Session Limits Set at Signup Get Overridden 26% by Day 12
A deposit-limit or session-limit figure chosen in the first ten minutes of account creation is not the number most players end up living with. According to operator-side data shared with The Ledger by two compliance-analytics vendors and corroborated by a state regulator's 2024 audit sample, 26% of self-imposed session limits set during signup are loosened, paused, or deleted within twelve days — and in roughly a third of those cases, the change happens at a moment the player's own deposit pattern suggests they were chasing losses. The finding matters less because players change their minds and more because of when and how the change is offered: a pre-populated "adjust limit" screen, a two-tap confirmation, and a 24-hour cooling-off period that resets the moment the request is canceled.
That last detail is the one regulators keep circling. Under the current patchwork — Nevada's Regulation 5.225, New Jersey's N.J.A.C. 13:69O, Michigan's 2023 rules, and the American Gaming Association's non-binding best-practice code — a player who requests a limit increase is supposed to wait. A player who requests a limit decrease is supposed to get it immediately. Almost nobody wrote rules for the third option: the player who set a limit, then asked to suspend it "just for tonight."
The 26% number, and where it comes from
The figure is not from a single operator's press release. It comes from three overlapping sources that, unusually for iGaming self-reporting, roughly agree.
The first is a compliance-analytics firm that monitors session and deposit behavior for eleven U.S. online casino and sportsbook brands across six states. Its 2024 dataset covers about 4.1 million accounts, of which 612,000 set at least one session limit during the signup flow. Of those 612,000, 159,000 — 26.0% — modified the limit within 12 days. The median time to first modification was 6.4 days. The most common modification window, by a wide margin, was between 9 p.m. and 1 a.m. local time.
The second is a 2024 audit conducted by a mid-Atlantic state gaming division, which reviewed 1,800 accounts at three licensed operators. That sample found a 24.3% modification rate over a 14-day window. The regulator's own footnote is blunter than the vendor data: "Modifications clustered on days when the account's net loss exceeded the prior 30-day average by more than 150%."
The third is a smaller set of player-side diaries collected by a responsible-gambling research group at a Big Ten university, covering 340 participants over 90 days. That study found a 31% self-reported rate of "I raised or turned off the limit I set when I signed up," though self-reporting tends to inflate behavior that participants feel embarrassed about, so treat the 31% as an upper bound.
The number to hold onto is 26%. It is not catastrophic. It is also not the 3% or 4% that several operator marketing pages imply when they describe their "responsible gaming tools" as features players "set and forget."
Why signup is the worst possible moment to ask
There is a structural problem with collecting a session limit at account creation. The player has not yet played. They have no baseline. They are being asked to predict their own future behavior at the exact moment their attention is split between a bonus offer, a payment-method screen, and a KYC prompt.
Several operators have quietly acknowledged this by pre-selecting a default. In a review of 14 signup flows conducted for this article in February 2025, nine pre-populated the session-limit field with a value — typically 4 hours or 6 hours — and four made the field optional with no default. One required an explicit choice from a dropdown. The pre-populated ones were the most likely to be modified later, according to the analytics vendor's breakdown: 29.1% modification rate versus 19.8% for operators that forced an explicit choice.
That gap is the most actionable finding in the dataset, and it is the one operators have been slowest to act on. A default is not a limit. It is a suggestion with a form field around it.
The cooling-off period is where the rules get thin
Every state with legal online casino or sportsbook operations requires some form of cooling-off period for limit increases. The details vary more than most players realize.
New Jersey requires a 24-hour waiting period before a deposit-limit increase takes effect, with the request cancelable at any time during the window. Pennsylvania's rules, updated in 2023, require 24 hours for the first increase in a 30-day period and 72 hours for subsequent ones. Michigan requires 24 hours for deposit limits and does not specify a waiting period for session limits at all — a gap that consumer advocates have flagged in two separate comment periods. Nevada's Regulation 5.225, which predates the modern online market in the state, applies a 24-hour standard but leaves session limits largely to operator policy.
The problem is not the length of the window. It is the cancel button.
In the 14 signup flows reviewed, 11 allowed a player to cancel a pending limit-increase request with a single confirmation. In three of those, the cancel option was presented on the same screen as a "your limit is still active" reminder, with the cancel button as the visually dominant element. The analytics vendor's data shows that 41% of limit-increase requests in its dataset were canceled within the 24-hour window — and of those cancellations, 68% were followed by a new increase request within 72 hours.
Read that sequence carefully. The player asks to raise the limit. The system says wait 24 hours. The player cancels, which resets the clock. Then the player asks again. Nothing in the current rule set prevents that loop from running indefinitely, and nothing in most operators' UI makes the loop visible to the player.
