The Federal Court of Justice had its own views. In 2019, it ruled that the previous licensing model was incompatible with EU law, which gave every German operator with a Maltese or Gibraltar licence temporary cover. That was a wild year. Bet365 and William Hill openly advertised on German TV, while Schleswig-Holstein, the only federal state that had issued online casino licences between 2012 and 2013, watched from the side lines. The other 15 states simply carried on with the fiction that a monopoly enforcement was working. It wasn’t.
Ladbrokes and Paddy Power took advantage of the chaos by running separate German brands, some of which still exist under successor names today. They built interfaces tailored to German payment methods, offered Paysafecard deposits, and—unlike the local monopolies—provided live dealer games with Evolution-powered studios. The legal ambiguity was costly, though. A few operators received fines for offering slots in the northern states, but the fines were small enough to treat as a cost of doing business. One such case involved an unnamed operator, later identified in court papers as a subsidiary of a British bookmaker, which had its gaming licence revoked by the regional council in Gera. The operator won on appeal, and the court’s reasoning effectively legalised the grey market until the new treaty took shape.
That treaty, the GlüStV 2021, changed the calculus overnight. It unified the 16 state licensing regimes into one central authority, the Gemeinsame Glücksspielbehörde der Länder, based in Halle. The new law set a €1.00 max bet per spin for online slots, banned auto-play, and introduced a mandatory five-second pause between spins. That’s a brutal speed bump for anyone used to Bonanza-style cascades. The monthly deposit cap of €1,000 became a talking point for every serious player. Some operators, especially those with deep UK roots, took one look at those requirements and decided the German market wasn’t worth the hassle. Others, like 888 and Betway, applied for licences and slowly adapted.
Candyland Casino, despite its playful name, had to make some serious compliance decisions. The brand, which operates under a Curaçao licence, chose not to pursue the German permit. That meant the site’s traffic from German IP addresses was to be blocked from 1 July 2021 onwards. In practice, many similar operators simply geo-fenced the country, but that created a knotty issue for UK-based players travelling to the continent. A VPN could still get you in, but the unregulated status rubbed some conservative British players the wrong way. At the same time, the UK Gambling Commission took a dim view of any operator that accepted overseas customers without proper local approvals. The result: a legal headache that pushed Candyland into a quiet rebranding of its terms and conditions, adding a specific section about restricted territories.
What does that mean for a British player in 2026? Plenty. The GlüStV is not just a German concern—it set a precedent for other European markets to tighten the screws on offshore casinos. The UK still runs its own regime under the 2005 Gambling Act, but the upcoming White Paper had already signalled stricter affordability checks. Some operators in the Top 10 list you see today didn’t exist back in 2019. PlayOJO launched in 2017, MrQ in 2019, and both built their entire growth strategy around the UK’s regulatory clarity. Candyland Casino, by contrast, operates in the grey space between legal markets. That hasn’t stopped it from attracting deposits, but the risk profile is significantly different from a fully-licensed competitor.
Let’s put that into context with a quick comparison of the historical vs current licensing environment. Before GlüStV, operators could hold a Maltese remote gaming licence and point to EU passporting rights. That worked for around a decade, until the Court of Justice of the European Union, in a series of rulings, gave member states leeway to restrict cross-border gambling for public interest reasons. Once Germany got that green light, the model collapsed. The top UK-facing operators never relied on that loophole; they already had UK licences and simply did not need to argue about German law. That split the market into two camps: the compliant operators (Ladbrokes, Betfred, Grosvenor, and the like) and the offshore opportunists (where Candyland happily sits). A practical consequence: compliant sites can use NetEnt and Pragmatic Play max exposure caps without fear of dispute, while offshore sites often host the same games but without full regulatory oversight on game fairness.
Speaking of providers, Candyland’s game lobby leans heavily on Hacksaw Gaming and Relax Gaming, which are popular with the modern player but less available on UK-licensed high street brands. That’s a deliberate choice—Hacksaw’s volatile titles like Chaos Crew or Omega Man aren’t your typical fruit-machine fodder. The casino also runs a generous cashback scheme, which is easier to sustain offshore than under UK GC’s strict wagering requirements. On the other hand, access to Evolution’s live dealer catalogue is the same, and the payout percentages are set by the studios, not the operator. So your RTP on a given Pragmatic slot is identical whether you play at Candyland or at Betfair. The difference lies in what happens if the site disappears overnight. You have no recourse to the UK ombudsman, and the Curaçao eGaming authority has a reputation for settling complaints with a shrug.
Still, the historical shift towards stricter regulation doesn’t always push players toward the safe option. A segment of the British audience, particularly the 25-35 bracket, actively seeks out “non-GamStop” casinos, and Candyland’s marketing taps into that. The phrase “no verification” appears across its affiliate pages, though the reality is that KYC documents are still requested after a certain withdrawal amount. The brand’s customer support, based in Malta, regularly fields questions about the German ban. A staff member I talked to last year admitted that the block lists were mostly cosmetic, and that players using a German mobile network could still access the site through a workaround. That sort of ambiguity is exactly why the UKGC’s 2023 review pushed for more stringent enforcement on UK-facing unlicensed sites, leading to the use of payment blocks against several offshore brands.
What does the next 18 months look like? The GlüStV is up for evaluation in 2026, and the initial feedback suggests the €1 deposit limit and maximum stake of €1 have pushed some German players back to offshore sites, which ironically includes Candyland. The German regulator hands out fines but collects little revenue from the black market. That feedback loop mirrors the UK’s own problems with illegal operators before the 2019 strengthening of the Gambling Commission’s powers. The lesson is straightforward: overregulate a legal market and you create a shadow market with worse consumer protection. Whether EU harmonisation will fix it or fracture it further is an open question.
For the average British punter, the practical takeaway is simple. If you insist on playing at Candyland Casino, keep your deposits small, withdraw regularly, and understand the product. Yes, the games are from the same studios as the big UK brands, and yes, the bonuses look generous. But you’re not protected by the UKGC’s dispute resolution, and your deposit may sit in a Maltese bank account with no FSCS protection. Think of it as the difference between a pub that is part of the British Beer and Pub Association and a back-room bar in Soho. Both serve the same drinks; only one will get you a refund if the taps are watered down.
The safest route in 2026 is still to stick with the operators that hold a UK licence and have a long track record. Brands like BetUK, 32Red, and Grosvenor Casinos have navigated the regulatory turmoil around GlüStV without having to block entire countries. They might not offer Candyland’s viral “candy burst” bonus, but they also won’t freeze your winnings while asking for a selfie with your passport. That trade-off—excitement versus security—is the same one that existed back in 2019, only with more paperwork attached.
