Spain’s Directorate General for Gambling Regulation (DGOJ) announced it has renewed a public consultation on a proposed nationwide mechanism that would require licensed online casinos to identify customers at increased risk of gambling-related harm.
The consultation will remain open until October 22, 2026. The draft resolution will introduce a joint, automated assessment system across Spain’s licensed gambling market, and replace the current approach under which operators determine their own risk indicators and detection methods.
This initiative strengthens Royal Decree 176/2023, which bolstered safer gambling responsibilities and required operators to establish protocols for spotting users with potentially risky gambling behaviour. The DGOJ’s explanatory memorandum argues that differences between operators’ existing systems have created inconsistencies in detection.
Under the latest proposal, the regulator will try to develop consistent criteria for identifying at-risk customers and ensure that the corresponding protective measures are applied consistently
How the Centralised Mechanism Works
If passed, licensed casinos would be required to run the assessment during the first seven calendar days of every month. Each of these assessments would examine gambling activity recorded over the preceding 183 days.
The mechanism will consist of a four-stage process that covers all accounts that are not excluded under the system’s initial screening rules.
Accounts of players with insufficient recent activity would be removed from further review. The mechanism would then apply objective criteria to identify customers whose activity meets predefined risk limits, allowing some accounts to be classified without further modelling.
With the remaining registrations, operators would take into account and calculate several variables derived from gambling activity and financial transactions recorded on their platforms. Then they are processed by the DGOJ-approved model to determine whether an account should be classified as exhibiting risk behaviour.
Variables include aspects such as deposits, withdrawals, betting frequency and amounts, session duration, gambling products, playing times, cancelled withdrawal requests and the use of safer gambling tools.
According to DGOJ, the system is developed to spot patterns that suggest risky behaviour and not diagnose gambling addiction or other forms of medical conditions.
DGOJ’s data protection impact assessment indicates that the mechanism is limited to information generated through customers’ gambling accounts. Therefore, it does not use social media activity, browsing history, clinical records, health questionnaires or personal communications.
The regulator will also supply the joint model and technical specifications, while operators will remain responsible for applying the mechanism to the accounts they manage.
Restrictions and Intervention for Flagged Players
Users tagged as displaying risky behaviour would then be subject to protective protocols under Royal Decree 176/2023.
Operators would also have to inform affected customers of their classification and explain the factors contributing to the decision. They would also be required to conduct an effective interaction with the customer within 72 hours.
However, if the user does not engage within the required period, the operator must suspend the gambling account until the obligation has been fulfilled.
Additional restrictions include a ban on promo offers, exclusion from VIP programmes and limits on marketing. Customers would also be banned from using credit cards and non-nominative payment methods, while operators would be required to verify the ownership of the payment method.
The draft framework outlines a minimum six-month period during which the risk classification remains in effect, which would be subject to the applicable rules on review and removal of the status.
These measures should help take the system beyond simply identifying potentially harmful gambling patterns, requiring operators to take specific protective action once a customer has been flagged.
Data Protection and Consumer Appeals
As part of the proposal, DGOJ also prepared a Data Protection Impact Assessment under the EU’s General Data Protection Regulation (GDPR).
It will recognise that automated categorisation can significantly affect customers’ gambling experience and their ability to interact with gambling platforms. Therefore, it addresses the need for safeguards on data processing, transparency, security and the exercise of individual rights.
Customers will be allowed to request a review from their operator if they believe their classification comes from an incorrect application of the rules. If the dispute remains unresolved, they would be able to escalate the issue with the DGOJ itself.
Notably, the protections would remain in place while a review is being performed. The process would therefore not automatically suspend the intervention requirements or the 72-hour interaction deadline.
The regulator would also assess the tool periodically based on accumulated data and reports from operators. If required, adjustments could be made to variables, thresholds and model parameters, while independent technical audits are planned to examine the system’s function.
Furthermore, the impact assessment states that operators must document their implementation of the mechanism and assess any additional data-processing activities or changes that could lead to risks beyond those covered by the common assessment.
Worries About Costs and Accuracy
The proposal comes after a public consultation from August 28 through 25 September 25, 2025. According to the DGOJ’s memorandum, feedback came from operator associations, suppliers, individual operators and player advocacy groups.
The consultation highlighted concerns about implementation costs, technical complexity, the accuracy of automated classifications and the protection of personal data.
One of the issues raised by industry stakeholders was the cost of implementing the new tool, with objections to the regulator’s original implementation calculation. The supporting documents also record concerns about the burden of implementing a common predictive model across operators with different platforms and gambling products.
Another key topic was accuracy, as industry representatives challenged whether a single model could reliably identify risk across different forms of gambling, especially poker and sports betting, where skill, betting patterns and product characteristics may affect user behaviour.
Sector representatives also raised questions about false positives and false negatives. A false positive could result in a customer being classified as at risk despite not showing problematic behaviour, while a false negative could leave a genuinely at-risk customer unidentified
Still, DGOJ’s stance is that a universal mechanism would provide greater consistency, transparency and legal certainty than the existing system, under which operators use different indicators, observation periods and statistical methods.
