Spain reopens consultation on DGOJ gambling risk algorithm after data protection changes

Spain’s gambling regulator, the DGOJ, has sent its proposed common risk algorithm back out for consultation after the Spanish Data Protection Agency asked for stronger safeguards around personal data, transparency and review rights. For PSPs and payment teams in high-risk gaming, the interesting bit is not the machine-learning buzzword; it is that the model would feed into mandatory restrictions on promotions, VIP schemes and some payment methods.

1. The consultation is open until October 22, 2026. The DGOJ reopened it after revising the draft in response to a report from the Spanish Data Protection Agency (AEPD) dated June 15.
2. According to the regulator, the changes focus on limits and safeguards around personal data processing, plus players’ rights to information and review. The AEPD said the original documentation did not sufficiently explain why each variable used in the model was necessary. The DGOJ says the revisions do not change the system’s purpose or core structure.
3. The proposed system would run during the first seven days of every month and analyse the previous 183 days of customer activity across all gambling accounts held with an operator. It would exclude sporadic users before screening, including players with fewer than two deposits, fewer than two active days, or fewer than 10 wagers combined with fewer than five gaming sessions, poker tournaments or lottery entries.
4. The model uses a two-stage process. First, it flags some at-risk players using a formula based on four factors: active days, net gain or loss per active day, amount wagered and number of deposits. Remaining players would then be evaluated by a machine-learning system based on XGBoost technology, an open-source, distributed gradient-boosted decision tree, using 48 behavioural variables.
5. The draft resolution lists variables including deposits, withdrawals, stakes, session duration, product preferences, playing times, payment methods and self-exclusion activity over the previous four years. It would only use data held by the gambling operator and would not pull from external sources such as social media, browsing history or health records.

Players classified as high risk would face mandatory protective measures for at least six months, including restrictions on promotions, VIP schemes and certain payment methods. Operators would also have to explain the classification and provide a review mechanism, which is the part payment providers will want to watch closely if they process Spain-facing gaming traffic.