A new audit of multi-state registration traffic finds that state self-exclusion lists block roughly 91% of attempted sign-ups from excluded players — meaning about 9% slip through when a bettor crosses a state line. The gap isn't a database failure so much as a design failure: each state runs its own registry, and most don't query their neighbors before approving an account.

The 9% figure comes from a six-month review of 412,000 registration attempts across four states with legal mobile sportsbooks and casinos. Of the 37,000 attempts matched to an active self-exclusion order in another jurisdiction, 3,330 were approved anyway.

Why the registries don't talk to each other

Self-exclusion has always been a state-level product. A player who enrolls in New Jersey's list is telling New Jersey operators to refuse them. Nothing in the enrollment form obligates the player, or the state, to notify anyone else. Multi-state compacts exist on paper — the Multi-State Internet Gaming Agreement covers poker liquidity among a handful of states — but self-exclusion data isn't part of that pipe.

Operators aren't blameless either. A sportsbook licensed in 30 states could, in principle, check every state list before onboarding. Few do, because there's no shared identifier to check against. Name and date of birth produce too many false positives; a partial SSN match is legally fraught across state lines.

The identity problem underneath

The 9% miss rate is really an identity-resolution problem wearing a compliance costume. A bettor named Michael Rodriguez born on 3/14/1987 in one state is indistinguishable from a dozen others in a national name-and-DOB query. Adding address helps until the player moves — which is exactly the population most likely to be signing up somewhere new.

What the misses look like

The audit broke the 3,330 approved cross-state sign-ups into rough buckets:

  • Recent movers (about 58%): excluded in their prior state, registered within 90 days of a documented address change.
  • Vacation and second-home sign-ups (about 24%): no address change, but a new account opened from an IP and billing ZIP in another state.
  • Deliberate evasion (about 18%): minor name variations, a different email, but matching device fingerprints.

That last bucket is the one regulators care about most, and it's also the smallest. Most of the leak isn't people gaming the system — it's people who moved and didn't know their exclusion followed them, or assumed it did when it didn't.

The fix regulators are circling

Two proposals are moving. One would require operators to query a national clearinghouse at registration rather than at first deposit, using a hashed identifier built from name, DOB, and the last four of an SSN. The other would make self-exclusion portable by default: enroll once, and the order travels with the player to every state that recognizes the compact.

Portability has an obvious appeal and an obvious problem. A player who excludes for a year in a state with no legal market shouldn't necessarily be barred everywhere, and a player who wants out of one operator's marketing list shouldn't be swept into a national ban. The 9% number cuts both ways: it's a compliance hole, but closing it by default would also expand the reach of every exclusion order well beyond what most enrollees signed up for.

The open question is whether the fix should be a stricter gate at registration or a clearer disclosure at enrollment — telling players, in plain language, that their exclusion stops at the state line. Right now most enrollment pages don't say that at all.