It’s undeniable that youth gambling is a real problem. A 2024 study found that individuals who begin gambling before age 18 are 50% more likely to develop a gambling disorder. Senator Britt’s own press release cites a Mott Poll finding that 1 in 6 parents wouldn’t even know if their child was gambling online.
This is a legitimate concern, but good intentions and good policy are not the same thing. And the Gaming Advertisement to Minors Enforcement Act of 2026, the GAME Act, introduced on May 18th by Senators Katie Britt (R-AL) and Richard Blumenthal (D-CT), is a bill worth reading carefully before anyone starts applauding.
Anytime I see a tech policy pitched as “child protection,” I have to wonder if it expands government surveillance frameworks. The GAME Act is no exception. It quietly assumes the surveillance infrastructure already exists, requires platforms to use it to comply, and then walks away without a single data protection guardrail in place.
That pattern should be familiar if you’ve been following our work. We flagged this in the TAKE IT DOWN Act, in POPA, in the App Store Accountability Act bills making their way through state legislatures. While the justification changes, the infrastructure it relies on stays exactly the same.
What the Bill Actually Does
The GAME Act prohibits “covered digital advertising platforms”; social media companies, search engines, and major ad networks with more than 100 million monthly users, from displaying targeted ads promoting sports gambling platforms to minors.
The prohibition takes effect one year after enactment. Enforcement goes to the FTC, which can treat violations as unfair or deceptive trade practices. Repeat offenders, platforms that rack up three or more enforcement actions, get referred to the Department of Justice, where fines reach up to $100,000 per advertisement shown to a minor.
The sports gambling definition includes prediction markets, which is worth noting. Senator Blumenthal’s quote in the press release specifically names “sportsbooks and prediction markets” as the target. That’s a deliberate policy choice, not a drafting accident, and it’s one that will generate First Amendment litigation given how contested the regulatory classification of prediction markets currently is.
“Sportsbooks and prediction markets are treating young people like a gold rush, flooding the internet with advertisements and promotions to hook them on gambling when they’re young,” said Senator Blumenthal. “High schoolers, even middle schoolers, are now gambling on their phones as never before, losing real money and creating life-altering addiction. The GAME Act would create a nationwide ban on targeted advertising of gambling to kids, backed with the force of punishing fines.”
On the surface, the mechanism sounds targeted: stop platforms from using what they know about your kid to push gambling ads at them. That’s reasonable, but the mechanism only works if platforms already know which users are minors. And the bill’s definition of what counts as a “targeted advertisement directed to a minor” tells you exactly what they’re expected to know.
The Definition That Does All the Work
Section 2(c)(10) defines the prohibited act. A targeted advertisement directed to a minor is one that an online advertising provider “links or possesses the information to be able to link to a minor” based on:
- The personal information of the minor
- The profiling of a minor based on observed behaviors or predicted preferences inferred from online activities
- A unique identifier of the connected device
So far, that sounds like it’s simply describing what bad actors are already doing. But here’s where it gets complicated.
To avoid liability under this bill, a platform has to be able to demonstrate that an ad wasn’t targeted to a minor. That means they have to know, or be able to determine, which users are minors. Which means they need the infrastructure to make that determination.
Now look at how the bill defines “personal information” in Section 2(c)(8). It’s not a short list. It includes:
- Name, address, email, phone number, Social Security number
- Photographs, video, and audio files containing a minor’s image or voice
- Geolocation information down to GPS coordinates, cell tower data, and Wi-Fi identifiers
- Persistent identifiers that track a minor across websites and apps over time — cookies, IP addresses, device serial numbers, unique device identifiers
- Biological and physiological characteristics used for identification: fingerprints, voiceprints, iris scans, facial templates, DNA, and gait
- Information linked or reasonably linkable to a minor, combined with any of the above
Look that list over again. That is a surveillance-grade inventory. Biometrics. Behavioral inference. Cross-platform persistent tracking. Facial templates. Voiceprints.
The bill doesn’t require platforms to collect any of this. It doesn’t have to. It defines compliance in terms that are only achievable if you already have it. And then it attaches civil penalties and potential DOJ referral to non-compliance.
The Infrastructure-as-Given Problem
This is what I’ve been calling the “infrastructure-as-given” problem, and the GAME Act is one of the cleaner examples of it I’ve seen.
Congress isn’t building a surveillance system here. It’s writing law that treats one as already existing, as settled background infrastructure rather than something that deserves scrutiny or constraint. The bill says: we know platforms already maintain detailed profiles on their users, including which ones are minors, and we’re going to use that fact as the enforcement mechanism for this prohibition.
