Spain’s gambling regulator has reopened public consultation on a centralized monthly test for online operators, aimed at identifying players at risk of problem gambling. This consultation, which started on October 17, 2023, will run until October 22, 2026.
The proposal mandates that all online gambling operators licensed by the Spanish Directorate General for Gambling Regulation (DGOJ) conduct automated tests monthly. These tests are designed to highlight players whose gambling behaviors indicate increased risk.
Under this mechanism, all licensed operators must run the assessment within the first week of each month, examining player activity over the prior 183 days. The evaluation follows a four-stage process for all non-excluded accounts, where those with minimal recent activity are excluded from further review.
Operators will apply objective thresholds based on four key variables to classify accounts showing “risk behavior.” They will analyze up to 48 features, including deposits, withdrawals, betting patterns, session length, product preferences, and self-exclusion tool usage. A model will assign a probability score, and any account exceeding a specified threshold will be flagged for risk.
Importantly, the DGOJ has clarified that this mechanism will not utilize external data sources such as social media or personal financial and health records.
When a player’s account is classified as “in risk behavior,” specific regulatory actions come into play as mandated in Real Decreto 176/2023. Operators must notify the affected player of this classification and the reasons behind it. The player is then required to engage with the operator within 72 hours; otherwise, their gaming account will be suspended until compliance is achieved. Flagged players will also be barred from promotional offers and may lose access to VIP services while facing limitations on marketing communications. Furthermore, the use of nominative payment methods becomes compulsory, eliminating the use of credit cards and necessitating validation of payment methods used.
Given the scale of this automated profiling and its legal implications, the DGOJ has conducted a comprehensive Data Protection Impact Assessment (DPIA) in accordance with GDPR regulations.
In terms of oversight, players can request reviews concerning data accuracy and the application of rules. Complaints can be escalated to the DGOJ if necessary. Protective measures will still be enforced during these reviews, requiring operators to uphold the 72-hour interaction requirement.
The DGOJ will routinely assess the effectiveness of the mechanism based on aggregated data and reports from operators, with adjustments to thresholds or model parameters as needed. Independent technical audits of the system are also planned.
This new initiative follows the feedback received from the first round of consultation in 2025, which included input from operator associations and advocacy groups. Concerns raised included the costs associated with implementation, which some operators dispute as too high at €130,000 ($145,320) per operator, and issues of model accuracy for skill-based games like poker and sports betting.
The driving force behind this initiative is the DGOJ, building on Real Decreto 176/2023, which strengthened regulations for safer gambling practices. The previous framework allowed operators to create their own detection models, leading to inconsistencies. The DGOJ aims to foster uniformity in risk identification and protective actions across all licensed operators.
Earlier this year, the DGOJ also announced a grant program to fund research focused on gambling-related issues and its effects. In March, the DGOJ unveiled its Safe Gambling Programme for 2026-2030, which expressed particular concern over behaviors associated with loot boxes and social casino products that could lead minors and young adults to normalize gambling activities.
