Geolocation Explained: How Licensed Casinos Confirm Where You Are

Understanding each layer explains nearly every failure players hit, because a rejected check is almost always one specific layer going missing or disagreeing with the rest.

IP Address: Present, but Barely Trusted

An IP address identifies the network block a connection came from, and a commercial database maps that block to a registrant address. For home broadband, that usually lands in the right metro area. Everything else degrades fast. Mobile carriers pool subscribers behind carrier-grade network address translation and route them out through regional gateways, so a phone in Camden can present an address registered in Philadelphia. Business, satellite and campus connections are worse, the block often registered to a headquarters in another state. Compliance systems therefore treat IP as context, not evidence: useful for spotting an obvious mismatch, but never enough on its own to approve a wager.

Wi-Fi Access Point Triangulation: The Desktop Workhorse

This layer decides most desktop sessions and is the one players understand least. Your device scans for nearby wireless networks and records two things about each: the BSSID, the hardware address of that access point’s radio, and the received signal strength. That list goes to a lookup service holding known coordinates for hundreds of millions of access points. Match three or more, weight them by signal strength, and you get a fix owing nothing to your IP address and nothing to satellites.

The reference data is enormous. Locance, one of the certified gaming vendors, publishes the following figures for its own map, which is crowdsourced: phones holding a satellite fix while seeing a given access point report the pairing, and coverage fills in over years.

Satellite Positioning on Phones and Tablets

Modern handsets receive from several constellations, not just the American GPS system, and compute position from signal travel time. With a clear view of the sky the fix is good to a few meters, far tighter than any border question needs. The trouble is that people play indoors. Walls, metal framing and coated glass attenuate the signal, and downtown it bounces off buildings before reaching you, producing multipath errors that throw a fix a block or more off course. Operators demand location permission because without it this layer does not exist at all.

Cell Tower Trilateration

A phone always knows which cell sites it can hear and roughly how far it sits from the serving one, because the network measures the timing advance that keeps transmissions in their assigned slot. Combine the known coordinates of two or three sectors with those distance estimates and a position falls out. In a dense urban grid full of small cells that can be good to a couple of hundred meters; in rural country served by one tall tower the uncertainty balloons to several kilometers. Cell data therefore rarely decides a session alone. Its value is as a cross-check: if the satellite fix says Newark and the serving sector is in Queens, the fraud engine wants to know which one is lying.

Bluetooth Beacons

Beacons serve a narrower purpose. New Jersey draws a much tighter boundary for on-property mobile gaming, permitting it “within the property boundaries of an approved casino hotel facility,” expressly including a pool deck but excluding parking garages. Satellite positioning cannot reliably distinguish a garage level from the lobby above it; short-range Bluetooth transmitters with fixed identities can, and GeoComply sells an on-property product it says resolves to roughly one meter. For statewide play from your living room, beacons are not in the picture.

Device and Browser Fingerprinting

Location fraud is usually not an attempt to fool satellites. It is an attempt to put a real, legally located machine between the player and the casino, then drive it from somewhere else. Fingerprinting catches that. The client inspects characteristics a normal consumer device presents in a normal combination:

• Graphics adapter and driver names
• Screen geometry
• The manufacturer prefix of the network adapter address
• Timer resolution
• Sensor availability

Virtual machines betray themselves because hypervisors ship recognizable virtual hardware. Remote desktop sessions expose a virtual display adapter and input latency no local user produces. Mobile emulators report build properties no shipped handset carries, and often expose accelerometer readings that never change because nothing is actually moving. On Android the platform’s mock-location facility is queried directly, as is root status; on iOS the equivalent is jailbreak detection. This is why a technically capable player who spoofs coordinates still gets rejected.

VPN, Proxy and Datacenter Detection

A separate subsystem classifies the connection itself. Every address block belongs to an autonomous system, and telling a residential broadband provider from a commercial hosting company is straightforward: traffic from a cloud provider’s address space is not somebody’s apartment. Beyond ownership, the engine weighs known exit-node lists, transport-layer fingerprints identifying tunneling clients, DNS resolution that leaks a different country, and round-trip latency inconsistent with the claimed position. GeoComply says its detection product draws on a database of more than 270 million addresses.

