Spain’s Gambling Regulator Opens Second Risk Detection Consultation

Spain’s gambling regulator, the Dirección General de Ordenación del Juego (DGOJ), opened a second public participation process on October 13, 2026, on its draft resolution approving a mandatory common mechanism for detecting at-risk gambling behaviour, with observations accepted from October 14 to October 22, 2026.

The agreement opening the process was signed on October 9, 2026, by Director General Mikel Arana Echezarreta. It sets a seven-working-day window for observations, from October 14 to October 22, 2026 inclusive, and provides that the agreement and case documents remain published on the regulator’s portal between October 13 and October 22, 2026. Contributions must be sent to the Subdirección General de Regulación del Juego by email at [email protected], with a subject line referencing the second public participation process on the risk-behaviour detection mechanism. The opening will be communicated to the operators, associations, organizations, entities and individuals that filed observations during the first round.

Published for comment are the consolidated text of the draft resolution and its annexes, an updated accompanying memorandum, the data protection impact assessment and an explanatory note of the changes introduced since the first consultation. The agreement justifies the shortened deadline by the additional character of the process, the earlier full consultation, recipients’ existing knowledge of the project, and the publication of a consolidated text and a note identifying the changes.

Revisions After the Data Protection Report

The second round follows report 015/2026, issued on June 15, 2026, by the Agencia Española de Protección de Datos, Spain’s data protection authority. In view of its observations, the DGOJ revised the draft and its accompanying documentation to reinforce the justification of the personal-data processing and the guarantees applicable to its execution by operators, according to the regulator’s explanatory note.

The revisions include a data protection impact assessment prepared under the General Data Protection Regulation, with each operator required to document the particulars of its own implementation and to assess separately any additional or modified operations. The project now delimits a closed set of data drawn from activity on the operator’s platform and excludes external sources, clinical data, questionnaires, personal communications and other information not necessary for the regulatory purpose. The categorization’s sole purpose is activating, maintaining and lifting the safer-gambling measures provided in the regulations, and using the data, the calculated variables or the categorization for commercial, promotional, advertising, segmentation, profitability, solvency or commercial-risk purposes is prohibited, with functional and logical separation from other processing and access limited to authorized personnel.

The revisions also expand the information owed to categorized players, recognize a review and error-correction procedure before the operator followed by a complaint to the DGOJ, and add a periodic evaluation by the regulator of the mechanism’s effectiveness, homogeneity and correct application. The agreement states the modifications do not alter the mechanism’s purpose or essential elements but affect aspects of its application and the guarantees recognized to participants, which is why re-submission to public participation was considered appropriate; the new process is additional to the first and directed mainly at observations on the incorporated changes.

The Mandatory Common Mechanism

The draft resolution approves a common detection mechanism of mandatory use by all operators subject to DGOJ supervision, applied to every game modality in their offer; operators may keep complementary mechanisms and protocols provided these do not disapply, substitute or alter the common mechanism. Players categorized as at-risk become subject to the protection measures of Royal Decree 176/2023, the 2023 regulation that develops safer gambling environments: specific and continued interaction by the operator’s responsible-gambling team, a ban on promotions, exclusion from VIP services, advertising restrictions, and a limitation of payment methods to nominal instruments excluding credit cards. The categorization cannot be used by itself to adopt other decisions, and any additional protection measures must be set out beforehand in the operator’s action protocol on objective, previously determined and publicly known criteria.

Operators must inform categorized players of the date of the categorization and the activity period considered, the factors that contributed most to the classification in clear and simple language rather than a bare score or threshold, the applicable measures with their scope and duration, the conditions for lifting them, the regulatory and non-clinical nature of the categorization, and their review and complaint rights. The review has two levels: first before the operator, covering the accuracy of the data, the calculation of the variables and the application of the rules and measures, and then by complaint to the DGOJ; neither suspends the categorization or its measures. The DGOJ will evaluate the mechanism’s functioning periodically and may promote updates to its variables, rules, parameters or thresholds. The resolution would take effect two months after its publication in the Boletín Oficial del Estado, the official state gazette.

Under the draft’s annexes, each operator runs the mechanism every month, within the first seven calendar days, across all game accounts, evaluating activity over a 183-day reference period ending on the last calendar day of the month. The application has four phases. Sporadic players are exempted and treated as no-risk: those with fewer than two deposits, fewer than two activity days, or fewer than ten bets combined with fewer than five sessions, poker tournaments or lottery records in the period. Players satisfying a stated direct-risk rule, a linear formula over four variables (F01, F02, F04 and F10) covering activity days, net result per active day, amounts staked per active day and deposits per active day, are flagged automatically. For the remaining players, the operator extracts the model variables and runs the model supplied by the DGOJ, and players whose predicted probability reaches or exceeds the threshold of 0.3312868 are categorized as at-risk.

The model is an XGBoost decision-tree model pre-trained by the DGOJ and distributed to operators in JSON format. Its variables, numbered F00 to F47, cover deposits, withdrawals, cancelled withdrawals, amounts staked, session duration, product mix, time-of-day patterns, payment-method categories, self-exclusions over the last four years, and instances of a balance falling below two euros followed by a deposit. Flagged players must be treated under the royal decree’s measures for at least six months; the categorization is lifted if a later monthly application detects no risk in their pattern of play, and otherwise renews for at least six further months. The annexes propose the SHAP explainability methodology so operators can identify the factors that contributed most to each classification.

The Regulator’s Evidence Base

An accompanying memorandum dated October 10, 2026, records the DGOJ’s analysis of the detection protocols communicated by 55 active operators over the last four years. According to the regulator, 16 operators flag under 0.1% of accounts as at-risk, 20 flag between 0.1% and 1%, nine flag between 1% and 2% and 10 flag over 2%, with per-operator rates running from 0% to 13.6%; 36 operators, or 65.45%, detect under 1% and only six detect over 4%. The DGOJ said the results evidence serious disparities in the protection levels afforded to users depending on the operator with which they play.

To build the model, the regulator signed collaboration agreements with FEJAR and AZAJER, two associations of rehabilitated gamblers, and the Hospital Universitario de Bellvitge, obtaining access to 506 medical diagnoses of people treated for gambling addiction who had held online gambling accounts recorded in its internal control system. Anonymization rules reduced that set to 394 identities with valid data from January 1, 2021, and a random sample of 3,456 identities was drawn from the online player database using the 11.4% estimate of possible problem gambling from the DGOJ’s prevalence study.

The memorandum records four alternatives considered and rejected: keeping operator discretion over detection criteria, a fully centralized model run by the DGOJ, a mixed model allowing operator flexibility, and systems based on artificial intelligence. The chosen design centralizes the criteria, variables, rules, parameters and thresholds while leaving application of the mechanism to each operator.

The project was first put to public consultation from August 28 to September 25, 2025, and the regulator said observations received in that round covered the model’s architecture, the number and nature of its variables, the implementation period, the convenience of an independent evaluation, possible qualitative criteria and the centralized or decentralized alternatives. The memorandum lists a report from the data protection delegate of the Ministry of Social Rights, Consumer Affairs and Agenda 2030 dated March 3, 2026, the data protection authority’s June report, and notification of the draft to the European Commission under the EU technical-regulations information procedure with a standstill period running to March 16, 2026, while the state legal service’s report was still pending. It also provides for an independent evaluation of the mechanism through a contracted consultancy service. Observations on the revised draft close on October 22, 2026.