DGOJ moves to end operator-by-operator gambling risk detection under new consultation 

Spain’s gambling regulator has announced the reopening of a public consultation on a centralised monthly operator test that would flag players who show signs of problem gambling. 

The consultation period opened on Tuesday and will remain active until 22 October 2026.

The proposal includes a binding mechanism that will require all nationally licensed online gambling operators to run an automated test monthly to flag players whose gambling behaviour falls into the category of increased risk. 

Scope and operation of the mechanism

All operators licensed by the Spanish Directorate General for Gambling Regulation (DGOJ) for state-level online gambling will be required to run the mechanism during the first seven calendar days of each month. Each monthly analysis will evaluate players’ account activity over the preceding 183 days.

The mechanism employs a four-stage evaluation process on all non-excluded accounts.

Accounts with minimal recent activity are excluded from further analysis. A small set of objective thresholds based on four variables will be applied. Accounts meeting any threshold are immediately classified as exhibiting “risk behaviour”.

Operators calculate approximately 48 features based on deposits, withdrawals, bets (including amount, time and product type), session duration, product mix, time of day, use of self-exclusion tools, cancelled withdrawals and payment instrument categories.

A model processes these variables to produce a probability score. Accounts scoring above a defined threshold are flagged as “in risk behaviour”.

The DGOJ notes that it explicitly excludes external data sources like social media, browsing history and detailed financial or health records.

Consequences for flagged players

An account classified as “in risk behaviour” triggers immediate regulatory responses detailed in Real Decreto 176/2023.

Operators must communicate the classification to the player, explaining contributing factors. Players will be required to engage in an effective interaction within 72 hours and failure to do so would lead to suspension of the gaming relationship until compliance is met. Promotional activities are prohibited for flagged players and players face exclusion from VIP services and restrictions on marketing communications.

Additionally, use of nominative payment methods is enforced with a ban on credit cards, requiring players to validate the payment method used.

Given that this is large-scale automated profiling to trigger legal consequences, the DGOJ also emphasised that it had prepared a detailed Data Protection Impact Assessment (DPIA) under the GDPR. 

Review, redress and governance

Players can request operator reviews regarding data accuracy and rule application. If there is still dissatisfaction, then complaints can be escalated to the DGOJ. 

Protective measures remain active during reviews, with operators obliged to enforce the 72-hour interaction deadline.

The DGOJ will conduct periodic assessments of the mechanism based on aggregated data and operator reports. It will also include adjusting variables, thresholds, or model parameters as required. The regulator also plans independent technical audits of the system.

First round of feedback

The first consultation round in 2025 drew feedback from operator associations, suppliers, some operators and player advocacy groups. 

Challenges raised included costs of integration and operation, with operators disputing the DGOJ’s €130,000 ($145,320) per operator implementation estimate.

Model accuracy sensitivities for skill-influenced games like poker and sports betting was also raised as a potential challenge as well as data protection risks associated with automated profiling.

Operators, vendors and legal teams are urged to review the draft resolution, annexes and DPIA within the consultation window..

What brought all this on?

The initiative is led by the DGOJ and builds upon Real Decreto 176/2023. This 2023 regulation strengthened obligations concerning safer gambling practices across the sector. 

While the decree mandated operators to implement risk detection protocols, it previously allowed each operator to define their own models and indicators.

This divergence in detection standards has prompted the DGOJ to design and impose a harmonised, sector-wide detection mechanism. 

The objective is to ensure consistent risk detection and subsequent protective measures across all operators licensed at the national level. 

In the same vein, earlier this year, the DGOJ announced a competitive grant programme dedicated to funding research on the prevention, effects and risks associated with gambling activities. 

In March, the DGOJ released its Safe Gambling Programme (2026-2030) which specifically highlighted concerns over behavioural patterns associated with loot boxes, social casino products and other hybrid gaming features that may normalise gambling behaviours among minors and young adults.