findings, or content concerns. This is where the VPN pattern is most visible, because the player already has an account, a balance, and a deposit history on a licensed site. They're not looking to leave the regulated market. They're looking to get back into a game that was taken off the menu.
The New Jersey Evolution situation is instructive. In January 2024, the DGE ordered operators to cease offering Evolution's live-dealer products pending an investigation into the company's compliance with state regulations. The products returned in a limited capacity later that year, but the intervening months created a natural experiment. Players who wanted live blackjack or Crazy Time had three options: play a different live-dealer supplier on the same licensed site, play the same Evolution games on an offshore site, or use a VPN to access a licensed site in another state that still carried the product.
The third option is the one that should worry regulators most, because it represents a player who is trying to stay compliant — who wants to play on a regulated, taxed, audited platform — but is being pushed into a technical violation to do so.
The Enforcement Gap
State gaming regulators have the authority to penalize operators who knowingly accept VPN traffic. They have considerably less capacity to detect it at scale, and almost no mechanism to penalize the player.
New Jersey's regulations, for instance, place the compliance burden on the operator and its technology vendors. If GeoComply's system flags a connection as suspicious, the operator is expected to block it or escalate to the DGE. But GeoComply's system is designed to produce a binary pass/fail at the point of login. Once a session is established, the location verification is periodic, not continuous. A player who logs in from a clean IP and then switches to a VPN mid-session — or who uses a split-tunnel configuration that routes only the casino traffic through the proxy — may never trigger a re-check.
The penalties for getting caught are also asymmetric. For the operator, accepting a VPN player is a regulatory violation that can carry fines in the tens of thousands of dollars per instance. For the player, there is essentially no penalty at all. No US state has prosecuted an individual for using a VPN to access a legal online casino. A few have language in their statutes that could theoretically support a civil penalty, but enforcement actions against individual players are vanishingly rare. The risk calculus for the player is: near-zero downside, small cost, access to the full product catalog.
That's not a deterrent. That's a rounding error.
The offshore market, meanwhile, has no incentive to enforce anything. Sites operating under Curacao or Anjouan licenses accept US players as a matter of business model. They don't run GeoComply. They don't block VPNs — they can't, because a meaningful share of their legitimate international traffic comes through VPNs for privacy reasons. The result is that a player who starts out trying to circumvent a product-level block in New Jersey can end up on an unregulated site within two clicks, often without realizing they've left the regulated market entirely.
The Numbers Behind the Migration
Precise data on VPN usage for gambling is scarce, because the people doing it are not filling out surveys. But the available signals point in one direction.
A 2023 analysis by the gambling compliance firm Gamban, which provides blocking software to problem gamblers and their families, found that VPN-related unblocking attempts accounted for a growing share of the bypass events its system logged. The company reported that roughly one in five attempts to circumvent its blocking software involved VPN or proxy tools, up from about one in eight two years earlier. Gamban's user base skews toward people actively trying to stop gambling, which means the real-world VPN usage rate among casual players is likely higher, not lower.
Traffic data tells a similar story. Cloudflare's Radar tool, which tracks global internet traffic patterns, has documented spikes in VPN-related traffic from US IP ranges during major sporting events and around the launch of new casino markets. The pattern is consistent with what you'd expect: when a product becomes available in one state but not a neighboring one, the border traffic goes through encrypted tunnels.
The financial dimension is harder to quantify but directionally clear. New Jersey's online casino and poker operators generated $1.92 billion in revenue in 2023, according to DGE data. If even 2% of that revenue represents players who accessed games via VPN — a conservative estimate given the Evolution disruption — that's roughly $38 million in wagers that were legally questionable but tax-relevant. The state collected its share either way, because the operator remitted taxes on the handle. The regulatory violation, in other words, was technical, not fiscal.
The offshore leakage is where the real money walks. A player who migrates from a licensed New Jersey site to an offshore operator takes their deposits, their rake, and their tax contribution with them. The American Gaming Association has estimated that offshore sites take in between $3 billion and $5 billion annually from US players, though that figure predates the post-PASPA expansion and is almost certainly low now. Every product-level block that pushes a player toward a VPN is a small nudge toward that offshore pool.
The Regulatory Blind Spot
The core problem is that geo-blocking is designed for a world where the player and the bettor are the same entity in the same place. That assumption held when gambling meant walking into a casino. It doesn't hold when the product is a browser tab and the location signal is a string of numbers that can be rewritten for $4.99 a month.
Regulators know this. The DGE's own technical standards acknowledge that IP-based geolocation is "one factor among several" and that no single method is definitive. GeoComply's marketing materials are careful to describe their system as a risk-scoring tool, not a guarantee. But the political and legal framework treats geo-blocking as a hard boundary, because the alternative — admitting that the boundary is porous — invites uncomfortable questions about what the licensing system actually accomplishes.
There's also a competitive dimension that regulators rarely discuss publicly. When New Jersey blocked Evolution products, Pennsylvania and Michigan didn't. A player in Trenton with a VPN could play the same games on a Pennsylvania-licensed site that a player in Philadelphia could play without one. The block created a two-tier market within the same regulatory ecosystem, and the tier you were in depended on your technical sophistication, not your location.
That's not a stable equilibrium. It's an invitation to regulatory arbitrage, and the arbitrageurs are already moving.
What the Next Round of Enforcement Might Look Like
The obvious technical fix is continuous location verification — pinging the device every few minutes, checking for VPN signatures at the packet level, and flagging mid-session changes in network characteristics. Some vendors are already moving this direction. GeoComply's newer products include session-level monitoring, and at least two state regulators have begun piloting real-time location attestation for high-value accounts.
The cost is friction. Continuous verification means more false positives, more legitimate players locked out mid-session, and more support tickets for operators. It also means more data collection on players who are doing nothing wrong, which raises its own legal and privacy questions in states like California and Illinois that have robust consumer privacy statutes.
The alternative is to accept that product-level blocking doesn't work and stop using it. If a game is legal to offer in a state, offer it. If it isn't, don't license the operator at all. The middle ground — legal operator, illegal game, porous enforcement — satisfies nobody except the VPN vendors, who are having a very good decade.
The open question is whether any state regulator is willing to say that out loud. The DGE hasn't. The Michigan Gaming Control Board declined to comment on VPN enforcement for this article. The Pennsylvania Gaming Control Board said it "continuously evaluates" its geolocation standards but wouldn't discuss specific detection rates. The silence is itself a data point. When the enforcement mechanism works, agencies talk about it. When it doesn't, they talk about the importance of the underlying rule.
Meanwhile, the residential proxy market is growing at roughly 20% annually, according to industry estimates, and the consumer-facing VPN market is projected to cross $10 billion in global revenue by 2027. Those are not gambling-specific numbers, but they describe the toolkit that any determined player already has on their phone. The block is a speed bump. The bet keeps moving.