Spain Reopens Consultation on Mandatory Online Gambling Risk-Detection Model
Spain’s Directorate General for the Regulation of Gambling (DGOJ) has reopened public consultation on a proposed standardised mechanism to identify online gambling customers displaying patterns of potentially risky behaviour. Interested individuals, companies and organisations have until 22 October 2026 to submit comments on the revised draft resolution.
The second consultation follows an earlier public consultation conducted between 28 August and 25 September 2025. The DGOJ reopened the process after the Spanish Data Protection Agency issued report 015/2026 on 15 June 2026, prompting amendments to the proposal concerning personal data processing and safeguards for customers.
The proposed mechanism is intended to establish a common approach for identifying potentially risky gambling behaviour across Spain’s nationally regulated online gambling market. At present, operators use their own systems to identify customers whose activity may indicate an increased risk of gambling-related harm. The proposed framework would replace these separate approaches with a model developed and provided by the regulator.
Under the draft, operators would analyse customer account activity covering the previous 183 calendar days. The assessment would be conducted during the first seven days of each month, using information recorded in gambling accounts and applying the DGOJ’s model to specified variables. The mechanism is intended to identify behavioural patterns that may warrant preventive intervention rather than provide a medical diagnosis of gambling disorder.
The model draws on real gambling activity data from individuals medically diagnosed with gambling disorder. The DGOJ presented the underlying algorithm in November 2025, stating that it could improve the identification of customers exhibiting potentially problematic behaviour. The regulator had identified substantial differences between operators’ existing detection approaches and sought to introduce a more consistent methodology across the market.
The revised draft places particular emphasis on data protection. It clarifies which information operators may use and includes a data protection impact assessment. It also expressly prohibits operators from using the information processed by the mechanism, or the resulting customer risk classifications, for commercial or advertising purposes.
The proposal further strengthens customers’ ability to challenge how their information is processed. Customers would be able to request a review of the data used in their assessment, the calculation of the relevant variables and the measures applied to them. They would also be able to submit complaints to the DGOJ where appropriate.
The regulator has stated that the new consultation focuses on the amendments introduced following the data protection authority’s assessment. The mechanism’s principal objective and essential elements remain unchanged.
For gambling operators, the proposal would create a common regulatory framework for identifying risk indicators and could require changes to existing monitoring systems, data processing arrangements and customer protection procedures. Operators would need to ensure that their systems can apply the prescribed methodology within the required monthly timeframe and that the information generated is not repurposed for marketing or other commercial activities.
The consultation remains a draft regulatory process. The final requirements will depend on the outcome of the consultation and the subsequent adoption and publication of the resolution. Until the measure is finalised, operators and other interested parties can submit comments on the proposed text and its safeguards.
Submissions must be sent to the DGOJ’s Subdirectorate General for Gambling Regulation by email to dgoj.sgregulacion@ordenacionjuego.gob.es, using the subject line “Segundo trámite de participación pública. Mecanismo de detección de comportamientos de riesgo”. The consultation period runs from 14 to 22 October 2026, inclusive.
By fLEXI tEAM
It's really interesting to see the Spanish DGOJ refining their risk-detection model with such a strong emphasis on data protection and customer rights. The decision to prohibit operators from using risk classifications for commercial purposes is particularly crucial for maintaining trust and focusing solely on welfare. This could set a high standard, making sure the system effectively helps those at risk without privacy becoming a slope unblocked for abuse.