Data Privacy for Gamblers: What Operators Collect and Your Rights

Opening a gambling account means handing over a lot of personal information. Operators collect more than most people expect, and they keep some of it for years. This guide explains what is collected, why, and what rights you have in the UK, the USA, Ireland, Canada and Australia.

This is general information, not legal advice. Privacy law is changing quickly in several of these countries, so use it as a starting point and confirm details with the relevant regulator.

What operators typically collect

A licensed operator usually holds several layers of data:

• Identity details: your name, date of birth, address, email and phone number.
• Verification documents: passport, driving licence or a proof of address. See identity checks explained.
• Payment data: the cards, bank accounts and e-wallets you use, and the amounts you deposit and withdraw.
• Play data: which games you play, when, how often, your stakes, wins and losses.
• Device and location data: your IP address, browser and device type, and sometimes your location.
• Communications: emails, chat logs and phone calls with customer support.
• Marketing preferences: the offers you opened, clicked or ignored.

Some operators also use outside data sources to check your identity or credit profile, which is part of affordability checks.

Why they collect it

Not all collection is optional, and it helps to separate the reasons:

• Legal duties. Licensed operators must confirm that you are old enough and who you say you are. Money-laundering rules also require them to keep certain records.
• Safer gambling. Regulators expect operators to notice signs of harm, such as sudden increases in spending or long sessions. That monitoring depends on play data.
• Running the account. Payments, withdrawals and complaints need records.
• Marketing. Using your data to decide which offers you see is a commercial choice, and it is the area where you usually have the most control.

How long data is kept

Retention depends on the country and the type of record. UK guidance for casinos, for example, sets a five-year retention period for customer due diligence records, counted from the end of the relationship. Even if you close your account, an operator may lawfully keep identity, transaction and safer gambling records for a time. If you have self-excluded, expect a minimal record to remain so the exclusion can be enforced. Deleting your account is not the same as ending that record.

Your rights, in plain terms

Although each country uses different words, the following rights are common:

• Access: ask what data a company holds about you and get a copy. Where the UK and EU GDPR apply, a company must normally reply within one month.
• Correction: have wrong information fixed.
• Objecting to marketing: under the UK and EU GDPR the right to stop direct marketing is absolute, and you can object verbally or in writing.
• Deletion: have data erased in some circumstances. This is not absolute, and legal retention duties can override it.
• Complaint: take a dispute to the data protection regulator if the company does not respond properly.

Rules by country

• United Kingdom: The UK GDPR and the Data Protection Act 2018 apply, overseen by the Information Commissioner’s Office. Direct electronic marketing is also covered by the Privacy and Electronic Communications Regulations, which generally require consent. The Information Commissioner’s Office has noted that its guidance is under review following the Data (Use and Access) Act 2025, so check its site for updates.
• United States: There is no single federal privacy law covering gambling operators. A growing number of states have their own laws, typically giving residents rights to access, delete and opt out of the sale or sharing of data for targeted advertising. Coverage differs by state, and some financial data is exempt, so check what applies where you live.
• Ireland: The EU GDPR applies, with the Data Protection Commission as regulator. Rights to access, objection and complaint are broadly similar to the UK.
• Canada: The federal PIPEDA covers private-sector organisations in commercial activity, except in provinces with their own substantially similar laws. Quebec, British Columbia and Alberta have private-sector privacy laws. Complaints go to the federal or provincial privacy commissioner.
• Australia: The Privacy Act 1988 and the Australian Privacy Principles apply to many businesses, with the OAIC as regulator. If an organisation uses your information for direct marketing, it must give you a simple way to opt out and act on your request. Electronic marketing is also covered by the Spam Act 2003. Operators registered with BetStop must also stop sending wagering marketing to people on the register.

How to make a request

• Look for a privacy policy or data protection contact on the operator’s site and send your request in writing, keeping a copy.
• Say clearly what you want: a copy of your data, a stop to marketing, or deletion.
• Note the date. If you hear nothing within the legal time, you can complain to the regulator.
• If the problem is bigger than privacy, see how gambling complaints and disputes work.

Reducing your footprint

• Use a separate email address for gambling accounts.
• Turn off marketing emails, texts and push notifications in your account settings.
• Review app permissions, especially location and contacts.
• Be wary of unlicensed sites: they may ask for documents and have no meaningful privacy protection. See why offshore sites are risky.

The bottom line

Gambling accounts hold sensitive information about your identity, finances and behaviour. Some collection is required by law and supports safer gambling, but marketing use is something you can usually limit. Know your right to access your data and stop marketing, keep copies of requests, and use the regulator in your country if a company ignores you.

Sources

• Right to object guidance (ico.org.uk)
• Customer due diligence and record keeping guidance (gamblingcommission.gov.uk)
• Direct marketing guidance for Australian Privacy Principle 7 (oaic.gov.au)
• PIPEDA and substantially similar provincial laws (priv.gc.ca)
• Gambling Regulation Act 2024 and consumer protections (gov.ie)

18+ only (21 in most US states, 19 in most Canadian provinces for casino and betting). Gambling can be addictive. Free, confidential help is available: Great Britain: England and Scotland 0808 8020 133, Wales 0808 2819 265 (free, 24 hours), and GAMSTOP (gamstop.co.uk); US: National Problem Gambling Helpline 1-800-MY-RESET (the older 1-800-522-4700 also works); Australia: Gambling Help Online 1800 858 858 and BetStop (betstop.gov.au); Ontario, Canada: ConnexOntario 1-866-531-2600; Ireland: speak to your GP or the HSE. Never gamble money you need for living costs.