Spain's gambling regulator has initiated a public consultation regarding a centralized monthly test for online gambling operators that seeks to identify players who may be at risk of problem gambling. The consultation commenced on Tuesday and will be open until October 22, 2026.
The proposal mandates all operators licensed under the Spanish Directorate General for Gambling Regulation (DGOJ) to conduct an automated monthly assessment within the first seven days of each month. This assessment will analyze player account activity for the previous 183 days.
The risk detection mechanism involves a four-step evaluation of accounts that are not excluded. Accounts with minimal activity will not undergo further scrutiny, while a set of standardized thresholds across four specific variables will be used to identify at-risk accounts. If any threshold is met, the account is classified as exhibiting "risk behaviour."
Operators will assess about 48 characteristics related to deposits, withdrawals, bets (including amounts, times, and product types), session lengths, product mixes, and usage of self-exclusion tools. A model is employed to process these data points, generating a probability score that flags accounts deemed to demonstrate risk behaviour if they exceed a certain score.
Importantly, the DGOJ has clarified that it will not incorporate data from external sources such as social media, browsing habits, or personal financial and health information.
For those identified as exhibiting risk behaviour, immediate regulatory actions will come into play as outlined in Real Decreto 176/2023. Operators are obligated to inform the player of their classification and the factors contributing to it. Players must engage in a mandated interaction within 72 hours; non-compliance will prompt a suspension of their gaming account. Those flagged will also lose access to promotional activities, VIP services, and receive limitations on marketing communications. Additionally, only nominative payment methods will be permitted; credit cards will be banned, requiring players to verify their payment method.
Given the scale of this automated profiling and its legal implications, the DGOJ has prepared a comprehensive Data Protection Impact Assessment (DPIA) in accordance with GDPR regulations.
Players have the right to request reviews from operators concerning data accuracy and the application of rules; complaints may be escalated to the DGOJ if necessary. During any review process, protective measures remain active, ensuring operators adhere to the 72-hour interaction requirement.
The DGOJ will periodically assess the effectiveness of this risk detection mechanism, adjusting thresholds, variables, or model parameters as needed. Independent technical audits of the system are also planned.
Feedback from the previous consultation round in 2025 involved input from operator associations, suppliers, and player advocacy groups, highlighting concerns over implementation costs, which operators contested as being estimated at €130,000 ($145,320) per operator. There were also discussions about model accuracy focusing on skill-based games, and the associated data protection challenges inherent in automated profiling.
The DGOJ's initiative follows Real Decreto 176/2023, which reinforced the requirements for safer gambling practices in the industry. Previously, operators had the liberty to establish their own risk detection models, leading to variance in detection standards. The DGOJ has stepped in to create a uniform detection mechanism to ensure consistency in identifying risks across all national operators.
Earlier this year, the DGOJ introduced a competitive grant program aimed at financing research related to gambling prevention, and in March, the Safe Gambling Programme (2026-2030) was unveiled, addressing concerns about gambling behaviors related to loot boxes and social casino products that may normalize gambling for minors and young adults.
