Spain’s gambling authority has reopened a public consultation to discuss a centralised monthly risk detection system for online gambling. This consultation began on Tuesday and will continue until October 22, 2026.
The proposed measure mandates all licensed online gambling operators in Spain to perform an automated test each month. This test aims to identify players at increased risk of problem gambling based on their activities.
According to the plan, every licensed operator under the Spanish Directorate General for Gambling Regulation (DGOJ) must conduct the assessment within the first seven days of each month, analyzing player account activity over the prior 183 days. The system follows a four-stage evaluation for all accounts that are not excluded from consideration.
Accounts demonstrating minimal recent activity will bypass further checks. Operators will apply thresholds derived from four specific indicators. If an account meets any of these thresholds, it will be classified as exhibiting "risk behaviour."
Operators will assess around 48 different features, including deposits, withdrawals, betting amounts, session durations, game types, self-exclusion tool usage, canceled withdrawals, and payment method categories. A statistical model will generate a probability score from these variables, flagging accounts as “in risk behaviour” if their score exceeds a predetermined mark.
The DGOJ affirms that their analysis will not utilize external sources such as social media or private health and financial information.
Once an account is labeled as “in risk behaviour,” operators must notify the player of this status and the reasoning behind it. Players will need to engage in a follow-up interaction with the operator within 72 hours. If they fail to do so, their gaming privileges will be suspended until compliance is achieved. Those flagged will face a ban on promotional activities and will be excluded from VIP programs and certain marketing communications.
Additionally, the mechanism mandates the use of identifiable payment methods. Players cannot use credit cards and will need to validate their selected payment means.
Given the implications of large-scale automated profiling, the DGOJ has conducted a comprehensive Data Protection Impact Assessment (DPIA) in line with GDPR regulations.
Regarding oversight, players may request reviews from operators about the treatment of their data and any rulings made. If further issues arise, complaints can advance to the DGOJ.
Protective measures will remain intact while these reviews are underway, with operators required to adhere to the 72-hour interaction rule.
The DGOJ plans to routinely assess the effectiveness of the mechanism using aggregate data and reports from operators, adapting the model’s parameters as necessary. Independent technical audits will also be part of the evaluation process.
Feedback from the first consultation round in 2025 highlighted concerns from operator associations, suppliers, and advocacy groups. Among the key issues raised were the costs associated with implementing the DGOJ’s estimated €130,000 ($145,320) per operator setup. Operators also pointed to potential challenges with model accuracy, particularly in games like poker and sports betting, as well as data protection risks stemming from automated profiling.
This initiative originates from the DGOJ’s commitment to enhancing safer gambling protocols under Real Decreto 176/2023, which reinforced operator obligations for risk detection. Initially, the decree permitted individual operators to create their own detection models, resulting in varied standards. Consequently, the DGOJ seeks to establish a unified detection framework for all licensed operators to ensure a consistent approach to identifying risk and implementing protective measures.
Earlier this year, the DGOJ launched a competitive grant initiative aimed at funding research on gambling's risks and effects. In March, it unveiled its Safe Gambling Programme (2026-2030), which underscores the need to address behavioural patterns linked to loot boxes and hybrid gaming features that may normalise gambling behaviours among younger audiences.
