Brazil's $97B Warning: Regulated Markets Built the Wrong Walls

by Harvey Specter Jr., Law, Business & Power Correspondent

---

$97.4 billion. That is what illegal online gambling operators collected in the United States in 2025, according to a Gaming Compliance International report — a 45% jump in a single year, in a country that spent the better part of a decade congratulating itself for legalizing sports betting state by state. The regulated sector grew too, just at roughly half the speed. Let that land. Every licensing framework, every compliance budget, every press release about responsible gambling — and the unlicensed side of the market is still lapping the field.

This is not a regulatory failure. It is a structural one. Regulated markets are built to tax and constrain operators who raised their hands. The ones who didn't raise their hands simply kept running. You cannot legislate people out of a market when the barrier to entry on the illegal side is a server and a payment processor willing to look away. What you can do is make the legal product so frictionless and so attractive that the illegal alternative loses its edge. Most regulators chose paperwork instead.

Brazil is watching this lesson unfold in real time and, to its credit, is doing something about it. The Ministry of Finance has moved beyond warning letters into automated website blocking and asset freezes targeting illegal operators — the kind of enforcement that actually costs someone something. A separate study showed illegal betting's market share falling in the first half of 2026, which means the pressure is working, at least partially. Brazil went from a completely unregulated market to aggressive enforcement inside eighteen months. That is not a slow government. That is a government that understood the window.

Meanwhile, in Philadelphia, Rivers Casino is heading to court over a 2024 data breach after a federal judge refused to dismiss the class action. The operator tried the standard move — argue standing, argue harm, argue the claim is too speculative. Judge Joshua D. Wolson was not persuaded. This is the second-order consequence of an industry that collects extraordinarily sensitive financial and behavioral data on millions of users and treats cybersecurity as a cost centre rather than a liability. A data breach at a casino is not like a data breach at a retailer. The plaintiff's attorneys know exactly what that data contains and exactly what a jury will think about it.

The through-line here is the same one it always is: the house builds the game, but regulators and plaintiffs are learning to build the walls around it. The question is whether those walls go up fast enough — or whether the illegal market, already at $97.4 billion, simply builds a door.

One move you can make tomorrow: If your business collects user data and you haven't stress-tested your breach notification procedure against the jurisdiction where your users actually sit — not where your servers are — do it before someone else finds the gap for you.