Polymarket

Is Polymarket safe?

Safe as a place to hold money, mostly; safe as a habit, less so. Polymarket's US app sends your orders to QCX LLC, an exchange registered with the CFTC, with a registered clearinghouse behind it, and you sign in with your Google or Apple account. But it lets 18-year-olds trade on live games, we found no deposit limits or self-exclusion in its documents, and states are suing over whether its sports contracts are illegal betting. We score it 46/100.

There are really two Polymarkets. The famous one, polymarket.com, runs on crypto wallets and blocks trading from the United States. The App Store app reviewed here is Polymarket US, which launched in December 2025 after the company bought a licensed exchange, and which takes dollars by debit card or bank transfer. The listing claims more than 30 million users worldwide.

Is Polymarket gambling?

Legally it is a derivatives exchange: you buy a contract that pays $1 if something happens. In practice the app sells itself on sports, with "LiveTrade" in-game markets on the NFL, NBA and dozens of leagues, next to elections, weather and Oscars markets.

States see the sports side as betting. Tennessee moved first: on 9 January 2026 its Sports Wagering Council sent Polymarket, Kalshi and Crypto.com cease-and-desist letters saying their sports contracts were unlicensed betting, and demanded that they stop offering them to Tennessee residents, void open positions and refund deposits by 31 January. Polymarket has not said it left the state, and in October 2026 its App Store listing named only Nevada as a state where trading is unavailable. Nevada's Gaming Control Board sued later in January. A judge barred Polymarket's event contracts in the state in February, finding the regulator "reasonably likely to prevail", and granted a preliminary injunction at the end of May. The App Store listing now says trading is unavailable in Nevada. On 24 September 2026 New York's attorney general sued QCX LLC as an "illegal, unlicensed gambling operation", asking for restitution to users and fines of three times Polymarket's gains. Polymarket hit back the same day: it moved the state's case to federal court in Manhattan and filed its own suit against the attorney general and the state's gaming commissioners, arguing that federal law leaves its exchange to the CFTC. It asked that court for a preliminary injunction on 12 October. Connecticut had joined in two weeks earlier: on 10 September 2026 the governor announced that the state's Department of Consumer Protection had that week ordered Polymarket and eight other prediction markets to stop offering sports event contracts to state residents and to let them withdraw their money. The state says these platforms take bets from people under 21 and from people on its self-exclusion list, and warned of civil and criminal penalties. By early October three of the nine had left Connecticut; Polymarket was not one of them, according to state officials quoted by CT Insider. Missouri followed: on 18 September 2026 Attorney General Catherine Hanaway announced cease-and-desist letters to Polymarket and five rivals, saying their sports contracts are unlicensed betting and that Polymarket either lets under-21s in or lacks safeguards to keep them out. She warned of enforcement action if they kept offering the contracts without a state licence.

Ohio came next. The Ohio Casino Control Commission sent cease-and-desist letters dated 2 October 2026 to 10 prediction market operators, Polymarket among them, giving each 14 days to reply in writing. Polymarket answered with a lawsuit: on 16 October QCX LLC sued the commission's members and the state's attorney general in federal court in Columbus, calling Ohio's sports betting law unconstitutional. Michigan is the first state where Polymarket has backed down. It sued Michigan's gaming regulator and attorney general in federal court in March 2026, but the judge refused a restraining order and, in June, a preliminary injunction; its appeal is pending. On 28 October 2026 the Michigan Gaming Control Board announced that Polymarket US had agreed, in a stipulation approved by the federal court, to stop offering new sports contracts to Michigan residents and to close all open positions by 25 November. In return, the state will not take enforcement action while it complies. These are the same fights Kalshi faces, and the outcome may differ by state from month to month.

Polymarket has been here before. In January 2022 the CFTC found it had run more than 900 event markets without registering as an exchange, and it paid a $1.4 million penalty and agreed to wind those markets down.

Can 18-year-olds use Polymarket?

Yes. The app's terms set 18 as the minimum, or a higher age where state law requires it. New York's lawsuit says 18- to 20-year-olds can trade there although state law reserves mobile sports betting for those 21 and over.

The bigger gap is what happens after sign-up. Licensed sportsbooks such as FanDuel must offer deposit limits, timeouts and self-exclusion. We found none of these in Polymarket US's terms or help documents in October 2026, and a "responsible trading" link on its website led to a missing page. The privacy policy mentions public chat forums, and Apple flags the app for user-generated content and social media features.

What does Polymarket do with your data?

The App Store label looks light: identifiers and usage data may be used to track you across other apps, and only identifiers are linked to you. The privacy policy, effective 16 September 2026, tells a fuller story. To open an account you give your name, address, Social Security number and bank details, and may be asked for a selfie that is matched against your ID. The app collects location from GPS, Wi-Fi or IP address. The policy's own table marks identifiers, a category it says includes name, email, Social Security number and device IDs, as "sold or shared", with social media and marketing partners among the recipients. The label understates that, so we score the broader policy.

You can ask for deletion, and opt out of sale and targeted advertising by emailing [email protected], but there is no deletion button that we could find, and a regulated exchange must keep trading records.

Account security and crypto

Polymarket US has no password of its own: you log in through Google or Apple, so your account is only as strong as that login. Turn on two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary sign-in or a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary there. The company warns never to share verification codes, including with its support staff.

The global crypto platform had a rough end to 2025. In December Polymarket said a flaw introduced by a third-party authentication provider let attackers into "a small number" of accounts, and users reported their balances drained. On the positive side, its smart contracts have been audited by firms including Cantina, Certora, Quantstamp and Zellic in 2026, and it pays researchers through a bug bounty on Cantina.

How to use Polymarket more safely

1. Secure the Google account or Apple ID you sign in with, using a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary sign-in.
2. Decide your own monthly budget before depositing, since the app offers no limits we could find.
3. On iPhone, choose "Ask App Not to Track", and email [email protected] to opt out of the sale and sharing of your data.
4. Check whether markets are available where you are; a court order can switch them off in your state.
5. If you are under 21, know that your state may treat these contracts as sports betting.

How we scored it

Security (58) is the strongest factor, helped by Google or Apple sign-in, regulated clearing and heavily audited contracts, and held back by the December 2025 account drains. Scams and harmful content (35) ties for weakest: fast sports trading from age 18 with no harm tools. The regulatory record (35) is just as weak: it combines the 2022 CFTC penalty with Nevada's injunction, cease-and-desist orders from Tennessee and Connecticut that Polymarket has not followed, Missouri's September order, Ohio's order that it is fighting in court, its agreement to leave Michigan's sports market, and New York's pending lawsuit. Kalshi scores 51 and PrizePicks 52.