Responsible Gambling Limits Set at Signup Get Ignored 71% of the Time
A deposit limit entered during account creation was still in force 30 days later in fewer than three of every ten accounts that set one, according to a six-month audit of 4,200 U.S.-facing online casino and sportsbook accounts conducted by a payments-compliance consultancy and shared with me ahead of publication. The figure — 71% of signup-time limits either raised, removed, or quietly lapsed — is the kind of number the industry prefers to discuss as a UX problem rather than a player-protection one. The audit suggests it is both, and that the design choices behind it are not accidental.
The study, run between August 2024 and February 2025 by a firm that asked not to be named because two of its clients are licensed operators, tracked a volunteer panel of adult gamblers who agreed to install a screen-recording app and share account statements. Participants were recruited through a mix of Reddit communities, a gambling-harm support forum, and a paid survey panel; the sample skews male (68%) and toward players who gamble at least weekly (61%), which the authors flag as a limitation. What the recordings show is less about willpower than about friction — and where the friction sits.
The 71% breaks down into three very different behaviors
The headline number collapses three distinct outcomes, and separating them changes the story. Of the 4,200 accounts:
- 38% had the signup limit raised or removed by the player within 30 days. Median time to first increase: 11 days.
- 21% saw the limit expire on its own because it had been set as a "temporary" or "session" limit the player believed was permanent, or because a promotional deposit reset the counter.
- 12% belonged to accounts where the limit was never technically applied — the field accepted the number, the confirmation screen appeared, but the back-end enforcement window was set to a default the player never chose.
That last bucket is the one that should worry regulators most, because it isn't a player decision at all. In 47 of the 504 accounts in that group, the recorded confirmation screen displayed the player's chosen figure while the account statement showed deposits above it within the same week. The consultancy's engineers reproduced the behavior on three platforms using test accounts and found the cause in two cases: a limit field that wrote to a marketing-preference table instead of the wagering-control table, and a timezone mismatch that reset daily limits at UTC midnight rather than the player's local midnight, effectively granting a second day's allowance to anyone gambling late on the East Coast.
Neither is exotic. Both are the sort of bug that survives because nobody is testing the limit path with the same rigor as the deposit path.
Why "raised within 30 days" isn't automatically damning
To be fair to operators, a player who sets a $50 weekly limit during a signup flow at 11 p.m. and then realizes it's too tight is not a failure of responsible gambling — it's the system working, provided the increase involves a cooling-off period. The audit found cooling-off periods on 62% of the platforms in the sample. On the other 38%, a limit increase took effect immediately, sometimes within the same session, sometimes with a single click and no confirmation step. The UK Gambling Commission has required a 24-hour delay on limit increases since 2022; no U.S. state currently mandates one, though several operators apply it voluntarily as a condition of their responsible-gambling certifications.
The median 11-day gap matters here. Problem-gambling researchers have long described the days immediately after a large loss as the highest-risk window for chasing, and a limit that can be lifted inside that window provides less protection than its existence implies. One participant in the panel, a 34-year-old in Ohio who asked to be identified only as D., described raising a $200 weekly deposit limit to $800 nineteen minutes after a session that wiped out his balance. The recording shows four clicks and a "Limit updated" toast. No delay, no prompt, no suggestion to revisit the decision in 24 hours.
The signup flow is where the leverage is, and it's shrinking
There's a structural reason limits set at signup underperform: signup is the moment a player is least able to forecast their own behavior and most motivated to clear the path to their first deposit. The audit timed the flows. Median time from "Create account" to first deposit on the sampled platforms: 4 minutes 40 seconds. Median time spent on the responsible-gambling settings screen, among players who visited it at all: 22 seconds. Thirty-nine percent of accounts never opened the settings screen; the limit was set through a pre-checked prompt during registration.
Pre-checked prompts are the quiet battleground. A pre-checked box offering a $500 weekly deposit limit reads, to a regulator, like a default protection. To a player in a hurry, it reads like a speed bump to click past. The audit found that when the limit field was blank and required a deliberate entry, 44% of players set something; when a default figure was pre-filled, 81% accepted it unchanged — but the accepted defaults ranged from $250 a week to $5,000 a week depending on the operator, a 20-fold spread with no relationship to the player's stated income or gambling history.
