Spain's DGOJ reopens consultation on centralised monthly test to flag at-risk online gambling players

Spain's Directorate General for Gambling Regulation (DGOJ) has reopened a public consultation on a centralised risk detection mechanism for online gambling. The consultation opened on Tuesday and will remain active until 22 October 2026.

Under the proposal, every operator holding a state-level online licence would have to run the automated test during the first seven calendar days of each month. Each run would review account activity over the previous 183 days. Accounts with minimal recent activity would be excluded, while a small set of objective thresholds based on four variables would classify some accounts immediately as showing "risk behaviour". For the remaining accounts, operators would calculate roughly 48 features drawn from deposits, withdrawals, bets, session length, product mix, time of day, self-exclusion tool use, cancelled withdrawals and payment instrument types. A model would turn these into a probability score, and accounts above a set threshold would be flagged. The DGOJ says external data such as social media, browsing history and detailed financial or health records is explicitly excluded.

A flagged classification would trigger the measures already laid out in Real Decreto 176/2023. Operators must tell the player about the classification and the contributing factors, and the player must engage in an effective interaction within 72 hours or have the gaming relationship suspended until they comply. Promotions are barred for flagged players, who would also lose access to VIP services and face limits on marketing communications. Credit cards would be banned and players would need to validate the payment method they use.

Because the system amounts to large-scale automated profiling with legal consequences, the regulator has prepared a Data Protection Impact Assessment under the GDPR. Players could ask operators to review data accuracy and rule application and escalate unresolved complaints to the DGOJ, while protective measures stay in force during reviews. The regulator plans periodic assessments, adjustments to variables, thresholds or model parameters, and independent technical audits.

The first consultation round in 2025 drew input from operator associations, suppliers, some operators and player advocacy groups. Concerns included integration and running costs, with operators disputing the DGOJ's estimate of 130,000 euros per operator, as well as model accuracy for skill-influenced games such as poker and sports betting, and data protection risks.

The initiative builds on Real Decreto 176/2023, which required operators to detect risk but let each define its own models and indicators. The DGOJ now wants a harmonised, sector-wide standard so that detection and protective measures are consistent across all nationally licensed operators.