Fusing It Into a Confidence Score

Here is the part most explanations skip. The engine does not pick a winner among these layers. It scores them. Each signal arrives with an estimated uncertainty, and the fusion logic weights the tighter, harder-to-forge signals more heavily while checking every source against every other. Agreement raises confidence. GeoComply describes running roughly 350 checks per transaction. What returns to the operator is not a map pin but a pass or fail plus a reason code, both written to a log a regulator can demand years later.

The Router Map Goes Stale

Wi-Fi positioning depends on access points being where the database says. Routers move. A family relocates from Philadelphia to Cherry Hill and takes the router along, and for weeks that hardware address still resolves to Pennsylvania. In a border metro, a stale record does not make the fix slightly wrong; it puts you in the wrong jurisdiction.

When the Border Is a River, or a Street

Philadelphia and Camden face each other across the Delaware River, roughly a third of a mile apart at the Benjamin Franklin Bridge. Both sides have legal online casinos, but they are separate regimes with separate licenses, and a Pennsylvania account cannot lawfully play from the Camden waterfront. Rivers are not even the tightest case.

Delaware’s border is the strangest of the set. The U.S. Supreme Court reaffirmed that 12-mile arc in New Jersey v. Delaware in 2008, which means someone standing on a pier off the New Jersey shore may be standing in Delaware. Compare our New Jersey, Pennsylvania and Delaware pages, because which side you occupy decides which account you may use.

Towers, Buildings and Overlapping Coverage

Radio does not respect surveying. Carriers place towers to cover population, not to trace boundaries, so a sector on a Pennsylvania hilltop serves customers across the river in New Jersey and a tower in Toledo covers homes in Michigan. Buildings compound it: in a waterfront high-rise, the strongest access points a laptop hears may belong to neighbors whose units were mapped from a different position, and the indoor satellite fix may be off by more than the distance to the border. In the four-mile-wide Northern Panhandle of West Virginia, a Weirton resident has Ohio one way and Pennsylvania the other, with towers from three states audible at one kitchen table. Michigan shows the same geometry against Ohio and Indiana, and Nevada, which licenses online poker but not online casino blackjack, has the Tahoe problem on its western edge.

The Accuracy Radius, and What “Fail Closed” Means

This is the technical heart of the border problem. A position fix is never a point. It is a coordinate plus a horizontal uncertainty, properly read as a circle: the device is somewhere in here, with stated confidence. When that circle sits wholly inside the licensed state, the answer is easy. When it straddles the border, the honest answer is that the system does not know which side you are on. At that point the software fails closed.

The asymmetry of consequences settles it. New Jersey requires operators to retain everything needed to reconstruct account activity, “including any identity or location verifications, for a period of no less than 10 years,” and to let the Division query and export it. Weighed against the license, the operator loses the customer every time. Anyone who moves between jurisdictions should read what happens when you cross a state line mid-session.

The radio count alone makes mobile checks likelier to resolve inside a tight radius, and the software gap widens it from there. Our mobile blackjack guide covers that side.

Michigan drew its carve-out narrowly: tribal exclusivity applies where the individual placing the wager “is physically present on Indian lands when the wager is initiated and the wager is received or otherwise made on equipment that is physically located on Indian lands.” Both ends, in other words. Other states took a broader path, deeming a bet placed anywhere in the state to occur at the tribal server receiving it. That theory survived its main federal test in West Flagler Associates, Ltd. v. Haaland, decided by the D.C. Circuit on June 30, 2023 on docket 21-5265, though the court resolved it on administrative grounds rather than endorsing the theory outright.

Connecticut’s market runs on a compact structure with the Mashantucket Pequot and Mohegan tribes, and players there still face an ordinary statewide fence. The mechanics are unpacked on our tribal gaming page.