The KYC timing problem
A second finding cuts against the idea that signup is the right moment for limits at all. On 71% of the sampled platforms, identity and income verification completed after the first deposit, sometimes days later. A limit set before verification is a guess about a person the operator hasn't met yet. Several European jurisdictions have moved verification to the front of the funnel for exactly this reason; in the U.S., the patchwork means a player in one state can be verified before depositing while a player in the next state cannot.
The practical consequence: the limit that gets set at signup is often replaced, formally or informally, once the operator learns more about the player. The audit couldn't isolate how much of the 38% "raised by player" figure reflects operators inviting a reset after verification — a "your limit may no longer suit you" email — but three participants produced such messages, all sent within the first two weeks.
States are starting to write delay requirements, unevenly
The regulatory map is moving, but not in one direction. As of this spring, seven states require some form of cooling-off period before a deposit-limit increase takes effect, with delays ranging from 24 hours to 72 hours; four of those seven adopted the requirement in the past 18 months. Another five states require operators to offer limits but specify nothing about how quickly they can be changed, which is roughly the same as requiring a lock but not a key.
The variance creates an obvious arbitrage in a market where geolocation, not brand loyalty, determines which product a player sees. A player who finds the 24-hour delay inconvenient in one state and crosses a border — or simply drives to a casino in a neighboring state with looser rules — encounters a different product with the same branding. The audit found nine multi-state operators whose limit-increase behavior differed by jurisdiction, in every case with the shorter delay in the state with the weaker rule.
Industry response to the audit's findings, solicited by email, was mixed. Two operators said the "never applied" cases were fixed within days of being reported and characterized them as isolated configuration errors. One pointed out that the panel is self-selected and that players who volunteer for a screen-recording study are, by definition, unusually engaged with their own gambling — which cuts both ways, since engaged players are the ones most likely to set a limit in the first place. A trade-group spokesperson argued that limits set in haste at signup are "a starting point, not a contract," and that operators should be judged on whether tools are available and functional, not on whether players use them the way researchers would prefer.
That's a defensible position, and it deserves a serious answer rather than a dismissal. The counterargument is that a limit is not a preference like a newsletter subscription; it's a commitment device, and commitment devices only work when the cost of reversing them is real. A 22-second settings screen, a pre-checked default, an immediate-increase path, and a back-end that sometimes doesn't enforce the number at all add up to a commitment device with the tensile strength of a paper straw.
What the number can't tell us
The audit has real limits of its own. It measures whether limits persisted, not whether they prevented harm. A player who raises a limit and stays within the new one is not a failure case; a player who keeps a limit and gambles elsewhere is not a success. The panel's 4,200 accounts over six months is a decent sample for describing behavior but too small to say anything rigorous about outcomes like self-exclusion uptake or credit-card delinquency, and the recruitment method almost certainly undercounts the players most at risk, who are the least likely to volunteer for a study about their gambling.
There's also the question of what "ignored" means in the title. Players didn't ignore their limits in the sense of forgetting them; the recordings show most remembered precisely what they'd set. What they did, in the majority of cases, was change them — often deliberately, often within minutes of a loss, and almost always through a path the operator made frictionless. The 71% is less a measure of player discipline than a measure of how much design effort went into the deposit button versus the limit button.
The open question is what a regulator does with a number like this. Requiring a cooling-off period on increases is cheap, testable, and already standard in the UK; requiring limits to be enforced at the back-end, with an audit trail a regulator can inspect, is cheaper still. Neither addresses the deeper issue the audit surfaces — that the most protective moment to set a limit is after verification, when the operator knows something about the player, and the least protective moment is the one where the industry currently puts it. Whether any state is willing to move the limit-setting step to the back of the funnel, and accept the drop in same-day deposits that would follow, is a question the next round of rulemaking will have to answer. The players in this sample already have.