Spain reopens consultation on model to flag at-risk players

Spain's gambling regulator, the Dirección General de Ordenación del Juego (DGOJ), has reopened public consultation on a draft resolution that would make every operator it licenses use one common model to identify players with risky gambling behaviour. Comments can be sent from 14 to 22 October 2026. The draft is not approved and has no start date yet.

The model comes from Royal Decree 176/2023 on safer gambling environments, which asked the regulator to design a risk-detection mechanism that operators must apply. A first draft went out for consultation from 28 August to 25 September 2025. In a report dated 15 June 2026 (report 015/2026), the Spanish Data Protection Agency (AEPD) raised points that led the DGOJ to change the text, mainly on limits and safeguards for the use of personal data and on what players must be told and how they can ask for a review. The DGOJ says the purpose and core elements of the model are unchanged, which is why this second round runs for only seven working days and focuses on the amendments.

How the monthly check would work

Under the consolidated draft published with the consultation, each operator would run the check during the first seven calendar days of every month, across all of a player's accounts with that operator, using a 183-day window of activity. It has four stages:

• Sporadic players are set aside. Anyone with fewer than two deposits, fewer than two days of activity, or fewer than ten bets together with fewer than five sessions of other games, pre-drawn games, poker tournaments and lottery entries combined is treated as not at risk.
• A fixed formula flags some players directly. It uses four values: days with activity, net result per active day, amount staked per active day and deposits per active day.
• The remaining players are scored by a model that the DGOJ trained itself and makes available to operators on its website. It is an XGBoost model, a widely used decision-tree technique, and it reads 48 variables, from deposits, withdrawals and stakes to the hours of the day a player is active, the types of payment method used and self-exclusions requested over the past four years.
• Players at or above the DGOJ's threshold are classified as at risk.

A player classified this way would fall under the protections already set out in articles 26 to 30 of Royal Decree 176/2023 for at least six months. If a new check after that finds no risk, the classification is lifted; if it finds risk again, the period starts over. The draft's preamble describes those protections as including restrictions on advertising and promotions, exclusion from VIP services, and payment limited to methods in the player's own name, with no credit cards.

What changed after the data protection report

The revised draft adds several safeguards:

• The operator must tell the player when the classification was made, which period was assessed and which factors contributed most, in plain language. A score, a threshold or a general description of the model is not enough.
• The notice must say the label is a regulatory category used only to apply safer-gambling measures, not a clinical diagnosis.
• The data, the calculated variables and the classification may not be used for commercial, promotional, advertising, customer segmentation, profitability or creditworthiness purposes, and must be kept apart from the operator's other processing.
• Only data generated by play on the platform is used. The explanatory note excludes external sources, clinical data, questionnaires and personal communications.
• Players can ask the operator to review the data, the calculation and how the measures were applied. Errors must be corrected and, where appropriate, the classification withdrawn. A player who disagrees with the outcome can then complain to the DGOJ.
• The DGOJ will evaluate the model periodically and can propose changes to its variables, rules, parameters or thresholds.

Why a common model

Spanish operators already have to detect risky play, but each designs its own protocol. In the draft's preamble, the DGOJ says its review of those protocols found a high degree of variation between operators, so the level of protection a player got depended on where they played. The common model is meant to give the same result for the same behaviour at any licensed site. Each operator would still assess only the play on its own accounts, so a player with accounts at two operators would be checked separately by each.

Under the draft, the resolution would take effect two months after it is published in the Boletín Oficial del Estado (BOE). It sits alongside the payment rules we covered this week: from 28 October, Spanish operators must check that deposit and withdrawal methods belong to the player.

What this means for players

Nothing changes yet. If the resolution is approved, players at DGOJ-licensed (.es) sites could receive a notice explaining why they have been classified as at risk, with restrictions lasting at least six months and a right to ask for a review. The rule would apply only to operators licensed in Spain. For other regulators setting limits on play, see the UK Gambling Commission's deposit-limit rules and the Dutch KSA's case against 711.

18+. Gambling can be addictive. If it stops being fun, see our responsible gambling page.