The practical consequence is that platforms facing FTC enforcement pressure will build more robust minor-identification infrastructure, not less. A platform that doesn’t maintain a comprehensive profile on its users has no way to prove it didn’t target a minor with a gambling ad. Compliance pressure flows in exactly one direction: toward more data collection, more behavioral profiling, more persistent identification of minors across platforms and devices.
The bill’s authors would likely argue that the personal information definition is just describing what’s already prohibited from being used for targeting, not requiring platforms to collect it. That’s a reasonable reading of the intent; however, it is not a reasonable reading of the incentive structure the enforcement mechanism creates.
What the Bill Doesn’t Do
There are no data retention limits in this bill. None. A platform could build a detailed dossier on every suspected minor on its platform, comply perfectly with the GAME Act by not showing them gambling ads, and then sell that dossier to a data broker the same afternoon. Nothing in this bill prevents that.
There are no data security standards. If a platform builds minor identification infrastructure to comply with this law and that infrastructure gets breached, the GAME Act provides no recourse and imposes no obligation.
There is no prohibition on third-party data sharing. The compliance infrastructure platforms build under this law can be monetized, licensed, transferred, or sold. The bill is silent.
There is no warrant requirement for law enforcement access to the minor profile data platforms build. The geolocation provision includes a narrow carve-out, data that reveals only “coarse location” and is deleted within 48 hours is excluded from the definition, but that’s the only data lifecycle protection in the entire bill.
And there is no parental role anywhere in this legislation: no consent mechanism, not notification requirement, and no private right of action. Senator Britt’s own press release quotes her saying that “youth gambling addictions could be developing under parents’ roofs without them even knowing it,” and then the bill’s answer to that is to hand enforcement entirely to the FTC and the Department of Justice. Parents are completely absent from the remedy for a problem that is happening in their own homes.
The Prediction Markets Landmine
The bill defines “sports gambling platform” as “any service that allows an individual to gamble on a sporting event, including a service marketed as allowing an individual to invest in prediction markets.”
Prediction markets are actively contested regulatory territory right now. The CFTC, the FTC, and multiple federal courts have been grappling with whether and how to classify them. Lumping them into a sports gambling definition without any limiting language is going to generate litigation, and that litigation could unravel the cleaner, less controversial gambling advertising prohibition that sits at the core of this bill.
If the prediction markets inclusion gets challenged and survives, it sets a precedent for how broadly Congress can define “gambling” in the digital advertising context. If it gets struck down, it creates risk that the entire definitional framework is tainted. Either way, it’s an unnecessary complication that weakens the protective intent of the bill rather than strengthening it.
So Where Does This Leave Us?
I run every technology bill through a structured evaluation framework, and I want to be honest about where this one initially landed. The GAME Act doesn’t mandate age verification by name and it doesn’t create a centralized government database. It doesn’t condition anyone’s access to lawful content on identity verification. So, on its face, it clears the triggers I typically use to call for automatic opposition.
But the more I worked through the compliance logic, the clearer it became that clearing those triggers doesn’t mean the bill is clean.
Here’s the problem that data guardrails can’t fix: to not show a gambling ad to a minor, a platform has to know the user is a minor. There is no version of this bill…no amendment, no revision, no additional privacy protection, where that determination doesn’t have to be made. Data minimization governs what happens to age verification data after the fact. It doesn’t eliminate the verification requirement itself. The bill doesn’t mandate age verification explicitly, but it mandates the outcome and leaves the method to the platform’s discretion, which means platforms will build whatever identification system is cheapest and most scalable, with no statutory floor on what that looks like.
And then layer the surveillance infrastructure problem on top of that. The personal information definition in Section 2(c)(8) doesn’t just describe what platforms might incidentally possess. It ratifies the entire behavioral surveillance stack, biometrics, behavioral inference, persistent cross-platform tracking, as settled compliance infrastructure. Data guardrails would limit what platforms do with that stack. They don’t constrain the stack itself or prevent it from being built out further under compliance pressure.
These two problems are independent of each other, and either one is sufficient. Together, they mean there is no amendment path that fixes the GAME Act’s core architecture. The problems are structural, not incidental.
The justification here is genuine; youth gambling is a real harm and Senator Britt’s concern for children is not performative. But the justification doesn’t change the architecture. The infrastructure is the constant, and the justification is the variable. That’s been true of every bill in this space I’ve analyzed, and the GAME Act is no exception.
CLA opposes the GAME Act.
Julie Barrett is the founder and president of Conservative Ladies of America, a 501(c)(4) constitutional conservative policy advocacy organization. She has testified against age verification and digital ID legislation in numerous states.