Spain's gambling regulator wants every licensed online operator to run the same monthly test for player risk, replacing operator-by-operator detection with one mechanism. The Dirección General de Ordenación del Juego (DGOJ) published the draft on 13 October 2026, and comments close on 22 October.
The DGOJ's notice confirms the title, date and deadline. It describes the draft resolution as one that would approve a mechanism for detecting risky behaviour by gambling users under the state framework that protects gambling participants. Operational detail on how the test works comes from iGaming Business, which reviewed the consultation documents. We attribute those specifics to that report.
What the draft asks operators to run
- A monthly run. Operators execute the automated test during the first seven calendar days of each month.
- A 183-day lookback. Each run evaluates account activity over the preceding 183 days.
- A probability model on about 48 features. Accounts the model flags are classed as "in risk behaviour".
- No outside data. The DGOJ excludes external sources such as social media and browsing history, according to iGaming Business.
- Binding on all licensees. The mechanism applies to all nationally licensed online operators.
The notable design choice is that the risk criteria are set once by the regulator and applied to every licensee, rather than set by each operator.
The timing rule matters as much as the lookback. Each run covers the same 183-day window, but it happens in a fixed seven-day slot each month. Operators therefore get a predictable operational cycle, and the regulator gets a consistent monthly picture of risk across the market. A player who escalates in the middle of a month is not assessed until the next run, which means the mechanism is designed for trends rather than same-day intervention.
Spanish trade coverage adds two data-use points that the iGaming Business report does not cover. According to focusgn, the data and categorisations cannot be reused for commercial, advertising or segmentation purposes, and players can ask for a review of their categorisation before complaining to the DGOJ. We did not read the notice text for those points, so they should be checked against the draft itself.
Why the DGOJ is going back to consultation
The notice reopens a process that began in 2025. iGaming Business describes the current round as a reopening after a first consultation. The article says data-protection risks from automated profiling were raised in that first round, and that the DGOJ has prepared a data protection impact assessment under the GDPR, because large-scale automated profiling can carry legal consequences for the people profiled.
The draft builds on Royal Decree 176/2023, according to the same report. That decree gave the DGOJ the responsibility for a detection mechanism that operators must use under its supervision.
The cost argument
Operators disputed the DGOJ's implementation estimate of €130,000 ($145,320) per operator, according to iGaming Business. The figure matters less than the shape of the cost. A fixed build cost of that size weighs most heavily on smaller licensees, which have fewer data engineers and risk staff to absorb it. Large groups with existing player-protection teams can fold the work into systems they already run.
That asymmetry is our reading, not a figure from the consultation. It is the question the comment period is likely to test.
The estimate is also a one-off build figure. The sources we reviewed do not quantify the ongoing cost of running the test every month, validating its output, or handling the reviews and complaints the draft allows. For operators budgeting against the consultation, those recurring costs may matter more than the build.
What changes for operators
Under operator-led detection, two brands can reach different conclusions about the same player. A common mechanism makes the categorisation consistent across licensees, whatever brand the customer uses.
It also moves the policy debate. Operators will argue about data access, implementation time and cost. The regulator will argue about consistency and profiling safeguards. The consultation is where those positions become specific.
Operators already running responsible gambling tools will need to map their current signals against the DGOJ's feature set once the final text is published. For a different regulator's approach to player affordability, see the UKGC affordability framework guide.
What a flag does not yet trigger
The sources we reviewed do not say what follows once an account is classed as in risk behaviour. They also do not give a date for the final resolution. Those two answers will decide whether the mechanism changes operator conduct or only produces reports. Until the final text is published, the detail that matters most for operators is the one the draft leaves open. Operators that want to shape those answers have until 22 October 2026 to comment on the draft.
Related: a separate Spanish decree on payment-method ownership is covered in Spain requires gambling accounts to match payment holders.