DraftKings

Is DraftKings safe?

DraftKings is a licensed, closely watched sportsbook, and the account protections are better than on most betting apps: a text-message code is required at every sign-in, and limits and self-exclusion cannot be undone early. The risk is the product. Live betting, parlays and online casino games sit one tap apart, the app tracks you for advertising across other apps, and state regulators fine DraftKings for compliance slips several times a year. We score it 50/100.

DraftKings started as a daily fantasy sports site in Boston and now runs its sportsbook in about 29 US jurisdictions, according to its June 2026 quarterly filing. The App Store listing claims a presence in all 50 states, which it reaches by mixing in fantasy contests, horse racing and DraftKings Predictions, a federally regulated event-contract product similar to Kalshi.

Has DraftKings been hacked?

Not in the sense of a database breach, but its customers were hit hard in November 2022. Attackers took username and password pairs leaked from other websites and tried them on DraftKings, a method called credential stuffing. DraftKings told Maine's attorney general that 67,995 customers were affected, and federal prosecutors in Manhattan put the money withdrawn at about $600,000. One of the attackers was sentenced to 30 months in prison in April 2026 and ordered to pay $1.3 million in restitution.

DraftKings' answer was to make two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary sign-in compulsory. If you are in a state where its sportsbook or casino is legal, every login needs a code sent by SMS. That is a real improvement, though SMS codes can be stolen through SIM swaps. DraftKings' help pages describe only text-message codes for the sportsbook. We also found no public bug bounty programme on HackerOne or Bugcrowd.

What does DraftKings do with your data?

Quite a lot. The App Store label says contact info, identifiers and "other data" may be used to track you across other companies' apps and websites. The data linked to your identity includes precise location (needed to prove you are in a legal state), contacts if you sync them, photos, search history, purchase history and payment details.

The privacy notice, last updated in May 2025, adds Social Security and driver's licence numbers and, with your consent, selfie face scans compared against your ID by vendors such as Onfido and Socure. DraftKings offers a Do Not Sell or Share link and honours Global Privacy Control in some states, which tells you that ad-related sharing happens. You can close the account yourself in the app, but closing is not erasure: gaming rules require records to be kept, and the notice says deleted data may stay in archives.

How often has DraftKings been fined?

Often, though mostly for small amounts. The pattern matters more than any one fine:

• Massachusetts, July 2025: $450,000 after DraftKings let 218 customers place 1,160 bets with credit card money, which state law bans. The commission said earlier fixes had failed and ordered refunds and an independent audit.
• Ohio, November 2024: $425,000 for taking college player-prop bets after the state banned them and for allowing an unapproved funding source for betting accounts.
• Connecticut, 2024: $19,000 over an online slot that paid nothing in more than 20,000 spins by 522 players.
• Ohio, February 2023: $500,000, of which $350,000 was for mailing betting ads to people under 21 and $150,000 for ads that lacked responsible-gambling messages or promoted "free bets".
• Massachusetts and New Jersey, 2024 to 2026: several penalties of $6,500 to $32,500, mostly for taking bets on events or markets the state had not approved.

Before sports betting was legal, the attorneys general of New York and Massachusetts settled with DraftKings in 2016 and 2017 over its fantasy contests, for $6 million and $1.3 million. The New York case is now more than ten years old. Several private class actions over "risk-free" and "no sweat" promotions are pending; those are allegations, not findings.

Limits and self-exclusion

This is where DraftKings does better than prediction-market apps. Under My Budget and Controls you can cap deposits, total wagers, single bets and daily time on the app. Loosening a limit takes a waiting period of one day to a month (90 days for deposit limits in Massachusetts, Ohio and Louisiana), plus another 24 hours. Self-exclusion runs for one, three or five years or for life, applies in every state, and DraftKings says it is not allowed to shorten it.

The sportsbook age line is the one most states use: 21, or 18 in Washington DC, New Hampshire, Puerto Rico and Wyoming. DraftKings Predictions breaks that line. Its help pages say anyone 18 or older with a verified account and a Social Security number can trade, so in many states a 19-year-old who cannot use the sportsbook can still back a team in the same app. Our cap for real-money betting apps still applies, because the features that make DraftKings popular (instant live bets, boosted parlays, slots in the same wallet) are the ones linked to gambling harm.

How to use DraftKings more safely

1. Set a monthly deposit limit before your first bet, and a single-bet cap if you play parlays.
2. Use a unique password; the 2022 attack worked only on reused ones.
3. Add a SIM lock or port-out PIN with your phone carrier, since your sign-in code arrives by text.
4. On iPhone, choose "Ask App Not to Track", and use the Do Not Sell or Share link if your state offers it.
5. If you want to stop, use self-exclusion rather than closing the account, because only exclusion blocks a new sign-up and marketing.

How we scored it

Transparency and control (60) is the strongest factor, thanks to self-serve closure and limits that cannot be loosened early. Privacy (40) is the weakest, pulled down by cross-app tracking and the identity data a sportsbook holds. Security (56) balances forced two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary sign-in against the 2022 account takeovers, and the regulatory record (55) reflects the 2017 Massachusetts settlement plus state fines over ads to under-21s, credit-card bets and a slot that never paid. Fines for unapproved betting markets count only as context. FanDuel, its main rival, and PrizePicks (52) are the closest comparisons.