Spain Reopens Its Gambling Risk Algorithm for Comment Until 22 October
Spain’s gambling regulator has sent its proposed player-risk algorithm back to public consultation after the data protection authority said the first version did not justify the data it uses. Comments are open until 22 October. Here is how the system would work and what it would mean for players.
Quick Take
- Spain’s DGOJ has reopened consultation on a common algorithm that every licensed operator would run to flag players at risk of gambling harm. Observations are accepted until 22 October 2026.
- The tool would run in the first seven days of each month on the previous 183 days of activity, using only data the operator already holds.
- Flagged players would have 72 hours to respond to the operator or face account suspension, and protective measures would last at least six months.
- It applies to operators licensed in Spain and takes effect two months after publication in the BOE, if approved.
What the DGOJ Is Proposing
Spain’s gambling regulator, the DGOJ, wants one common method for spotting players whose behaviour suggests gambling harm. According to Focus Gaming News and SCCG, the DGOJ has now reopened the consultation on a revised version. Observations are open until 22 October 2026 (the dates are the same in Gaming.net and iGaming Business).
The first consultation ran from 28 August to 25 September 2025 and drew 18 submissions. This is the second round, and it comes after a data protection review.
How the Algorithm Works
Every licensed operator would run the same test once a month, during the first seven days, looking back over the previous 183 days of a player’s activity. Players with only sporadic activity are screened out first. The rest go through two stages.
| Step | What happens |
|---|---|
| Screening | Occasional players are excluded before the full test. |
| Stage 1: fixed indicators | Four factors: active days, net gain or loss per active day, amount wagered and number of deposits. |
| Stage 2: machine learning | For the remaining players, an XGBoost model scores about 48 behavioural variables. |
| Data used | Only data the operator already holds. No social media, browsing history, geolocation, external financial records or health data. |
That last row is the point regulators keep returning to: the system is meant to read what happens inside a player account, nothing outside it.
Why the Consultation Was Reopened
On 15 June 2026 Spain’s data protection authority, the AEPD, issued a report (015/2026, per Gaming.net) finding that the original documentation did not sufficiently explain why each variable was necessary, according to Focus Gaming News. The DGOJ revised the draft with stronger limits on how personal data is processed and stronger rights for players to be informed and to have a classification reviewed. It says the purpose and basic structure are unchanged.
What Happens to a Flagged Player
A flagged player must be contacted by the operator and has 72 hours to respond. If they do not, the account is suspended until contact is made (Focus Gaming News, iGaming Business). Protective measures must then stay in place for at least six months, and if a later monthly run still finds risk, they renew (SCCG, Gaming.net).
Operators also have to explain the classification in plain language. Telling a player a risk score or threshold is not enough, according to the draft as described by Focus Gaming News and SCCG.
Cost and Timing
The DGOJ estimates implementation at about €130,000 per operator, or roughly €7.4 million across the 57 licensed operators (Focus Gaming News, SCCG). The industry body JDigital disputes the estimate. If the resolution is approved, it takes effect two months after publication in the BOE, Spain’s official gazette, so no start date exists yet. Spain is also separately moving on payment checks: the account-holder rule starts on 28 October (see our report on Royal Decree 813/2026).
📌 In our view: the interesting part is not the machine-learning model but the 72-hour rule. Spain would be replacing each operator’s own approach with one common test that comes with a deadline, a possible suspension and a six-month minimum. Combined with the 28 October payment checks, a Spanish player will soon face more verification and more contact from the operator than before.
What It Means for Players
💡 What this means for players: nothing changes today, because this is a proposal and the consultation is still open. If it is approved, flagged players at Spanish-licensed sites should expect a message from the operator and a short window to answer it, so keep your contact details current. The rules cover operators licensed by the DGOJ only; they say nothing about offshore sites, which sit outside this framework. A classification as “at risk” is described as a regulatory flag, not a medical diagnosis.
Cocktailspins Weekly Brief
One email a week: the regulation changes, market news and events that matter for crypto gambling. Verified, no spam.
18+ only. Unsubscribe any time. See our privacy policy.FAQ
What is Spain’s gambling risk algorithm?
A common monthly test that every DGOJ-licensed operator would run on player activity from the previous 183 days to identify players at risk of gambling harm. It combines four fixed indicators with a machine-learning model.
When does the Spanish consultation on the risk algorithm close?
Observations are accepted until 22 October 2026.
How long does a flagged player have to respond?
72 hours. If the player does not respond, the account is suspended until they make contact with the operator.
When would the algorithm take effect?
Two months after the resolution is published in the BOE, if it is approved. No date has been set.
Does the algorithm use social media or browsing data?
No. According to the DGOJ it uses only data the operator already holds about the account, and excludes social media, browsing history, geolocation, external financial records and health data.
Sources
↗ Focus Gaming News — Spain’s proposed gambling risk algorithm goes back to consultation ↗ SCCG — DGOJ reopens consultation on revised gambling risk algorithm ↗ Gaming.net — Spain’s gambling regulator opens second risk detection consultation ↗ iGaming Business — DGOJ consultation on the player risk mechanism18+ only. Gambling laws differ by country and change quickly — check the rules where you live. If gambling stops being fun, BeGambleAware and GamCare offer free, confidential support.