Spain reopens consultation on its model for detecting at-risk gambling
The Spanish regulator will train a machine learning model to decide which players are at risk, and operators will be obliged to use it. On October 13, the Directorate General for the Regulation of Gambling (DGOJ) opened another public participation instance on the draft resolution that creates this mechanism, common to all and mandatory to use, with a deadline for observations until October 22, and the objective of gathering input on the changes incorporated into the original proposal.
The project had already undergone consultation and returned due to external intervention. It was open for public information throughout August and September 2025, but the DGOJ reopened it after the report issued by the Spanish Data Protection Agency (AEPD) on June 15, 2026, with observations that forced a redrawing of the scope of personal data use and the guarantees remaining for the user. The agency clarifies that the modifications do not affect the purpose of the mechanism or its essential components, but they do tighten the conditions under which it is applied. The general framework is Royal Decree 176/2023, which entrusts the regulator with building the detection tool.
The data chapter is where the changes are concentrated. A data protection impact study was added, reviewing what operations are necessary, what risks they entail, and what guarantees were foreseen. Each operator will have to document how they implement it in their case and separately analyze any additional processing. The proposal also reinforces minimization with a closed list of information taken from activity on the platforms, from which clinical data, questionnaires, personal communications, and any external source not required by the regulatory purpose are excluded.
There is an express prohibition that should be read carefully. Neither the information entering the model, nor the variables calculated from it, nor the category ultimately assigned to each player may subsequently be used for commercial, promotional, advertising, segmentation, profitability, solvency, or commercial risk purposes. The operator must keep this processing separate, both functionally and logically, from the rest of its internal processes, and restrict access only to those authorized to apply safer gambling measures.
The model has a name and periodicity. It is a statistical system that the DGOJ trains with machine learning, specifically XGBoost, and it monitors what each gaming account did over 183 days, with a run in the first week of each month. The category it yields enables the protection measures already provided for in the regulations, including specific contacts with the user, a cut-off of commercial and promotional communications sent to them, removal from privileged attention programs, and certain limits on payment methods. The resolution clarifies that the classification serves a regulatory purpose and is not equivalent to a clinical diagnosis.
The categorized player has the right to dispute it. The new version expands the information that must be provided and recognizes the possibility for the player to ask the operator to review what data was used, how each variable was calculated, how the mechanism was run, and what measures were applied, with the obligation to correct any errors that appear and to invalidate the categorization when appropriate. After this review, they can file a complaint with the DGOJ, without affecting the rights already recognized by data protection regulations. The agency, for its part, will periodically evaluate how the mechanism works, whether it is effective, whether it is applied equally everywhere, and whether relevant or repeated errors appear, with the possibility of changing variables, rules, parameters, or thresholds.
The process still has a way to go. Observations are sent by email to the Sub-directorate General for Gambling Regulation, the complete documentation is published on the DGOJ website, and the resolution will take effect two months after its appearance in the Official State Gazette, so its mandatory application depends on final approval.
What is at stake here is a change in the regulatory model, not just another tool. A state that trains an algorithm, operates it monthly on the accounts of all operators, and imposes the use of its results is doing something different from setting rules and auditing their compliance, because it takes on the classification function that until now each company performed with its own criteria. Hence the intervention of the AEPD, and hence why the most important clause in the text is the one prohibiting commercial use, because the variables used to detect a player at risk are almost exactly those that a CRM uses to identify a valuable player, and without that separation, the mechanism would provide each operator with a segmentation system financed by the regulator. It is also the DGOJ's fourth move in a week, after the agreement with Red.es, the three warnings with loss figures, and the verification of payment method ownership.
Tags: DGOJ, XGBoost, Responsible gambling detection, AEPD