Non GamStop Casino Apps 2026 — PWA, Native, Sideloading

Three things called an "app" at non GamStop casinos

When an offshore operator advertises a "mobile app", it can mean one of three quite different things. First, a genuine native application distributed through Apple's App Store or Google Play — rare in this market for reasons the store-rules sections below explain. Second, a Progressive Web App installed from the browser share menu — same web code, different shell. Third, a sideloaded APK file downloaded directly from the operator's site and installed on Android with the store's malware scan bypassed. The three routes carry different reviewer risk profiles. When you see "download our app" on a non gamstop casino landing page, the first job is to identify which route you are being offered. The button label rarely tells you honestly; look for the store badges, the "Add to Home Screen" hint, or the direct APK download link. For an overview of how these routes fit against browser play, see the non gamstop casinos homepage.

The proportion of each route in the market runs roughly as follows in our reviewer bench. Around 5% of offshore operators offer any UK-visible listing on either the App Store or Google Play, usually under a narrow sports-book or companion-app justification. Around 60% offer a Progressive Web App installable from the site's mobile lobby. Around 20% offer a direct APK download for Android, usually behind a "click here for the Android app" banner. The remainder offer no explicit app route and expect users to bookmark the mobile web.

Apple App Store rules for gambling apps

Apple's App Store Review Guideline 5.3 sets out the rules for real-money gambling. Apps must be geo-restricted to countries where they are legal, must be submitted by an entity holding the necessary licences, and the licences must be verifiable. For the UK, that means a UK Gambling Commission licence. Since UKGC participation is a licence condition for GamStop participation, only UKGC-licensed operators can list a real-money casino app for UK users on the App Store.

Non-UKGC operators can hold licences in other jurisdictions — Curaçao GCB, Anjouan Offshore Gaming, MGA Malta — and can attempt to list under those jurisdictions. The territory switch on the App Store enforces the geo-restriction. When a UK user opens the App Store, apps not licensed for the UK are not shown. This is why searching "casino" on a UK iPhone returns UKGC-licensed brands and a handful of social-casino (play-money) apps, and no offshore operators.

Apple has also historically restricted apps that route real-money gambling through the App Store's own payment system, and requires the payment to be made outside Apple's in-app purchase mechanism. This is a benefit to operators (no 30% Apple cut on deposits) but a friction for casual users who expected to deposit with their Apple ID. The offshore market has not been able to solve for this because it does not clear the more fundamental licensing hurdle.

Google Play rules for gambling apps

Google Play's Real-Money Gambling policy runs similarly to Apple's. Since 2021 Google has expanded the list of countries where real-money gambling apps are permitted on Play, including the UK, but the developer must submit a country-specific application demonstrating licensing. For UK listings that means UK Gambling Commission licensing. Offshore operators holding only a Curaçao or Anjouan licence cannot pass this application for UK-visible listings on the Play Store.

Google's enforcement is generally quieter than Apple's — apps can slip through initial listing and be delisted months later during a policy sweep. This makes any listing under thin justification structurally unstable. In our reviewer sample the average lifetime of an offshore operator's UK-visible Play listing was under six months before a sweep pulled it. The engineering effort to maintain a listing that will be pulled again is a poor allocation for the operator, and most have stopped trying.

Where an offshore operator does maintain a Play listing, the app usually contains only account management, sports-book odds views or news updates rather than the full casino shelf. The casino play itself is either linked out to the mobile web or opened in a WebView inside the app. Either way the actual gaming session runs the same web code as the browser lobby.

The Progressive Web App workaround and what it does not do

Progressive Web Apps solve the store-listing problem by bypassing it entirely. A PWA is a website that ships an install manifest and a service worker so that a modern mobile browser can offer "Add to Home Screen". The result is an icon on the phone that opens the site in a full-screen shell without the browser bar. To a casual user it feels indistinguishable from a native app. Under the hood it is the same web code the operator ships to the browser lobby.

What the PWA route does: it gives the operator a home-screen presence, a full-screen shell, service-worker caching for faster loads, and — on Android and iOS 16.4 and later — Web Push notifications. It preserves the operator's flexibility to iterate on daily deploys without waiting for a store review. It works on iOS and Android with essentially the same manifest.

What the PWA route does not do: it does not carry an app-store safety review. There is no verified developer badge, no malware scan, no permissions audit performed by a third party. The safety of the PWA is exactly the safety of the operator behind it — if you trust the site enough to deposit in a browser, installing its PWA changes little. If you would not trust the site in a browser, do not install its PWA. The PWA does not confer legitimacy that the operator otherwise lacks.

Sideloading APKs and the security warning

Sideloading is the direct installation of an Android application package (APK) file outside the Google Play store. The operator hosts the APK on its own website, the user downloads it, and Android prompts the user to enable "Install unknown apps" for the browser before the install completes. This route is Android-only — iOS does not permit sideloading for consumer users under the normal store model.

The security caveats are real. When you sideload an APK you are trusting: (1) that the download itself has not been tampered with in transit — HTTPS helps but is not a signature check; (2) that the operator's signing key has not been stolen or misused; (3) that the update chain is honest — a subsequent update pushed by the operator carries no store-level verification; (4) that the permissions the app requests are proportionate to its stated function.

• Only sideload from HTTPS URLs published on the operator's official domain, never from a third-party mirror.
• Check the APK signature after download using a tool like APK Signature Verifier before installing.
• Review the requested permissions on first install — an offshore casino app has no legitimate reason to request contacts, SMS, or precise location.
• Uninstall promptly if the app requests store-independent updates or accessibility-service permissions.
• Assume that a sideloaded APK carries a higher risk profile than the browser or PWA route.