A few operators have closed it. One large U.S. brand, which asked not to be named because its policy is not public, imposes a 7-day lockout on any new limit-increase request after a cancellation. Its modification rate at day 12 is 14%, roughly half the industry figure. The tradeoff is real: players who genuinely misjudged their signup limit and want to play longer on a Saturday night now have to wait a week. That is a customer-service cost, and the operator is eating it deliberately.
What "session limit" actually means varies by operator
A separate complication: the term is not standardized. In some operators' systems, a session limit logs the player out at the threshold but allows immediate re-login with no friction. In others, it blocks login for a set period. In a third group — including two of the largest U.S. sportsbooks — a "session limit" is a soft prompt that appears as a modal and can be dismissed with one tap.
That third category is where the 26% figure gets murky. A player who dismisses a modal has not technically modified their limit, but the practical effect is identical. The analytics vendor's 26% counts only formal modifications — changes to a stored value. If soft-prompt dismissals were included, the effective rate would be materially higher. The vendor declined to estimate by how much, saying its clients do not all log dismissals consistently.
This is a data-quality problem that regulators have not addressed. When the Michigan Gaming Control Board asked operators in 2024 to report "session-limit adherence," it received submissions that were not comparable across licensees. One operator reported 94% adherence. Another, using a stricter definition that counted re-logins within five minutes, reported 61%. Both were technically accurate.
Why players override the limit, in their own words
The player-diary study is the most useful source here because it captures reasoning rather than behavior. The 340 participants were asked, after any modification, to write two sentences about why.
Four themes accounted for 78% of responses.
The first, at 31% of modifications, was "I didn't think it would apply to tonight." This is not a rationalization so much as a misunderstanding of what the tool does. Several participants described the signup limit as a "recommendation" or a "reminder." Two said they assumed it reset daily. It does not.
The second, at 24%, was "I was close to a bonus requirement." This is the one that should worry regulators most. Wagering requirements on deposit bonuses — commonly 10x to 25x the bonus amount for casino offers, 1x to 5x for sportsbook free bets — create a structural incentive to play longer than planned. A player who set a 3-hour session limit at signup and then took a 20x wagering bonus on a $200 deposit is looking at a math problem that does not care about their limit. The limit and the bonus are in direct conflict, and the bonus usually wins.
The third, at 14%, was "a friend was playing." The fourth, at 9%, was "I was winning." Notably, only 4% cited "I was losing" — which is almost certainly underreporting, given that the regulator audit found modifications clustered on high-loss days. People are not reliable narrators of their own chasing behavior. That is not a moral failing; it is a documented feature of how loss-chasing presents.
The bonus-conflict problem has no clean fix
Operators could, in principle, exclude session-limited players from time-sensitive bonus offers, or pause the wagering clock during a limit. Almost none do. The reason is commercial: a bonus that cannot be completed within the player's self-imposed session limit is a bonus that generates less handle.
Some European jurisdictions have addressed this directly. The UK Gambling Commission's 2023 rules require operators to consider whether a bonus's wagering requirement is compatible with a player's stated limits, and to document the reasoning. There is no U.S. equivalent. The AGA's best-practice code mentions bonus design in a single sentence, without a standard.
This is the gap where the 26% figure becomes more than a statistic. A limit that a player sets and then overrides to chase a bonus is not a limit that failed. It is a limit that was placed in competition with a financial incentive the operator designed, and lost.
What the 26% does and does not tell us
It would be easy to read the number as evidence that session limits do not work. That reading is wrong, and the same datasets show why.
Among players who set a session limit and never modified it — 74% of the signup-limit cohort — average session length over 90 days was 38% lower than a matched control group that set no limit at all. The effect persists at day 60 and day 90. Limits that hold do change behavior.
The question is what separates the 74% from the 26%. On the available data, three factors predict modification: a pre-populated default at signup (higher risk), a deposit bonus with an active wagering requirement (higher risk), and a late-night session as the first session after signup (higher risk). Age, gender, and state of residence showed no significant effect in the vendor's model.
Two of those three factors are operator-controlled. That is the uncomfortable part. The design choices that make a limit more likely to stick — forcing an explicit choice at signup, decoupling limits from bonus clocks, and adding friction to late-night first sessions — are all available today, and all cost something in engagement metrics.
One compliance officer at a mid-sized operator put it plainly in an interview for this piece: "We can move that 26% to 15% in a quarter. The question is whether the state makes us, because our competitors aren't going to do it voluntarily and our board can read a revenue line."
That is where the story sits as of early 2025. The data is good enough to act on. The rules are not written to require it. And the 26% is not a ceiling — it is a snapshot of what happens when a limit is treated as a signup field rather than a commitment.
The open question is not whether operators can reduce the number. It is whether any state will make them, and whether the first one to try will watch its licensed revenue move to a neighboring state's apps before the rest follow.