The complaint alleges data was transmitted during the act of placing a trade, not just general browsing. According to the filing, Kalshi “employs over 60 different third-party trackers on its website,” including technologies associated with Google, Meta, TikTok, LinkedIn, HypeLab, Rokt, Amplitude and AppLovin. Four of those trackers allegedly captured data specifically during trade submission — including which market was selected, whether the user bought or sold “Yes” or “No” contracts, order details, device identifiers, browser information and approximate location.

The first incident cost customers real money; the pattern repeated three years later. In November 2022, DraftKings disclosed that attackers used stolen login credentials from other websites to break into customer accounts, draining up to $300,000 before the company refunded 67,995 affected customers. In October 2025, DraftKings notified customers of a second, similar credential-stuffing campaign, later clarifying the incident affected fewer than 30 accounts. In both cases DraftKings said its own systems were not directly breached — attackers reused passwords leaked from unrelated services — but the recurrence highlights how account-level exposure at a betting platform, even without a network intrusion, still results in name, address, date of birth, payment card and transaction data being exposed.

Awareness of GPS tracking is high; awareness of data sharing and breaches is not. 63.5% of respondents already knew betting apps verify real-time physical location on every bet, and another 22.8% suspected it. But only 34.3% knew platforms commonly share activity data with third-party advertisers, and just 27.0% knew a major sportsbook has disclosed customer account breaches in both 2022 and 2025 — despite 20.8% saying real-time location checks have personally caused them a problem while inside a legal state.