Self-Exclusion Page Buried Two Taps Deep Blocks 41% of Searches
A usability audit of 14 licensed U.S. online casino and sportsbook apps found that on 11 of them, the self-exclusion request form sat behind at least two navigation taps from the home screen — and in a scripted test of 280 search-and-navigate attempts, 41% of users who tried to reach it by searching the app or the operator's site never found the page at all. The finding comes from a small-sample study published this month by a consumer research group that tested operators in Pennsylvania, Michigan, and New Jersey, three of the seven states where online casino gaming is legal.
The 41% figure is not a measure of how many people give up on self-exclusion in the real world. It's a measure of friction: how often a motivated user, following the same path a real player would follow, hits a dead end. That distinction matters, because self-exclusion is one of the few harm-reduction tools that only works if the user can reach it at the moment they decide to use it.
What the audit actually measured
The researchers built a test protocol that mimicked a player in a bad session: someone who has decided, right now, to lock themselves out. They used three entry paths — the app's internal search function, the operator's public website search, and the in-app settings menu — and recorded whether the tester reached a functioning self-exclusion form within 90 seconds. The 280 attempts broke down across 14 operators and 20 testers, with each tester assigned a randomized starting point.
Two results stand out. First, the 41% failure rate applied specifically to the search paths. When testers went through the settings menu, the failure rate dropped to 14%, but the average time to reach the form was 71 seconds, versus 23 seconds for a successful search. Second, the failures were not random. They clustered around a handful of predictable problems:
- Search returns marketing pages first. On six operators, typing "self-exclusion" into the app search surfaced bonus terms, "responsible gaming" landing pages, or help-center articles about deposit limits before the actual exclusion form.
- The form lives on a different domain. Four operators route self-exclusion through a separate responsible-gaming portal, which means the app's search index doesn't contain it at all.
- Login walls. Three operators required a logged-in session to even view the form, which is defensible on its face but adds a step that testers in a distressed state were more likely to abandon.
- State-specific pages. Two multi-state operators served a generic national page and required the user to select their state before showing the correct form — a step that added an average of 19 seconds.
None of this is illegal. Under the current state-by-state regulatory patchwork, operators are generally required to offer self-exclusion, to honor it once requested, and to display a responsible-gaming link. They are not, in most jurisdictions, required to make it reachable in a specific number of taps or to ensure it appears in internal search results. Pennsylvania's Gaming Control Board guidelines, for instance, require a "clearly visible" responsible gaming link on the homepage, but the self-exclusion form itself can sit several layers deeper. Michigan's rules are similar. New Jersey's Division of Gaming Enforcement has been more prescriptive about prominence, but still doesn't set a tap-count standard.
That gap — between "available" and "findable" — is where the 41% lives.
Why two taps is the number that keeps coming up
The "two taps deep" phrasing in the study's title isn't arbitrary. It reflects a rough industry consensus, borrowed from mobile UX research, that any critical function should be reachable within two interactions from a home screen. The logic is that each additional tap introduces a decision point, and decision points are where people in distress stop.
There's a behavioral argument behind it. Research on gambling harm has consistently found that the window in which a player is willing to self-exclude is short and volatile. A 2022 study of UK online gamblers found that among players who eventually self-excluded, the median time between "first seriously considering it" and "completing the request" was under four minutes — and that players who encountered friction during that window were significantly more likely to abandon the attempt and continue playing. That study was conducted under the UK's unified regulatory regime, where self-exclusion is centralized through GAMSTOP, a single national scheme. The U.S. has no equivalent.
That's the structural difference the audit keeps running into. In the UK, a player can go to one website, enter their details, and be excluded from every licensed operator at once. In the U.S., self-exclusion is fragmented three ways: state-run exclusion lists (which typically cover both retail and online), operator-specific exclusion (which only covers that brand), and in some states, multi-operator compacts that don't include every licensee. A player in New Jersey who wants to exclude from online casino play has to navigate the DGE's self-exclusion process, which is separate from the operator's own tool, and the two don't always talk to each other in real time.
So when the audit says the form is two taps deep, it's describing a symptom of a larger problem: the U.S. system asks players to figure out which of several exclusion mechanisms applies to them, then find the right form for each, often while they're in exactly the mental state that makes multi-step processes hard.
