Daily fantasy sports companies DraftKings and FanDuel built their billion-dollar brands on a shaky legal foundation, declaring their games “100 percent legal” under a federal statute that exempts fantasy sports from gambling restrictions. That foundation started to crack this week after an insider-information scandal at DraftKings drew renewed scrutiny of the largely unregulated world of fantasy sports games.

The companies faced major consumer backlash Tuesday after a midlevel DraftKings employee admitted last week to accidentally leaking confidential information on user lineups the same week he won $350,000 in a FanDuel contest. Both companies deny the employee, Ethan Haskell, used the information to gain an unfair edge, but for critics, the implication is clear. In an industry that has somehow escaped the exhaustive federal oversight typically afforded to sports gambling, consumers are far too susceptible to fraud.

Even before the insider-betting allegations surfaced, prominent officials from Massachusetts, New Jersey and other states had announced their intention to challenge the legality of daily fantasy sports. Amid a shifting legal landscape that could threaten the very existence of the daily fantasy sports industry, experts say companies like DraftKings and FanDuel have little choice but to accept federal regulation in order to preserve their business model.

“Whether it’s at the congressional level or the state level, it is inevitable that this industry will be as tightly regulated and controlled as other forms of gambling,” said Daniel Wallach, a sports and gambling attorney at Becker & Poliakoff, a Florida-based law firm. “It can’t continue to operate in the unregulated sphere.”

In daily fantasy sports, users pay an entry fee of anywhere from 25 cents to $1,000 and craft customized player lineups. Players are assigned “salaries,” and users must stay within their “salary cap” while selecting their lineups. Users are awarded points based on how players perform in their real-life games, and the user with the highest score wins prize money.

The product is wildly successful. DraftKings and FanDuel have secured hundreds of millions of dollars from investors and landed lucrative partnerships with virtually every major American sports league. Ravenous consumers will spend about $2.6 billion on daily fantasy sports contests in 2015, with that number slated to surpass $14 billion by 2020, Eilers Research, which analyzes the industry, told the New York Times. FanDuel dispensed more than $500 million in cash prizes to its users in 2014, while DraftKings awarded about $300 million. Both sites say their awards will surpass $1 billion this year, the Wall Street Journal reported.

Given the sheer amount of money spent on daily fantasy sports contests, this week’s New York Times report on alleged insider-information leaks raises numerous concerns. In theory, a user with knowledge of which NFL players appear most frequently in fantasy lineups can load up their rosters with players available at a bargain, or so-called “sleeper” picks that most users aren’t targeting. Simply choosing the top players at every position would be akin to filling out a March Madness bracket with only top-seeded teams, Deadspin notes.

Regardless of whether he profited from the information, Haskell was able to access information that could have been used to gain a competitive advantage over the public. Whatever internal regulations the companies imposed at the time to prevent confidential data leaks were insufficient to prevent a midlevel content manager from gaining access.

DraftKings and FanDuel addressed the insider-information scandal in a joint statement Monday, stating they have “strong policies in place to ensure that employees do not misuse any information at their disposal, and strictly limit access to company data to only those employees who require it to do their jobs.” In a subsequent statement in tandem with the Fantasy Sports Trade Association, both companies said their employees are now banned from participating in any daily fantasy sports contests.

Critics say that ban should have been in place from the start.

“We don’t know the extent to which this is pervasive or whether this is an isolated incident. What we do know is that the extent of cross-site playing is pretty widespread,” Wallach said. “That alone presents a problem, because we don’t know how many employees had access to sensitive information which is locked down for the public. It creates a bad optic for the industry if the biggest sharks on these sites are employees of the companies playing on each other’s sites.”

A DraftKings spokesperson did not immediately respond for a request for comment on the specific internal safeguards the company has in place to prevent information leaks. A FanDuel representative noted that none of its employees had been accused of wrongdoing.

“FanDuel has always operated on the basis of trust and integrity, which is paramount to our business and culture,” FanDuel spokesperson Emily Bass said in an email. “We have always proactively implemented policies to restrict employee access to data, ensuring the integrity of the games we offer for users and protecting our own employees.”

Daily fantasy sports companies have grown so rapidly that they’ve outstripped the few existing laws designed to police them. Federal law prohibits sports gambling in all forms in all but four states – Nevada, Montana, Oregon and Delaware. By most logical measures, daily fantasy sports games are a form of sports betting. Users wager actual money on the real-life performance of professional athletes, with cash prizes of up to $1 million up for grabs.

For now, sites like DraftKings and FanDuel are able to legally operate because of the Unlawful Internet Gaming Enforcement Act, a 2006 federal statute that outlawed other forms of online gambling, such as poker, but included a legal “carve-out,” or exemption, for fantasy sports, which lawmakers deemed to be a game of skill, not chance.

Top officials from the NFL, MLB, NHL, NBA and NCAA all lobbied in favor of the fantasy sports exemption, even though they staunchly opposed conventional sports gambling. But daily fantasy sports didn’t even exist when the 2006 UIGEA act was passed, and critics say the statute was never intended to completely safeguard fantasy sports from legal challenges.

“The UIGEA carve-out is the most overhyped, overrated, mischaracterized and misunderstood statute in the gambling industry. It does not provide an absolute immunity to fantasy sports operators,” Wallach said. “That statute does not supplant or pre-empt state law. Claims that fantasy sports are 100 percent legal really vary by game and by state.”

Last month, Rep. Frank Pallone, D-N.J., formally requested that the House Energy and Commerce Committee hold hearings on the daily fantasy sports industry. Massachusetts Attorney General Maura Healey is examining whether such betting should remain legal in the state.

With multiple legal challenges brewing on the state level, federal legislation on the subject seems inevitable. Formal oversight and regulation of the daily fantasy sports industry could be months, not years, away, H. Brian Holland, a professor of law at Texas A&M University, said.

Ironically, federal regulation would benefit companies like FanDuel and DraftKings. The alternative -- restrictions on daily fantasy sports that vary dramatically from state to state -- would make doing business nearly impossible.

“Imagine trying to run a business that’s valued at $1 billion when you’re illegal in half the states and legal in half the other states. It’s just going to be impossible. I think the federal solution is really the only solution for DraftKings and Fan Duel,” Holland said.

He said federal officials will likely formally legalize the industry, so long as it submits to strict regulation and oversight. Consumer interests would be protected and DFS companies would avoid their financial logjam.

“There will be reforms,” Wallach said. “Fantasy sports will be legal, it will be clarified, but it will also be regulated.”