How Geofencing Works, and Why Regulators Keep Calling It Broken

Geofencing for online gambling and derivatives compliance rarely relies on a single signal. Mature implementations combine IP-address lookups, GPS coordinates from a mobile device, Wi-Fi network mapping, and cell-tower triangulation, cross-referencing all of them so that a mismatch between signals, a spoofed GPS reading paired with Wi-Fi networks that do not match the claimed location, flags the session for review.

This layered approach exists because any single signal is individually weak. IP-based geolocation alone can be defeated by a consumer VPN in seconds, which is precisely why regulators evaluating an operator's compliance program look for multiple independent data sources rather than accepting an IP check on its own.

Nevada's experience with Kalshi shows the gap between an on-paper geofencing commitment and an operating one. After a May 18, 2026 injunction ordered Kalshi to geofence the state, Nevada investigators reported completing prohibited event-contract purchases from inside the state eight times across four days that same month, evidence of a system that was not catching what it was ordered to catch.

Kalshi's July settlement of the resulting contempt motion committed it to a 'more robust, multi-source' geofencing system, language that mirrors the industry's own description of what a mature implementation looks like, by an August 12 deadline. Washington state's King County Superior Court took a stricter approach in its own August 13, 2026 order, building a $120,000-per-day penalty directly into the injunction for missing either of two staged deadlines, an initial IP-and-residency check and a fuller multi-source verification system, rather than waiting for a violation and a later contempt motion.

The European Securities and Markets Authority's Risk Monitor, published September 11, 2026, flagged the same underlying weakness from a different jurisdiction. It found that Kalshi and Polymarket restrict access from some, but not all, EU member states, and stated plainly that their 'geographic restrictions do not prevent users from accessing the platforms through VPNs.'

ESMA's report is not an enforcement action and carries no penalty of its own, but it shows that the technical gap US state courts have been litigating over since spring 2026 is the same gap a securities regulator on another continent identified independently, looking at the same two platforms' geo-blocking from an entirely different angle.

GPS spoofing software, residential proxy networks that route traffic through real consumer internet connections rather than an obviously flagged data-center IP, and remote-access tools that let a user in a restricted state control a device physically located elsewhere are all documented evasion techniques in the gaming-compliance industry, and none of them is fully solved by any single vendor's product.

That is the core reason courts keep ordering staged, escalating compliance rather than accepting a one-time geofencing rollout as sufficient. A system that blocks today's known evasion method does not necessarily block tomorrow's, which is why the Nevada and Washington orders both frame compliance as an ongoing verification standard rather than a feature an operator ships once.

An operator's geofencing vendor contract or feature list is not, on its own, evidence of compliance in the way courts are now applying that word. What matters in these rulings is demonstrated, ongoing performance against real attempted access from a restricted jurisdiction, the kind of evidence Nevada's investigators generated by testing the system directly.

Operators facing a state injunction with a geofencing deadline should expect the standard to keep moving toward multi-source verification with documented testing, not away from it, and should treat a single-signal IP check as a starting point rather than an end state for any jurisdiction where enforcement risk is live.