DGOJ Reopens Consultation on Revised Gambling Risk Algorithm After Data Protection Review

Spain’s gambling regulator has revised its proposed common algorithm for detecting at-risk players and reopened it for public consultation. The move follows a June 15 report from the Spanish Data Protection Agency that faulted the original version for insufficient justification of its 48 variables and inadequate safeguards on personal data use, transparency, and review rights. Consultation remains open until October 22, 2026.

The system would evaluate up to 183 days of player activity, drawn exclusively from operator-held records. Sporadic users—those with fewer than two deposits, two active days, or minimal wagering and sessions—face exclusion before full screening. A first-stage formula applies four fixed risk indicators: active days, net gain or loss per active day, amount wagered, and number of deposits. Remaining players receive assessment through an XGBoost machine-learning model built on 48 behavioural variables, including session duration, product preferences, payment methods, and self-exclusion history stretching back four years.

Players flagged as high risk must receive mandatory protective measures under Articles 26 to 30 of Royal Decree 176/2023 for a minimum of six months. These include bans on promotions, VIP schemes, marketing communications, and credit card payments, plus limits to payment methods in the customer’s own name. Operators must explain classifications in clear language—disclosing only a risk score is insufficient—and provide a 72-hour window for customer response before potential account suspension. Affected players hold rights to request review of both the decision and underlying data, with escalation available to the DGOJ. The classification remains in force during any review, and operators may not repurpose the data for marketing or credit checks.

Stakeholder Input from First Consultation Round

The initial consultation drew 18 submissions from industry bodies such as JDigital and AEJAD, multiple operators, and specialists including Mindway and OpenBet-Neccton. Many respondents argued the DGOJ itself should operate the detection system, limiting operators to implementing resulting protections. Additional concerns focused on the volume of variables, demands for independent auditing, calls for qualitative judgment flexibility, and the proposed rollout timetable.

The DGOJ estimates rollout costs at €130,000 per operator, or roughly €7.4 million across Spain’s 57 licensed operators, though JDigital disputes the total. The regulator has committed to periodic reviews, variable adjustments as needed, and an external consultancy assessment of effectiveness. As reported by Focus Gaming News, approval would trigger effect two months after BOE publication. Current operator methods produce high-risk classifications ranging from 0 per cent to 13.6 per cent of active accounts, a spread the DGOJ attributes to inconsistency rather than demographics alone.

Path to Standardized Risk Controls

The revisions tighten data processing limits without changing the model’s core purpose or two-stage structure. Operators should track this consultation closely, as the final framework will impose uniform detection standards and compliance obligations that vary markedly from existing practices. The outcome will test whether enhanced privacy controls can coexist with timely intervention tools in a maturing regulated market.

Reporting: Focus Gaming News

Generated by SCCG’s automated editorial system from published source reporting. SCCG Management holds editorial responsibility.