Spain’s Directorate General for the Regulation of Gaming (DGOJ) has reopened a public consultation on a proposal to introduce a unified system for identifying potentially risky user behaviour across nationally licensed online gaming platforms. The revised proposal follows feedback from an earlier consultation and changes requested by Spain’s data protection authority.

A Common Monthly Assessment

Under the proposal, all nationally licensed platforms would be required to run the same automated assessment during the first seven calendar days of each month. Each assessment would review account activity over the preceding 183 days.

The process would first exclude accounts with limited recent activity. It would then apply objective thresholds based on four variables before using a machine learning model to assess remaining accounts. The model considers approximately 48 variables, including deposits, withdrawals, transaction amounts, session duration, product types, activity times, payment methods and the use of account protection tools.

The system is designed to establish consistent assessment criteria across licensed platforms rather than allowing each operator to rely solely on its own methodology.

Measures for Accounts Flagged as High Risk

Under the existing regulatory framework, accounts classified as showing risky behaviour would trigger protective measures. Platforms would need to inform affected users of their classification and explain the factors contributing to it.

Users would be required to complete an appropriate interaction with the platform within 72 hours. Failure to do so could result in suspension of the user-platform relationship until the requirements are met. Promotional activities and access to VIP services would also be restricted for flagged accounts.

The proposal also includes payment verification requirements and restrictions on credit card use in accordance with the applicable rules.

Data Protection and Review Rights

The DGOJ has emphasised that the mechanism would not use external sources such as social media, browsing history or detailed financial and health records.

The revised draft also addresses data protection concerns raised by Spain’s data protection authority. Users would be able to request a review of the information used in their assessment, how the relevant variables were calculated and the measures applied to their accounts. If concerns remain unresolved, complaints could be escalated to the DGOJ.

The regulator has prepared a Data Protection Impact Assessment under the General Data Protection Regulation (GDPR) and plans periodic evaluations and independent technical audits of the system.

Industry Feedback and Implementation Costs

The first consultation, held in 2025, drew feedback from industry associations, service providers, platforms and user advocacy groups. Concerns included implementation and operating costs, the accuracy of the model for different types of games, and the privacy implications of automated profiling.

Industry participants also challenged the DGOJ’s estimated implementation cost of €130,000 per platform.

The regulator’s objective is to establish a consistent framework for identifying potentially risky behaviour and applying protective measures across the nationally regulated market.

Updated Consultation Deadline

The second consultation initially ran from 14 to 22 October 2026. The DGOJ subsequently extended the deadline to 26 October 2026, giving interested parties additional time to review the revised proposal and submit feedback. The final implementation timetable has not yet been announced.