Spain returns revised gambling risk algorithm proposal to consultation

A revised version of the common algorithm for spotting gambling-related risk is now the subject of a reopened public consultation by Spain's regulator, the Dirección General de Ordenación del Juego (DGOJ). The regulator said the text was reworked after the Spanish Data Protection Agency (AEPD) published a report on 15 June. Comments can be filed up to 22 October 2026.

The regulator said the changes focus chiefly on restricting and protecting how personal data is handled, and on strengthening what players can learn about and challenge. In the AEPD's view, the earlier paperwork failed to make clear why every variable in the model was needed. The DGOJ said the mechanism keeps both its aim and its basic design.

Each month, licensees would carry out a review in the opening week, looking back over 183 days of activity on all the gambling accounts a customer holds with them. Sporadic users would be filtered out ahead of screening: those with under two deposits, under two active days, or under 10 wagers together with under five gaming sessions, poker tournaments or lottery entries.

The DGOJ stressed that only data from a player's account with a given operator feeds the model; social media activity, internet browsing history, geolocation information, external financial records and health data are all excluded. The proposal adds that being labelled at risk is a regulatory classification, not a clinical diagnosis.

Those flagged by the system would face the protective measures set out in Articles 26 to 30 of Royal Decree 176/2023 for at least six months. Operators would have to tell customers when the classification happened, which period was assessed and which factors weighed most heavily, in clear and accessible language; merely revealing a risk score or threshold would not be enough. Flagged customers would get 72 hours to reply to the operator, and if they did not, the account would be suspended until contact was made.

While classified, players would lose access to promotions, VIP programmes and marketing communications. Payment methods would have to be registered in their own names, and credit cards would be off limits. Customers could ask for the classification and the underlying data to be reviewed. Complaints could then go up to the DGOJ, with the classification staying in force throughout the review. Operators would also be barred from using the data for marketing, customer segmentation or creditworthiness assessments.

In the DGOJ's view, a single standardised model is necessary because the methods operators have devised themselves for spotting risky gambling behaviour have produced inconsistent results. The regulator reports that the share of active accounts rated high risk ranges from 0 per cent to 13.6 per cent depending on the operator, and that customer demographics on their own cannot account for the gap.

Between 28 August and 25 September 2025 the DGOJ ran its first consultation round and collected 18 submissions. Organisations that took part included the industry bodies JDigital and AEJAD, a number of operators, and the gambling harm detection specialists Mindway and OpenBet-Neccton. In the regulator's summary, numerous respondents said the DGOJ ought to run the detection system itself, so that operators would only have to apply whatever protective measures came out of it. Other points of concern were the quantity of variables in the model, whether independent auditing is needed, the missing scope for qualitative judgement and the timetable proposed for implementation.

The DGOJ puts the cost of implementation at roughly €130,000 per operator, or about €7.4m across Spain's 57 licensed gambling operators, a figure JDigital has disputed. The regulator intends to review the system periodically, with authority to change variables and thresholds where needed, and to bring in an external consultancy to judge how well the model works. Comments on the revised proposal are due by 22 October 2026. Should it be approved, the resolution would apply two months after it appears in the BOE.

The consultation was reopened after a separate regulatory step approved in June, which brought in cross-operator gambling deposit limits in Spain run through a centralised system. Starting 28 October, Royal Decree 813/2026 will oblige operators to check that a payment method belongs to the holder of the gambling account. The aim is to tighten anti-money laundering controls, and existing customers get a six-month transition period.