DGOJ reopens consultation on player risk test until 22 October

Spain's gambling regulator, the Dirección General de Ordenación del Juego (DGOJ), opened a new public consultation on 13 October 2026 on a draft resolution. Comments are accepted until 22 October 2026.

What happened

The consultation file includes the draft resolution, annexes and a Data Protection Impact Assessment (DPIA). Interested parties can send contributions by email to the regulator's gambling regulation unit, the Subdirección General de Regulación del Juego.

According to iGaming Business, the mechanism works as follows:

• The test covers account activity from the previous 183 days.
• Accounts with minimal recent activity are screened out.
• A limited group of objective thresholds built on four variables is then applied to the accounts that remain. Meeting any one of them means an account is classed as showing risk behaviour.
• Operators also calculate about 48 features, including deposits, withdrawals, bets, session length, the mix of products played, the hour at which activity occurs, whether self-exclusion tools were used, cancelled withdrawals and the types of payment instrument. A model turns these into a probability score, and accounts above a set threshold are flagged.

iGaming Business reports that the DGOJ says the system does not draw on outside data such as social media, browsing history or in-depth financial or health records.

Consequences for flagged players

A classification triggers the responses set out in Real Decreto 176/2023. Operators must tell the player and explain the contributing factors.

Players can ask the operator to review data accuracy and how the rules were applied, and can escalate unresolved complaints to the DGOJ. Protective measures stay in place during a review. The DGOJ plans periodic assessments using aggregated data and operator reports, with possible adjustments to variables, thresholds or model parameters, and independent technical audits.

Background

Real Decreto 176/2023 required operators to run risk detection but let each define its own models and indicators. The DGOJ prepared the DPIA under the GDPR because the system involves large-scale automated profiling with legal consequences.

The first consultation round in 2025 was answered by player advocacy groups, some operators, suppliers and operator associations. Operators disputed the DGOJ's estimate of €130,000 per operator for implementation, and respondents also raised the accuracy of the model for skill-influenced games such as poker and sports betting, and data protection risks of automated profiling.

Why it matters

Operators with a Spanish state-level licence should review the draft resolution, annexes and DPIA and decide before 22 October whether to file comments, particularly on cost. The earlier dispute over the €130,000 per operator estimate suggests implementation budgets are likely to be a central point.

Operators would need to check whether their data pipelines can supply the listed features.

The concerns raised on poker and sports betting accuracy are also likely to matter for operators with a large share of skill-influenced products.

What's next

The consultation closes on 22 October 2026. Contributions go by email to the Subdirección General de Regulación del Juego at the address given on the DGOJ page.