Spain's gambling regulator, the DGOJ, has reopened a public consultation regarding a centralized monthly risk detection test aimed at identifying players who may exhibit signs of problem gambling. This consultation period commenced on Tuesday and will continue until October 22, 2026.
The proposal mandates that all online gambling operators licensed under Spanish regulations conduct an automated assessment each month to highlight players whose gambling behavior indicates increased risk.
**Mechanism Details**
Operators licensed by the DGOJ for online gambling at the state level will be required to implement this mechanism during the first seven calendar days of each month. The monthly analysis will review players' account activities over the last 183 days.
The mechanism utilizes a four-stage evaluation process for all accounts that are not excluded. Accounts with minimal activity are disregarded in the analysis. A specific set of objective thresholds based on four key variables will be applied, and any accounts meeting these thresholds are classified as showing “risk behavior.”
To make this assessment, operators evaluate around 48 features, including deposits, withdrawals, betting amounts, duration of gaming sessions, product types, the timing of play, use of self-exclusion tools, cancelled withdrawals, and types of payment methods. These variables generate a probability score through a model, flagging any account that exceeds a predefined threshold as exhibiting “risk behavior.” Importantly, the DGOJ expressly states that this process does not involve external data sources such as social media or personal health records.
**Implications for Flagged Players**
When an account is classified as “in risk behavior,” immediate regulatory actions are invoked as outlined in Real Decreto 176/2023. Operators must inform the affected player about the classification and the factors that led to it. The player is required to engage in an effective interaction within 72 hours, or their gaming relationship will be suspended until this requirement is met. Flagged players will also be restricted from promotional activities and may lose VIP status, subject to limits on marketing communications.
Additionally, only nominative payment methods will be permitted, with credit cards banned and players needing to verify the payment method in use.
Recognizing the significance of this large-scale automated profiling that triggers legal consequences, the DGOJ has conducted a comprehensive Data Protection Impact Assessment (DPIA) in compliance with GDPR guidelines.
**Review Process and Governance**
Players have the right to request reviews regarding the accuracy of their data and the application of rules. If they remain unsatisfied, complaints can be escalated to the DGOJ. During this review period, protective measures will stay in place, with operators still required to enforce the 72-hour interaction requirement.
The DGOJ will periodically assess the effectiveness of this mechanism, utilizing aggregated data and reports from operators, and may adjust variables and thresholds as necessary. Independent technical audits of the system will also be conducted.
**Feedback from the First Consultation**
Feedback from the initial consultation in 2025 included input from operator associations, suppliers, selected operators, and advocacy groups for players. One of the main concerns raised was the integration and operational costs, with operators questioning the DGOJ's estimate of €130,000 (approximately $145,320) per operator for implementation. Furthermore, sensitivities related to model accuracy for skills-based games like poker and concerns about data protection risks linked to automated profiling were also highlighted.
Operators, vendors, and legal teams are encouraged to review the draft resolution, attached documents, and DPIA during this consultation phase.
**Background of the Initiative**
The DGOJ's initiative builds upon Real Decreto 176/2023, a regulation implemented in 2023 that strengthened obligations regarding safer gambling practices across the industry. Previously, while operators were required to have risk detection protocols, they were at liberty to determine their own models and indicators. The lack of standardization in detection practices led the DGOJ to create a uniform detection mechanism applicable across the board to all licensed operators.
The goal is to standardize risk detection and the protective measures that follow, ensuring consistency across all national-level operators. Earlier in the year, the DGOJ announced a competitive grant program aimed at funding research into gambling-related risks and prevention strategies. In March, they unveiled the Safe Gambling Programme for 2026-2030, which focused on behavioral patterns associated with products like loot boxes and social casino games, especially concerning their effects on minors and young adults.
