Research

ChatGPT now checks casino licenses before it answers

Updated 17 August 2026

ChatGPT has started checking license information before it responds to players' prompts. Ask it which casino is the best one. It goes to the government register first. Nobody asks it to. What it finds there decides which brands appear in the answer, and which do not.

So we measured it. 81 controlled runs in New Jersey, Great Britain and Australia, nine questions repeated three times in each market, every claim scored against our own daily snapshots of 14 official gambling registers, which is how we could check the answers line by line rather than take them at face value.

In Britain it quoted license account numbers correctly, 42 register facts with no errors. In New Jersey it reproduced a regulator's revenue table figure by figure. In Australia, where online casino is illegal, it named no brand at all.

Then we sent one more message, five words long, and it produced a ranked list of offshore casinos sourced from affiliate sites.

It knows the difference between license 55149 and 55148

bet365 holds two British licenses, one for casino and one for sport. Asked which online casinos are legal in Britain, ChatGPT built a table nobody requested, brand, licensed operator, account number, and took the gaming license every time. It also skipped a surrendered Ladbrokes account for the active one, and picked the online Grosvenor licensee over the land-based company with a nearly identical name.

Twenty-one fields, all twenty-one correct against the register the same day. Across the British runs we checked 42 register facts and found no errors.

It got all ten New Jersey revenue figures right

Asked for the ten best online casinos in New Jersey, one run ranked them by regulator revenue and quoted ten figures. Every one was right, in the right order, with nothing skipped. Those brand-level numbers are not in the regulator's press release. They sit inside a PDF filing, one page per casino licensee, signed under penalty of perjury.

Ask for the best online casinos in Australia and it names none of them

Australia prohibits online casino. We asked for the ten best, the same question that produced ten-brand rankings in New Jersey and Britain. Across three runs it named zero brands and cited the statute instead.

These are legal findings rather than content policy. The runs also went after the way offshore sites make themselves look local. Australian branding, Australian dollars and local-style domains were each named, and each dismissed as carrying no legal weight. Zero casino brands were named anywhere in nine Australian runs.

One follow-up and the refusal disappears

Our protocol allowed one prompt per conversation and no follow-ups, so this sits outside the 81 runs. It is also the thing an operator most needs to know. Push back once on that Australian refusal, in five words, and the shortlist arrives.

Look at position three. Its Safety Index is 7.1 out of 10, and the answer states that Casino Guru notes no licence and an undisclosed owner. It stays ranked, still labelled best for pokies, and still appears in the final pick line.

The sourcing flips too. On the cold turn, Australian answers about prohibited products cited only the regulator and government departments, no affiliates at all across six runs. On the second turn the citations are affiliate and review sites, and the answer even names that ecosystem while using it, noting that some brands appear frequently on affiliate lists.

The license check applies to the opening answer. It did not survive one follow-up. Anyone measuring AI visibility with cold single prompts is only seeing the first turn, and a player who asks twice is further along than one who asks once.

It dropped two brands from its own ranking, and said why

Asked for the best AFL betting sites, one run went to the Northern Territory government's list of licensed operators, found two brands flagged as not currently trading, and cut them.

Betr and BoomBet are marked "not currently trading" there, so I have excluded them despite their appearance on some comparison websites. ChatGPT, Australia, 5 August 2026. We quote this as the assistant's reading of the list it cited. We have not verified either company's trading status ourselves.

New Jersey showed the same mechanism running backwards. Of three runs on which casinos are legal there, two fetched the regulator's page and scored 35 of 35 and 25 of 26 against the authorised list. The third leaned on a comparison site and named four brands as currently legal that hold no New Jersey authorisation. Two had closed years ago. One never held one.

Worth stating the limit. Only one of the three Australian runs used that trading-status field. The other two ranked one of those brands ninth and tenth.

Same question, opposite answer, both correct

One widely known gambling brand shares its name with an Australian financial app. We asked whether it was safe, in the same words, from all three markets. From New Jersey and London the answer was about the casino, cautious, six runs out of six. From Perth it was about the share-trading platform, positive, three out of three, with the financial license and custody arrangements laid out.

Any brand monitoring watching that query would show a clean positive in one market and a clean negative in the others, and be right both times, about two different companies.

It found a register we did not know existed

This one cost us two days. On an unlaunched casino site advertising a Curacao license, ChatGPT reported a register entry with a status, an expiry and a company number. We checked the regulator's certificate search, found nothing, and concluded it had invented the record.

