Spain’s proposed gambling risk algorithm goes back to consultation
The proposal for a common gambling risk algorithm has been revised following feedback on data protection.
Key takeaways:
- Spain’s gambling regulator, the DGOJ, has reopened consultation on a revised common algorithm designed to identify players at risk of gambling harm, after the Spanish Data Protection Agency required stronger safeguards around personal data use, transparency and review rights. The consultation is open until October 22, 2026.
- The system would analyse up to 183 days of player activity using a two-stage process combining fixed risk indicators and an XGBoost machine-learning model based on 48 behavioural variables. It would only use data held by the gambling operator and not external sources such as social media, browsing history or health records.
- Players classified as high risk would face mandatory protective measures for at least six months, including restrictions on promotions, VIP schemes and certain payment methods, while operators would be required to explain classifications and offer review mechanisms.
Spain.- The Spanish gambling regulator, the Dirección General de Ordenación del Juego (DGOJ) has reopened a public consultation on its proposed common algorithm for identifying gambling-related risk in Spain. The move follows changes requested by Spain’s data protection authority regarding the proposed system, which is intended to improve early detection and intervention through the use of real player data.
The DGOJ said the proposal has now been revised following a report issued by the Spanish Data Protection Agency (AEPD) on June 15. According to the regulator, the amendments mainly relate to limits and safeguards on personal data processing and players’ rights to information and review. The AEPD concluded that the original documentation did not sufficiently explain why each variable used in the model was necessary. The DGOJ stated that the revisions do not alter the mechanism’s purpose or core structure.
Under the proposal, operators would run an assessment during the first seven days of every month, analysing the previous 183 days of customer activity across all gambling accounts held with it. Players considered sporadic users would be excluded before screening, including those with fewer than two deposits, fewer than two active days, or fewer than 10 wagers combined with fewer than five gaming sessions, poker tournaments or lottery entries.
The model would initially identify some at-risk players using a formula based on four factors: active days, net gain or loss per active day, amount wagered and number of deposits. Remaining players would then be evaluated using a machine-learning system based on XGBoost technology, an open-source, distributed gradient-boosted decision tree.
The draft resolution lists 48 variables, including deposits, withdrawals, stakes, session duration, product preferences, playing times, payment methods and self-exclusion activity over the previous four years.
The DGOJ emphasised that the model relies solely on information held within a player’s account at a specific operator and does not use social media activity, internet browsing history, geolocation information, external financial records or health data. The proposal also states that the risk designation is a regulatory classification rather than a clinical diagnosis.
Players identified by the system would become subject to the protective measures contained in Articles 26 to 30 of Royal Decree 176/2023 for a minimum of six months. Operators would need to inform customers when the classification was made, the period assessed and the factors that most influenced the result, using clear and accessible language. Simply disclosing a risk score or threshold would not satisfy this requirement.
Flagged customers would have 72 hours to respond to the operator. Failure to do so would result in account suspension until contact is made. During the classification period, players would be barred from receiving promotions, VIP programmes and marketing communications. They would also be limited to payment methods registered in their own names, while credit card use would be prohibited.
Customers would have the right to request a review of both the classification and the data supporting it. Complaints could subsequently be escalated to the DGOJ, although the classification would remain active during the review process. Operators would also be prohibited from using the resulting data for marketing purposes, customer segmentation or creditworthiness assessments.
The DGOJ argues that a standardised model is needed because operators’ own methods for identifying risky gambling behaviour have led to a lack of consistency. According to the regulator, the proportion of active accounts classified as high risk currently varies between 0 per cent and 13.6 per cent across operators, with customer demographics alone insufficient to explain the disparity.
Consultation responses
During the first consultation round, which ran from August 28 to September 25, 2025, the DGOJ received 18 submissions from organisations including the industry bodies JDigital and AEJAD, several operators and gambling harm detection specialists Mindway and OpenBet-Neccton. According to the regulator’s summary, many respondents argued that the DGOJ itself should operate the detection system, with operators responsible only for implementing any resulting protective measures.
Stakeholders also raised concerns about the number of variables included in the model, the need for independent auditing, the absence of flexibility for qualitative judgement and the proposed implementation timetable.
The DGOJ estimates implementation will cost approximately €130,000 per operator, equating to around €7.4m across Spain’s 57 licensed gambling operators, although JDigital has questioned that estimate. The regulator plans to conduct periodic reviews of the system, with the power to amend variables and thresholds as necessary, and intends to appoint an external consultancy to assess the model’s effectiveness.
Stakeholders have until October 22, 2026, to submit comments on the revised proposal. If approved, the resolution would take effect two months after publication in the BOE.
The reopening of the consultation follows another major regulatory development approved in June, with the introduction of cross-operator gambling deposit limits in Spain administered through a centralised system. Meanwhile, there are new rules for online gambling payments in Spain.
From October 28, Royal Decree 813/2026 will require operators to verify that a payment method belongs to the gambling account holder. The change is intended to strengthen anti-money laundering controls. There will be a six-month transition period for existing customers.
FAQs
Why has the DGOJ reopened the consultation on the proposed Spanish gambling risk algorithm?
The consultation was reopened after Spain’s data protection authority (AEPD) said the original proposal did not adequately justify the necessity of all the variables used in the model. The revised proposal adds stronger limits on personal data processing and reinforces players’ rights to information and review without changing the system’s overall purpose.
How will the proposed Spanish gambling risk algorithm identify at-risk gamblers?
Operators would assess customer activity during the first seven days of each month, using data from the previous 183 days. A first-stage formula would evaluate factors such as active days, losses or gains, wagering activity and deposits, while remaining players would be assessed using an XGBoost machine-learning model based on 48 behavioural indicators.
