A vibe-coding tool can build a casino or sweepstakes app in a weekend. Whether you can operate it is a different question. In 2026 the answer depends on licensing first, because ten US states have now banned sweepstakes casinos and California's law reaches vendors, processors and platform providers; on distribution second, because Apple and Google require licenses per jurisdiction and Stripe prohibits games of chance outright; and on verification third, because every licensed operator must verify age and identity before a customer can deposit or play. This guide covers all three and gives the deepidv workflow that handles age, identity, geolocation, multi-accounting and self-exclusion.

Read this before writing the first prompt. The legal position decides what you can build. The app itself should already have passed the vibe coding security checklist.

Can you legally launch a sweepstakes casino in 2026?

In fewer places every month. California's AB 831 was signed on 11 October 2025 and took effect on 1 January 2026; it bans dual-currency sweepstakes games, carries misdemeanor penalties of up to a year in jail and $25,000 per violation, and reaches any entity, financial institution, payment processor, geolocation provider, gaming content supplier, platform provider or media affiliate that knowingly supports one. New York's attorney general acted against 26 platforms in 2025.

An industry tracker lists the 2025 to 2026 bans as New Jersey (signed 15 August 2025), Connecticut (effective 1 October 2025), Montana (effective 1 October 2025), New York (signed 5 December 2025), Maine (effective July 2026), Indiana (effective 1 July 2026), Tennessee (signed 22 May 2026), Oklahoma (effective 1 November 2026) and Louisiana (May 2026), with Nevada, Idaho and Washington relying on existing law. A law firm's July 2026 review confirms the Indiana, Maine, Oklahoma and Tennessee dates and notes that liability now reaches platform providers, suppliers, geolocation providers and media affiliates.

The vendor-liability clauses are the part builders miss. Under California's law, the person who vibe-coded the platform is a platform provider.

What this means in practice: real-money gaming needs a license in each jurisdiction you serve; sweepstakes models are closing in the US; social casino with no prize of value is the remaining unlicensed category, and it still needs age controls under app store policy. Get a gaming lawyer before you get a domain.

What do the app stores and processors require?

• Apple, guideline 5.3: real-money gaming apps must hold licensing and permissions where used, be geo-restricted, be submitted by the legal entity providing the service, and cannot sell gambling credit through in-app purchase.
• Google Play: an application process, a valid gambling license for each distribution jurisdiction, geo-blocking, underage prevention and an adults-only rating, with only online casino, sports betting, horse racing, lotteries and daily fantasy permitted.
• Stripe: prohibits "games of chance including gambling, internet gambling, casino games, sweepstakes and contests, and fantasy sports leagues with a monetary or material prize". You need a gaming-specialist processor from day one.

What must a gambling app verify?

The UK Gambling Commission's rule is the clearest statement of the standard most regulators apply: since May 2019, licensees must verify age before a customer can deposit or access free-to-play games, and obtain and verify name, address and date of birth before the customer is permitted to gamble. US state regulators require the same at account opening, plus geolocation at every wager.

Beyond the legal minimum, the fraud that drains a gaming P&L is multi-accounting: one person, many accounts, every welcome bonus. The control is one-to-many face matching at signup, so a returning bonus abuser is caught by their face rather than a fresh email.

The full list:

1. Age, before deposit or free play. A carrier age gate (the network confirms 18 plus) or face age estimation for a light first check, and the ID check for anyone who deposits.
2. Identity, before gambling: document, liveness, match.
3. Geolocation and VPN detection, at signup and at wager.
4. Multi-accounting, 1:N face dedupe at signup and on re-verification.
5. Self-exclusion, matched against your exclusion list and any state list.
6. Ongoing monitoring for source-of-funds and AML, with filings where required.

