DGOJ reopens consultation on unified operator risk-detection test

Spain's Directorate General for Gambling Regulation (DGOJ) has reopened a public consultation on a single, compulsory monthly screening tool designed to identify players showing signs of problem gambling, according to iGaming Business.

The window for feedback opened this week and closes on 22 October 2026, giving operators, suppliers and advocacy groups a further chance to respond to a plan first put out for comment in 2025.

Under the draft resolution, every operator holding a state-level online licence would have to carry out the check during a set window at the start of each calendar month, looking back across the previous 183 days of account activity.

The process works in four stages. Accounts with little recent activity are screened out immediately. The remainder are tested against a handful of fixed thresholds covering four variables, and any account that crosses one of these lines is automatically classed as showing risk behaviour.

Accounts that pass this initial filter are then scored by a model built from roughly 48 features, drawing on deposits, withdrawals, betting patterns, session length, product mix, time of play, use of self-exclusion tools, cancelled withdrawals and the type of payment instrument used. A score above a set threshold results in a formal flag.

The DGOJ has said the model will not draw on social media activity, browsing history or detailed financial or health records.

A flag triggers obligations already set out in Real Decreto 176/2023. Operators must tell the player they have been classified as at risk and explain which factors contributed. The player then has 72 hours to engage meaningfully with the operator, or their gaming relationship is suspended until they do.

Flagged players lose access to promotions and VIP programmes, face tighter limits on marketing contact, and must use payment methods registered in their own name, with credit cards barred outright.

Because the system amounts to large-scale automated profiling with direct legal consequences, the DGOJ has produced a Data Protection Impact Assessment under the GDPR to accompany the proposal.

Players will be able to challenge a classification by asking their operator to review the data and the rules applied, and can escalate unresolved disputes to the DGOJ itself. The 72-hour interaction requirement stays in force while any review is under way.

The regulator intends to review the mechanism periodically using combined data and operator reporting, adjusting variables, thresholds or the model itself where needed, and has also planned independent technical audits of the system.

Feedback from the first consultation round in 2025 came from operator associations, suppliers, individual operators and player protection groups. A recurring objection was cost: the DGOJ had estimated implementation at roughly €130,000 ($145,320) per operator, a figure operators disputed. Concerns were also raised about how reliably the model would work for skill-influenced products such as poker and sports betting, and about the data protection implications of profiling on this scale.

The push for a single standard follows Real Decreto 176/2023, which obliged operators to run risk-detection protocols but left each one free to design its own model and indicators. The DGOJ says that divergence is what has driven it to pursue one harmonised mechanism across all nationally licensed operators.

The regulator has pursued related initiatives this year, including a grant programme funding research into gambling prevention and harm, and its Safe Gambling Programme for 2026 to 2030, published in March, which flagged concerns about loot boxes, social casino products and other hybrid features that may normalise gambling behaviour among minors and young adults.