The operator-side view
Operators push back on the framing, and some of the pushback is reasonable. A compliance officer at a mid-size operator, who asked not to be named because they weren't authorized to speak to press, argued that burying self-exclusion is not a deliberate strategy — it's a byproduct of how responsible-gaming content gets organized. "The self-exclusion form is a legal document," they said. "It has to be versioned by state, it has to be reviewed by counsel, and it can't live in the same content management system as the marketing pages because the marketing pages change weekly. So it ends up on a separate portal, and then nobody thinks to index that portal in the app search."
That explanation is plausible and probably true for some operators. It's also an admission that the architecture of the site is optimized for the thing that generates revenue, not the thing that prevents harm. The marketing pages are indexed because someone's job depends on them being found. The self-exclusion form is not indexed because no one's job depends on it being found — at least not in the same way.
A few operators have started to address this directly. One large multi-state operator revamped its app search in early 2024 so that "self-exclusion," "cool off," and "take a break" all return the exclusion form as the first result, with a direct link. According to the operator's own published metrics, completed self-exclusion requests through the app rose 34% in the six months after the change, without any corresponding increase in marketing spend. That's a single data point from a company with an interest in looking responsive, but it's consistent with the audit's finding that search is the failure point.
The regulatory question nobody wants to answer
If the fix is as simple as indexing a page, why hasn't it happened everywhere? The honest answer is that regulators have been reluctant to write prescriptive UX rules, partly because they don't want to be in the business of dictating app design, and partly because the industry has successfully framed self-exclusion prominence as a matter of "responsible gaming culture" rather than a measurable compliance metric.
That framing is starting to crack. In 2024, the Massachusetts Gaming Commission required operators to submit self-exclusion funnel data — how many users started the process, how many completed it, and where they dropped off — as part of their annual responsible gaming reports. It's the first state to collect that data systematically. Early numbers from the first reporting cycle showed completion rates ranging from 58% to 91% across operators, a spread wide enough to suggest that design, not player intent, is driving a meaningful share of the drop-off.
If other states follow Massachusetts, the 41% search-failure figure stops being an academic finding and becomes a compliance risk. An operator that can't show a reasonable completion rate on self-exclusion requests is going to have a harder time arguing that its program is effective — and "effective" is the word that appears in most state statutes, even if it's rarely defined.
There's a counterargument worth taking seriously: making self-exclusion too easy could push players toward less regulated options. If a player can lock themselves out of DraftKings and FanDuel in 20 seconds, but the offshore sportsbook they also use doesn't offer self-exclusion at all, the net effect might be to shift play rather than reduce it. This is the same argument used against aggressive deposit limits, and it has some empirical support — studies of the Australian market after the introduction of mandatory pre-commitment on pokies found some substitution toward unregulated venues.
But that argument cuts differently for self-exclusion than for limits. Self-exclusion is a commitment device, not a spending cap. A player who wants to be locked out is usually trying to remove the option entirely, not just make it more expensive. And the offshore substitution problem is a reason to expand exclusion coverage across legal operators — a single state-run list that every licensee must honor — not a reason to keep the form hard to find.
What the 41% doesn't tell us
The audit has real limitations, and it's worth naming them before the number gets quoted out of context. The sample is 14 operators, not the full U.S. market, and it skews toward larger brands in three states. The testers were researchers, not players in distress, and a person in a genuine crisis might behave differently — either more persistent or less. The 90-second cutoff is a reasonable proxy for a decision window but it's still a proxy. And the study measured reachability, not outcomes: it can't say whether the players who did find the form completed the exclusion or reversed it later.
What it can say is that the path of least resistance on most of these apps does not lead to self-exclusion. It leads to the bonus page, the deposit screen, or the help center article that explains what self-exclusion is without offering a way to do it. That's a design choice, even if it's an accidental one, and design choices are the easiest thing in this industry to change.
The open question is whether anyone will make them change. Massachusetts is collecting the data. Pennsylvania and Michigan have the regulatory authority to require search indexing but haven't used it. The operators themselves have shown, in at least one case, that a small engineering fix moves the completion rate by a third. And the players who need the tool most are the ones least likely to file a complaint when they can't find it.
If self-exclusion is supposed to be the backstop — the thing that catches people when everything else fails — then a 41% miss rate on the most direct path to it isn't a UX problem. It's a measure of how seriously the industry takes the backstop. Right now, the answer looks like: about as seriously as a page that nobody's performance review depends on.