The deepidv workflow for a gaming app

deepidv's iGaming set exposes each of those as a workflow step or a direct call (workflow steps); the vertical overview is at deepidv.com/igaming:

curl -X POST https://api.deepidv.com/v1/workflows \
  -H "Content-Type: application/json" \
  -H "x-api-key: $DEEPIDV_API_KEY" \
  -d '{
    "name": "player-onboarding",
    "steps": [
      {"id": "ID_VERIFICATION", "config": {"minimum_age": 21, "escalation_type": "nfc-passport"}},
      {"id": "FACE_LIVENESS"},
      {"id": "ANTI_CHEAT"},
      {"id": "IP_JURISDICTION"},
      {"id": "VPN_DETECTION"},
      {"id": "INJECTION_DETECTION"},
      {"id": "PEP_SANCTIONS"}
    ]
  }'

Set minimum_age to the jurisdiction's threshold (18 or 21). ANTI_CHEAT is the one-to-many dedupe; it can also be called directly with a session id, an image and a device fingerprint, and returns UNIQUE, DUPLICATE, SELF_EXCLUSION or UNAVAILABLE with the configured action. INJECTION_DETECTION catches virtual cameras and injected video at capture, which is how deepfake attacks reach a KYC flow.

A light age check before any ID, for the free-play gate (carrier intelligence):

curl -X POST https://api.deepidv.com/v1/screening/carrier-age-gate \
  -H "Content-Type: application/json" \
  -H "x-api-key: $DEEPIDV_API_KEY" \
  -d '{"phone":"+447425604497","sensitivity":"medium"}'

The player session itself is the same hosted flow as any other vertical: POST /v1/sessions with the player's details and the workflow id returns a session_url; the session.status.verified webhook unlocks deposits (sessions, webhooks).

From Cursor or Claude Code with the deepidv MCP server attached, the prompt is: "Create the player-onboarding workflow above, add a server function that creates a session for a new player and blocks deposits until the verified webhook arrives, and run the carrier age gate before free play."

How do you handle the monitoring and filing side?

Licensed operators file suspicious activity reports and keep records. Arbiter, deepidv's compliance module, runs continuous user and transaction monitoring, Travel Rule and AML checks, and automated filings with FinCEN, FINTRAC, the NFIU and UK regulators, with six parallel sub-agents for sanctions, PEP, adverse media, re-verification, transaction patterns and behavior. It is the difference between a KYC check and a compliance program, and it is what a regulator asks for after the license is granted.

Every check, every re-verification and every filing carries a proof at proof.deepidv.com. When an auditor asks whether a player was verified before their first deposit, the answer is a link.

What does it cost?

Per check at the public list prices at the time of writing: identity with liveness $0.50, biometric dedupe 1:N $0.30, PEP and sanctions $0.40, age estimation $0.05, phone verification $0.15, with volume and term discounts that stack. iGaming is one of the priority verticals for the deepidv Startup Program.

Frequently asked questions

Is it legal to build a sweepstakes casino app in the US in 2026?

In a shrinking number of states. California, New Jersey, Connecticut, Montana, New York, Maine, Indiana, Tennessee, Oklahoma and Louisiana have banned or restricted them in 2025 and 2026, and several laws reach vendors and platform providers. Get gaming counsel before building.

Can I put a gambling app on the App Store?

Only with licenses for every jurisdiction where it is available, geo-restriction, submission by the licensed entity, and no gambling credit sold through in-app purchase. Google Play has an application process and similar rules.

What must a casino app verify before a player deposits?

Age and identity: name, address and date of birth, verified, plus geolocation at wager. The UK Gambling Commission requires age verification before deposit and before access to free-to-play games.

How do gambling apps stop bonus abuse?

One-to-many face matching at signup, so a returning player is recognized by their face regardless of the email and phone they use, combined with device signals and self-exclusion checks.

Will Stripe process payments for a gaming app?

No. Stripe prohibits games of chance, sweepstakes with prizes and casino games. Use a gaming-specialist processor.

Can deepidv handle age verification without collecting ID?

For a first gate, yes: carrier age checks and face age estimation confirm 18 plus without a document. Licensed play still requires full identity verification before a deposit.