Spain’s gambling regulator, the DGOJ, has reopened consultation on a standardised monthly test that would require nationally licensed online gambling operators to identify customers whose activity indicates increased risk. The consultation opened on Tuesday and runs until 22 October 2026.
The proposal would replace the operator-by-operator risk detection models permitted under Real Decreto 176/2023 with a common mechanism. The 2023 regulation required operators to have risk detection protocols but left them free to set their own models and indicators.
How the test would work
Operators would run the automated test during the first seven calendar days of each month, assessing account activity over the previous 183 days. Accounts with minimal recent activity would be removed from the analysis. The remaining accounts would pass through a four-stage process, including objective thresholds based on four variables; meeting any threshold would result in an immediate risk classification.
The system would also calculate about 48 features, drawing on deposits, withdrawals, bets, session length, product mix, time of day, use of self-exclusion tools, cancelled withdrawals and payment instrument categories. Bet data would include amounts, timing and product type. A model would use these variables to generate a probability score, with accounts above a set threshold classified as showing “risk behaviour”.
The DGOJ says the mechanism would not use external sources such as social media or browsing history, or detailed financial and health records. It has prepared a Data Protection Impact Assessment under the GDPR for the automated profiling system.
Effects on players and oversight
A risk classification would trigger measures under Real Decreto 176/2023. Operators would have to tell players they had been flagged and explain the factors behind the decision. Players would then need to take part in an effective interaction within 72 hours; otherwise, the operator would suspend the gambling relationship until the requirement was met.
Flagged players would be barred from promotional activity and VIP services, and their marketing communications would be restricted. Operators would also have to enforce the use of nominative payment methods, including a ban on credit cards, and require players to validate their payment method.
Players could ask operators to review data accuracy and how the rules were applied, with unresolved complaints eligible for escalation to the DGOJ. The protective measures would remain in force during a review, including the 72-hour interaction deadline. The regulator plans periodic assessments using aggregated data and operator reports, adjustments to model variables or thresholds where needed, and independent technical audits.
Issues raised in consultation
Feedback in the first consultation round in 2025 came from operator associations, suppliers, operators and player advocacy groups. Respondents raised implementation and operating costs, disputing the DGOJ’s estimate of €130,000 ($145,320) per operator. They also questioned model accuracy for skill-influenced products such as poker and sports betting and raised data protection concerns.
The DGOJ says the common system is intended to bring consistent detection and safeguards across nationally licensed operators. Its wider work includes a competitive grant programme for gambling research and the Safe Gambling Programme (2026-2030), published in March, which addressed concerns about loot boxes, social casino products and other hybrid features that may normalise gambling among minors and young adults.
