Spain’s gambling authority, the Directorate General for Gambling Regulation (DGOJ), has initiated a public consultation aimed at establishing a centralized monthly operator test. This new system is designed to identify players who may be exhibiting signs of problem gambling. The consultation period began on Tuesday and will be open until October 22, 2026.
The proposed mechanism intends to enforce a requirement for all online gambling operators licensed in Spain to conduct an automated assessment each month, focusing on players whose gambling behavior may indicate elevated risk.
All operators with national licenses must implement the testing mechanism within the first seven days of each month. This test will analyze player account activities over the 183 days preceding the evaluation.
The assessment employs a four-stage evaluation process for all non-excluded accounts. Accounts showing minimal recent activity will not be subject to further analysis. A set of objective thresholds related to four specific variables will apply. Any account that meets a threshold will be immediately classified as showing "risk behavior."
Operators are tasked with calculating around 48 different features based on various factors, including deposits, withdrawals, betting patterns (amount, time, and product type), session durations, game variety, time of play, usage of self-exclusion options, canceled withdrawals, and the types of payment instruments used. A model assesses these variables to generate a probability score, flagging accounts that surpass a preset risk threshold as engaging in "risk behavior."
Notably, the DGOJ has stated that it will not consider external data sources such as social media activity, browsing histories, or detailed financial and health records in this assessment.
For players identified as exhibiting "risk behavior," immediate regulatory actions will follow, as outlined in Real Decreto 176/2023. Operators are obliged to notify the affected player about their risk classification and the relevant factors contributing to this assessment. Players must then respond within 72 hours; failure to do so will lead to suspension of their gaming account until they comply. Additionally, promotional activities will be banned for these players, who will also be excluded from VIP services and face limitations on marketing communications.
To further protect players, the use of nominative payment methods will be mandated, disallowing credit card use, and requiring that players authenticate the payment method they wish to utilize. Given that this approach involves large-scale automated profiling that can invoke legal consequences, the DGOJ has prepared a comprehensive Data Protection Impact Assessment (DPIA) in line with GDPR regulations.
Players have the right to request reviews from operators regarding data accuracy and the application of rules. If necessary, these complaints can escalate to the DGOJ. Protective measures will remain in effect during these review processes, with operators expected to enforce the 72-hour requirement for interaction.
The DGOJ also plans to evaluate the mechanism periodically using aggregated data and reports from operators, making adjustments to variables and thresholds as needed. Technical audits of the system will be conducted independently.
The first round of consultation in 2025 received input from various stakeholders, including operator associations, suppliers, and player advocacy organizations. Concerns included the costs associated with implementation and operation, as operators contested the DGOJ’s estimate of €130,000 ($145,320) per operator for integration costs. The sensitivity of the model's accuracy for skill-influenced games like poker and sports betting was another challenge raised, along with potential data privacy risks related to automated profiling.
Operators, vendors, and legal teams are advised to examine the draft resolution, annexes, and DPIA throughout the consultation period.
This initiative, spearheaded by the DGOJ, builds upon Real Decreto 176/2023, which enhanced regulations surrounding safer gambling across the sector. While the decree initially mandated risk detection protocols, it allowed each operator to develop their own models and indicators. However, this resulted in inconsistencies in detection standards, prompting the DGOJ to implement a harmonized detection mechanism for the entire sector. The goal is to guarantee uniform risk detection and protective measures across all nationally licensed operators. Earlier in 2023, the DGOJ also established a grant program to fund research into the prevention and consequences related to gambling activities, further demonstrating its commitment to addressing these issues. The DGOJ's Safe Gambling Programme (2026-2030) highlights concerns about behavioral trends linked to items like loot boxes and social casino products that may normalize gambling behaviors among minors and young adults.
