France’s gambling regulator, the Autorité nationale des jeux (ANJ), and the country’s privacy watchdog, the Commission nationale de l’informatique et des libertés (CNIL), have released a major compliance guide explaining how the EU’s General Data Protection Regulation (GDPR) rules apply to gambling operators.
In a recent 59-page document published in May 2026, the authorities explained how the GDPR rules are designed to help gambling companies understand their obligations regarding player data, identity verification, responsible gambling systems, and anti-money laundering controls.
Applies to all forms of gambling
The regulators have strongly asserted that the GDPR rules apply across France’s regulated gambling sector, including online sports betting, horse racing, poker operators, casinos, gaming clubs and state-backed operators such as Française des Jeux (FDJ) and Pari Mutuel Urbain (PMU). It also extends to third-party firms that handle gambling-related data, including payment processors, marketing agencies, identity verification providers, and IT service companies.
Although the document does not introduce entirely new legislation. Yet, authorities wanted to clarify how existing GDPR obligations apply within the gambling industry, which regulators describe as “neither an ordinary business nor an ordinary service.”
According to the guide, gambling operators are expected to contribute to three key public policy objectives: preventing excessive gambling and protecting minors, ensuring gaming integrity and transparency, and combating fraud, money laundering and terrorist financing.
Data protection’s a priority
One of the strongest recommendations in the document concerns the appointment of Data Protection Officers (DPOs). ANJ and CNIL stated that most gambling operators should have dedicated DPOs because the industry routinely carries out large-scale monitoring of player behaviour and processes potentially sensitive personal information.
Operators are also expected to maintain detailed records of all data-processing activities and publish privacy policies that remain separate from standard terms and conditions. The guidance further states that gambling companies must carry out mandatory Data Protection Impact Assessments (DPIAs) for systems linked to responsible gambling monitoring and anti-money laundering controls.
Another major focus of the guide is commercial marketing. French regulators clarified that gambling operators must obtain clear user consent before sending promotional material through email, SMS, telephone calls or automated marketing systems.
The same requirement applies when sharing customer data with commercial partners. Operators must clearly identify all third parties that receive player data and provide players with transparent information before any data sharing occurs.
CNIL also reiterated that cookie consent systems must allow users to reject tracking cookies just as easily as they can accept them. One of the most significant parts of the guidance involves responsible gambling systems.
Problem gambling to be addressed
French regulators stated that classifying a player as an excessive or pathological gambler could legally qualify as processing health-related data under Article 9 of GDPR.
The bodies also warned that gambling companies cannot rely entirely on automated systems when dealing with potentially vulnerable players. While algorithms and monitoring tools can still be used to detect risky gambling patterns, any major action involving a player’s account must first be reviewed by a human.
The guidance also tightens rules around anti-money laundering checks. Operators can request additional financial documents only when specific risks or suspicious activity are identified, rather than as part of routine checks for every customer. However, operators cannot request bank statements or copies of payment cards during standard verification procedures.
Manila’s calling and it’s not whispering. From 31 May to 03 June 2026, SiGMA Asia returns to the undisputed regional heavyweight. With 16,000 delegates, 3,040 operators, and 250+ speakers under one roof, this isn’t just an expo. It’s ignition!
