Spain Moves Toward Centralized Gambling Risk Detection System

The Spanish gambling regulator, the Directorate General for Gambling Regulation (DGOJ), has initiated a critical phase for player protection in the online sector. Through a public consultation running until October 22, 2026, a new centralized model for gambling risk detection is set to be established. This move marks the end of an era where each licensed operator could define its own criteria and thresholds for identifying at-risk players. The authority is responding to the identified heterogeneity of previous protection measures, which led to massive differences in consumer safety.

The new system builds upon Royal Decree 176/2023 and obliges all nationally licensed online gambling operators to conduct an automated test monthly. This algorithm scans every player's behavior to isolate signs of problematic gambling early. It involves not just simple loss limits but a deep analysis of account movements and play styles over a longer period. Anyone falling into the risk behavior category must expect immediate regulatory consequences, ranging from exclusion from marketing activities to a ban from VIP services.

Numbers and facts

The planned mechanism is technically highly complex and based on an evaluation considering the last 183 days of account activity. Operators must perform this check during the first seven calendar days of each month. A total of 48 different features are used to calculate a probability score for potential risk. These features include the amount and frequency of deposits and withdrawals, the duration of gaming sessions, the time of day of activities, as well as the use of self-exclusion tools or the cancellation of withdrawals.

A critical point in the debate is the cost. While the DGOJ estimates implementation costs at around 130,000 Euros per operator, there is already opposition from the industry. Associations and operators doubt the model's accuracy, especially for games of skill like poker or sports betting, where betting patterns often follow different tracks than pure games of chance. Additionally, players classified as at-risk must respond within 72 hours to a mandatory interaction from the operator. If this does not happen, the account is suspended.

Background

The DGOJ is pursuing a long-term strategy with this step, anchored in the Safe Gambling Programme (2026-2030). Particular focus is placed on hybrid gaming forms such as loot boxes and social casino products, which could introduce young adults to gambling. Through the uniform algorithm, the authority wants to ensure that no provider gains a competitive advantage through laxer controls at the expense of player protection.

„The DGOJ has prepared a detailed Data Protection Impact Assessment (DPIA) under the GDPR, given that this is large-scale automated profiling that triggers legal consequences." - Elisa Lorenzo, Legal Expert at DLA Piper

This quote highlights the legal sensitivity of the project. Since the classification as a risk player has immediate consequences, such as the ban on credit card payments, the data processing procedures must be extremely transparent. Players have the right to challenge the accuracy of the data with the operators and escalate complaints to the DGOJ if they feel unjustly sanctioned.

Why it matters for German players

For German players registered with providers holding a license from the Gemeinsame Glücksspielbehörde der Länder (GGL), the Spanish model sounds familiar but goes deeper in algorithmic depth than local standard checks. In Germany, player protection is already strictly regulated by the State Treaty on Gambling 2021 (GlüStV 2021). Instruments like the cross-game deposit limit of 1,000 Euros per month and the central exclusion system OASIS are standard here. Furthermore, the LUGAS system monitors compliance with limits and prevents parallel playing across multiple providers.

A Spanish model of centralized risk analysis could serve as a blueprint for the German market in the future to increase the effectiveness of early detection. Currently, risk analysis in Germany primarily lies with individual casinos, which must report suspicious behavior to the GGL or block accounts. Standardizing algorithms, as Spain is now attempting, would also provide more legal certainty here and prevent players with problematic behavior from migrating to providers that might look less closely.

What it means for GGL-licensed casinos

German casinos with a GGL license already have to meet the highest requirements for player protection. However, the Spanish example shows that the regulatory pressure in Europe continues to tighten. Should the central algorithm prove successful in Spain, the GGL could prescribe similar technical specifications for German licensees. This would mean that providers would have to open their IT systems even more deeply for external audits.

Currently, a bet limit of 1 Euro per spin applies to virtual slots in Germany. Such hard limits are missing in Spain in this form, which is why the focus there is stronger on individual behavior analysis. For providers, this means constant pressure to adapt their compliance systems. Those who do not adhere to the strict rules risk losing their license in both countries, which permanently blocks access to the regulated market.