The reviewer position on sideloading is to avoid it unless there is a specific engineering reason the operator's PWA or mobile web does not meet your needs — and those reasons are vanishingly rare in 2026. The browser route and the PWA route provide effectively the same experience as a sideloaded APK, without the unverified-software risk stacked on top of the already-serious operator risk. If a site is aggressive in pushing you toward its APK when its PWA works, treat that as a small warning signal about how it approaches user consent generally.

How updates work outside the stores

App-store apps update through the store. Apple pushes app updates through the App Store update mechanism, Google Play through Play Store updates. The store verifies the update signature and scans for malware. Outside the store both mechanisms are absent. PWAs update through the service worker — the site publishes a new version and the browser fetches it on the next visit. Sideloaded APKs update through whatever mechanism the operator has built in, which is usually an in-app "update available" prompt that downloads a new APK from the operator's site.

The PWA update chain is safe because the browser mediates it. Chrome and Safari verify TLS, execute the service worker in a sandbox, and enforce the same-origin policy. A malicious update to a PWA cannot escape the browser's sandbox — the worst case is a compromised session for that site alone. Sideloaded APK updates carry more risk because the operator is trusted to deliver the update chain honestly. A compromised update-server or a stolen signing key can push malware to every user who has the app installed.

The reviewer note on updates: the PWA route is the update chain we recommend defaulting to. If your operator ships only a sideloaded APK and no PWA, you can install the site to your home screen as a bookmark from the browser share menu — this gives you a home-screen icon without the app-installation risk, though without the full-screen shell that a PWA manifest provides.

App permissions to review before install

Whether native, PWA or APK, an installed app carries permissions. For casinos the legitimate list is short: internet access (obviously), camera for KYC selfies, biometric hardware for WebAuthn login. Everything else deserves scrutiny. Contacts, SMS, precise location, microphone, phone identifier, storage-write beyond the app's own scope — none of these are needed for a casino to function, and any app requesting them should be interrogated.

PWA permissions are governed by browser-level prompts. When a PWA asks for camera access, notification permission or location, the browser shows a native dialog and the permission is scoped to that site. You can revoke a PWA permission at any time from the browser settings for that origin, independent of the PWA install. This is the strongest permissions model in the three routes and is one of the reasons the PWA route is preferred.

Delistings and the fragile-listing pattern

Even rare native listings for offshore operators are unstable. The store enforcement patterns are cyclical: Apple runs periodic sweeps against real-money gambling apps that were listed under thin justifications; Google Play runs its own reviews on a semi-annual cadence. In our reviewer archive of casino-app listings tracked since 2019, the median lifetime of a UK-visible offshore operator listing was under six months before a delisting event.

Delistings are usually notified to the operator with a short remediation window, but the app is removed from the store immediately. Users who had installed the app before delisting typically keep the installed copy — the app continues to run because the store only controls new installs — but future updates are blocked. The operator then has to migrate users back to the mobile web or the PWA. In practice most operators anticipate the delisting and pre-emptively route new users to the web.

The consumer note: if you install a native offshore casino app from a store, expect the listing to disappear on a store sweep, and the operator to migrate you to the web at that point. This is not a sign of the operator being dishonest — it is a structural feature of the store's gambling-policy enforcement. It is another reason the PWA route, which does not depend on store listing, is the more stable long-term route.

Companion and news apps that are not casinos

Some offshore operators list companion apps on the App Store or Google Play — a news app for casino promotions, a sports-book odds viewer, or a customer-service chat app. These clear the store review because they do not offer real-money gambling directly. The gambling itself happens on the mobile web, either through an in-app WebView or by linking the user out to the browser. The store sees a permitted non-gambling app; the user reaches the same real-money site as anyone else, just via a different route.

The reviewer view on companion apps is neutral. They are functional but they are not casino apps in the meaningful sense — they are a marketing wrapper. Installing one does not change your session risk against the operator behind it. If a companion app is convenient for you (say, you want odds alerts on a sports-book you already use), install it; if you are looking for a "real" casino app on iOS or Android for an offshore operator, the companion route is not that.

The other pattern to note is the browser-shortcut disguised as an app. Some operators offer a two-second "install" that adds a Web Clip (iOS) or a homescreen shortcut (Android) that opens the browser lobby with no PWA shell. These are functionally identical to bookmarking the site — no service worker, no full-screen mode — but marketed as an app for parity with UKGC-licensed operators. Do not be misled by the icon; a Web Clip is a bookmark with a badge.

Frequently Asked Questions

Responsible Gambling

Non gamstop casino apps and PWAs make a session even easier to start than the browser does — the home-screen icon removes the friction of typing a URL. If you are registered with GamStop for problem-gambling reasons, do not install any casino app or PWA. GamStop exists as legitimate consumer protection and the responsible position is to complete your self-exclusion term. UK support: GamCare on 0808 8020 133 for the National Gambling Helpline; NHS National Gambling Clinic for specialist treatment; GordonMoody for residential programmes; BeGambleAware for the wider public helpline; GAM-Anon for family members. Text mentions only, not endorsements. For UK regulatory context see the Wikipedia article on the Gambling Act 2005 and the statute at legislation.gov.uk.

Marcus Ellis

Mobile & Tech Reviewer · MM Info

Marcus has reviewed mobile gambling experiences on iOS and Android since 2017, testing browser performance, PWA installation, and native-app friction across offshore operators. He writes descriptively about the app landscape and the store-gate constraints shaping it.