It had not. The Curacao regulator publishes its real licensee register as a dated PDF on a media subdomain, roughly weekly, and we had not been reading it. The record was there, and every one of the eleven things the answer said about it was correct, down to the company registration number we had claimed appeared nowhere.

It also caught something we waved away. The operator's own footer publishes its license expiry as an issue date, with the wrong year. That mismatch is exactly the defect our brand-protection work exists to find, and we filed it as evidence the machine was making things up.

Where it actually breaks

• Dates. Entities, numbers and corporate structures came back clean. Dates did not. A British enforcement penalty landed in the wrong month in one run of three. A brand's market exit collapsed two events, two months apart, into a single date in all three runs. Thirteen claims across five British cells were stamped two days into the future, one of them a statement about the regulator's own data freshness.
• A hard search box hides a real license. Asked about a brand licensed in Anjouan, one answer named the register, said it could not retrieve the entry through the available search, and left the claim empty. The record exists in our snapshot. A valid license went unreported because the register is awkward to query, and for the operator holding that license this is the expensive failure.
• No document, invented document. One offshore brand publishes a single sentence about its licensing and no certificate at all. Two runs, in two markets, reported an expiry date from a certificate linked on its site. The archived page carries no such link and no such year.

One pattern sits under all three. Where a regulator publishes a plain list of who holds a license, the assistant can even state that a brand is absent from it.

Two things operators keep asking about

Bonuses never entered a ranking. In all eleven ranking runs across the three markets, the answer stated that its order was not based on welcome offers or sign-up promotions. One went further and disclaimed affiliate commissions by name.

And the location signal runs deeper than the country. Asked from a Perth IP where an Australian player can play a particular pokie, the answer named Crown Perth and cited the venue's own site. Not Melbourne, not Sydney, not a generic suggestion.

What this means if you run a casino brand

Your register row is a published surface now, read field by field, including fields you may not know are published. An expired-and-under-assessment status reached a player who asked a one-line question, in three markets, within days of that register edition appearing. A brand that stops trading gets dropped by the assistant reading the regulator and kept by the listings that do not.

That holds for the opening answer. On the second turn in our Australian capture, the regulator was gone and a third-party safety score set the order instead.

Two practical consequences. Your competitor set differs between the first answer and the second, so measure both. And the aggregator quoted on that second turn is doing the ranking, which makes its score a brand-protection surface.

For regulators, the format of your published register decides what an answer engine can say about the operators you license. A plain list lets it state that a brand is unlicensed. A record-by-record lookup leaves that unsaid. A difficult search box makes valid licenses vanish from answers. In our capture, none of that applied once the user asked a second time.

Method and limitations

81 runs, captured 3 and 5 August 2026. ChatGPT on the web, Temporary Chat, Intelligence set to High, one prompt per fresh conversation, no follow-ups. Nine questions per market, three repeats each. Five asked whether a named brand was safe, sampled by known register state. Four asked general questions with no brand supplied. The exit IP was verified at ipinfo.io before every block and logged with city, region and country. One early reading resolved to the wrong country, so it was discarded and no captures were taken on it. Every run was scored on six separate axes, whether a regulator source was reached, whether an exact record appeared, whether it matched our snapshot, whether local law appeared, the direction of the verdict, and what was recommended.

One limit our own protocol created. Allowing no follow-ups measured cold answers only, and a single follow-up changes the Australian result completely, as the section above shows. That capture sits outside the 81 and is reported as a single observation, not a scored cell. Wave 3 adds a second-turn cell to every market.

Three markets is not a global claim. What 81 runs support is a mechanism, shown in both directions, not a share of anything. Behaviour was intermittent throughout, which is why the results above are given as ratios. Two claim types carry no accuracy score here, review-platform ratings, because those platforms publish no history, and game availability inside a lobby, because a lobby sits behind a login.

A separate pilot of 25 brands ran on 2 August 2026, one run per brand, from a fourth vantage point. It read a brand-specific register record in 16 of 25 probes, all 16 matched our snapshots, and revoked licenses surfaced with their numbers in 4 of 5 cases. Its numbers never join the 81.

The research question came out of our iGaming client work, and no client data appears in the study. We hold the full row-level scoring for all 81 runs, with verbatim answers and per-run scores. Ask us for the run behind any number.