A Global Snapshot of Biometric Compliance in iGaming

Biometrics (face, voice, fingerprint and behavioral signals) are moving from “nice-to-have” to regulatory expectation in iGaming, primarily to tighten KYC/age checks, stop account takeovers and enforce self-exclusion. But because biometric data is highly sensitive, regulators are simultaneously raising the bar on consent, governance, auditability and security. Below is a concise, market-by-market view of what’s changed and what to do about it—timed for August 2025.

Cross-cutting rules you can’t ignore

• Biometrics are “special category” data in the EU/UK, meaning processing is generally prohibited unless you meet narrowly defined conditions (often explicit consent), apply DPIAs, and implement strong safeguards. If you use biometric recognition to uniquely identify players, expect to evidence lawful basis and necessity/proportionality. GDPRICO+2ICO+2
• AI and remote onboarding: In the EU, the AI Act and evolving AML regime are reshaping onboarding and player-protection tech. Operators using AI (e.g., liveness detection, fraud scoring) must assess risk categories and comply accordingly; new EBA work under the AML package (RTS/GLs) is standardizing what “good” remote due diligence looks like, including electronic ID and selfie/biometric checks. DLA PiperWiggin LLPEuropean Banking AuthorityAnti Money Laundering

North America

United States: patchwork—but Illinois BIPA risk just shifted

• Online gambling is state-regulated (NV, NJ, PA, MI, etc.). States continue to harden account security (e.g., NJ’s MFA mandate for online gaming accounts), which pairs naturally with biometric step-ups for high-risk changes. NJ.gov
• Illinois BIPA—the most litigious biometric law—was amended on Aug 2, 2024 to cap per-person damages and to accept electronic consent, reducing “annihilative” exposure for routine biometric onboarding (but liability remains meaningful). If you operate in IL or process IL residents’ biometrics (even for KYC), update consent flows and retention schedules. Greenberg TraurigFaegre Drinker
• Nevada has allowed remote ID verification in support of cashless/casino wagering since 2021–22 rule changes—relevant as cashless expands and face-match becomes a common step. Nevada CurrentThe Fintech Times

Canada (Ontario) spotlight

Ontario’s competitive market keeps refining standards for operator conduct, risk controls and safer-gambling measures through AGCO’s Registrar’s Standards, with supporting guidance refreshed in 2024 and organizational shifts (iGaming Ontario separating operationally from AGCO in 2025) that keep compliance in focus. While not prescriptive about biometrics, strong identity assurance is expected as part of KYC, SOW/SOF, and self-exclusion enforcement. AGCO+1iGaming Express

Canada: privacy first, province by province

• Québec (Law 25) imposes some of North America’s strictest biometric duties: prior notification to the CAI when creating biometric databases, express consent, and a high bar validated by recent CAI decisions. Nationally, the OPC published fresh biometrics guidance in August 2025 reinforcing purpose limitation, risk assessment, and consent clarity. Ontario iGaming standards remain robust on player protection alongside privacy expectations. IAB CanadaLanglois AvocatsPrivacy Commissioner of CanadaAGCO

Latin America

Brazil: from grey market to gated market

• Brazil’s fixed-odds betting framework is phasing in through 2024–2025. Operators must apply for authorization, pay the statutory fee, and meet anti-fraud/AML and identity verification obligations—new ordinances (e.g., SPA/MF nº 722/2024) set KYC guidelines that favor robust digital ID (including biometrics). Enforcement stepped up in late 2024 with site blocks and migration timelines into 2025. caf.ioAP NewsReuters

Practical 2025 note: Build Brazil-specific KYC that handles real-person liveness, CPF checks, and document + selfie flow, with explicit consent for any biometric capture.

European Union & UK

EU: AML + AI converge

• The EBA’s Guidelines on Remote Customer Onboarding (applicable since Oct 2023) set common standards for remote KYC, which many operators mirror for gambling flows that must meet AML rules (video ID, selfie biometrics, liveness, document checks). Draft RTS under the new AML Regulation in 2025 continue this harmonization, referencing eID/eIDAS-aligned identification. European Banking Authority+1Anti Money LaunderingEUR-Lex
• The AI Act (Regulation 2024/1689) is now in force. If you deploy AI-based biometric systems (e.g., age assurance, liveness, risk scoring) in the EU, map them to the AI Act’s risk tiers and implement the required controls (data governance, testing, documentation, human oversight). Sector analyses are already advising gambling companies to align roadmaps this year. DLA PiperWiggin LLP

United Kingdom: more verification, stricter biometrics governance

• The UK Gambling Commission tightened age-verification expectations in 2024, with new premises reporting/data duties from 30 August 2024 that ripple into remote operators’ KYC/verification controls. amusementnetwork.co.uk
• The ICO issued detailed biometric recognition guidance (2024; under review post-June 19, 2025 Data (Use and Access) Act). If you use facial recognition or other biometric tech to uniquely identify customers, plan for explicit consent unless another Article 9 condition clearly applies; complete DPIAs; and evidence security-by-design. ICO+2ICO+2

Practical EU/UK takeaway (2025):

Use biometric age/KYC tools that (1) capture explicit, unbundled consent, (2) support human-in-the-loop for edge cases, (3) log model versions and performance, and (4) store templates with strong encryption/segregation and short retention.

Asia–Pacific

Australia: pre-verification now mandatory

• Australia tightened customer pre-verification for online wagering (no more “verify after wagering”) under AUSTRAC’s AML/CTF Rules, with full effect by late 2024 and active enforcement in 2025. This pushes operators toward fast remote ID and, increasingly, biometric liveness to fight fraud and self-exclusion evasion. austrac.gov.auAGBrief

Singapore: casino AML controls strengthened

• Casino Control regulations were amended in Nov 2024 to bolster AML/CTF (and proliferation financing) controls, tightening KYC expectations in a market that has widely adopted facial recognition in venues for security/self-exclusion. If you operate VIP or cross-border segments touching Singapore, align enhanced due diligence workflows. AGC Singapore

Philippines: PAGCOR’s 2025 overhaul

• PAGCOR has rolled out substantial changes to online gambling oversight coming into full force in 2025, modernizing standards aligned to responsible gambling and technology controls—implications for KYC and player authentication are material for on-shore licensees. sagmeisterinc.com

What’s next (H2 2025–2026)

• Americas: Brazil’s phased enforcement continues; US states are adding privacy acts touching biometrics even when not BIPA-style. Reuters
• EU AML package: Watch the EBA’s final RTS and AMLA standing up supervision—likely more detailed prescriptions for remote ID and reliance on trust services/eID in gambling onboarding. European Banking Authority
• UK: ICO may update biometric guidance post-June 2025 legislation—expect tighter expectations on consent clarity, governance and fairness testing. ICO
• APAC: AUSTRAC enforcement is active; Singapore’s AML/TF controls for casinos are in force and maturing. ReutersAGC Singapore

Bottom line for August 2025

Biometric KYC/age-assurance is increasingly expected—but so is privacy-by-design. Treat biometric programs like regulated financial infrastructure: explicit consent, provable accuracy, documented necessity, tight retention, and independent security testing. Build jurisdiction-specific flows for the EU/UK, US (state patchwork), Canada (Québec notifications), Brazil (SPA/MF), Australia (pre-verification), Singapore (casino AML), and Philippines (PAGCOR 2025).