French betting regulator rolls out fresh data protection rules

(AsiaGameHub) –   The guidelines set out the compliance expectations for gambling operators regarding data handling.

France.- The national gambling authority, the Autorité Nationale des Jeux (ANJ), has released new data protection guidance that details how General Data Protection Regulation (GDPR) rules are implemented within the French gambling industry.

Produced in cooperation with the National Commission for Information Technology and Civil Liberties (CNIL), the document targets all licensed operators in France, including online betting and poker sites, casinos, gaming halls, and the historic monopoly operators FDJ and PMU.

While presented as guidance and not legally binding rules, the paper emphasizes that the duties outlined have been applicable since the GDPR took effect in 2018. It underscores the volume and sensitivity of data processed by gambling firms, encompassing personal identification, contact and payment details, betting and transaction logs, marketing records, and responsible gambling indicators.

Operators are required to designate a data protection officer, chart their data processing operations, implement privacy policies, maintain procedural documentation, and conduct data protection impact assessments as needed.

Areas of focus for gambling data protection guidance

The guidance also places considerable focus on marketing practices. It specifies that customer consent is mandatory for any commercial gambling communications, whether by email, SMS, phone, mail, or automated calls. This consent must be secured independently of general account conditions, and clear authorization is needed before disclosing player information to identified commercial partners.

Regarding cookies and tracking technologies, the document explains that user consent is typically necessary before storing or accessing device information, with exceptions for essential functions like authentication trackers or anonymous analytics. The option to reject cookies must be as simple as accepting them.

The responsible gambling section observes that labeling a player as excessive or pathological can constitute processing health data, as it may indicate addictive behavior. Although algorithmic systems can identify risks, any resulting protective actions require human evaluation. Companies must also inform players about profiling techniques, the criteria used, and possible outcomes.

For anti‑money laundering (AML) and counter‑terrorist financing purposes, operators are permitted to gather identification documents, payment information, and transaction histories, and, when alerts justify it, proof of fund sources. However, CNIL cautions against blanket requests, noting that bank statements and card copies are not seen as proportionate.

Data retention periods vary by purpose: gambling account information is usually kept for six years after an account closes, whereas AML documentation is retained for five years. The guidance also notes that some player rights, including erasure, objection, and data portability, are not applicable when processing is required by law under AML regulations.

Earlier this month, the ANJ expressed concern upon publishing initial results from its new algorithm designed to assess problem gambling in France. The regulator reported that players identified as high-risk accounted for 60 per cent of total operator gross gaming revenue (GGR).

The figures indicated an increase in both the count of problem gamblers and their portion of operator income. In the latter half of 2025, the algorithm detected about 600,000 players with a high probability of excessive gambling. This segment made up 8.7 per cent of the online gambling customer base across licensed providers in France.

From this group, some 300,000 were categorized as “manifestly excessive” gamblers, a group the ANJ stated operators must promptly identify. These high-risk players produced approximately €1.2bn in GGR, representing 60 per cent of all online gambling revenue. The regulator noted this share has been consistently increasing since 2023.