French gambling regulator launches new data protection guidelines
The guidelines clarify expectations around data compliance for gambling operators.
France.- The national gambling regulator, the Autorité Nationale des Jeux (ANJ), has issued a new set of data protection guidelines clarifying how General Data Protection Regulation (GDPR) principles apply to the French gambling sector.
The document, prepared in collaboration with the National Commission for Information Technology and Civil Liberties (CNIL), is aimed at all licensed operators in France, from online betting and poker platforms to casinos, gaming halls and the legacy monopoly operators FDJ and PMU,
Although framed as guidance rather than binding instructions, the paper stresses that the obligations it describes have been in force since GDPR came into effect in 2018. It highlights the scale and sensitivity of the data handled by gambling companies, which includes identity details, contact and payment information, betting and transaction histories, promotional records, and indicators of responsible play.
Operators are expected to appoint a data protection officer, map their data processing activities, establish privacy policies, document procedures, and carry out impact assessments where necessary.
Areas of focus for gambling data protection guidance
The guidance also devotes significant attention to marketing practices. It makes clear that customer consent is required for any gambling‑related commercial outreach, whether via email, SMS, phone, post, or automated calls. Consent must be obtained separately from general account terms, and explicit approval is required before sharing player data with commercial partners, who must be clearly identified.
On cookies and tracking technologies, the document states that consent is generally required before storing or accessing information on a user’s device, except for essential tools such as authentication trackers or anonymous audience measurement. Refusing cookies must be as straightforward as accepting them.
The section on responsible gambling notes that classifying a player as excessive or pathological may amount to processing health data, since it can reveal signs of addiction. While algorithmic tools can flag risks, any restrictive measures must be reviewed by a human. Operators are also obliged to explain profiling methods, criteria, and potential consequences to players.
For anti‑money laundering (AML) and counter‑terrorist financing, operators may collect identity documents, payment details, and transaction histories, and, when justified by alerts, evidence of fund origins. However, CNIL warns against indiscriminate requests; bank statements and card copies are not considered proportionate.
Retention rules differ by purpose: gambling account data is typically stored for six years after account closure, while AML records are kept for five. The guidance also clarifies that certain player rights, such as erasure, objection, and portability, do not apply when processing is legally mandated under AML frameworks.
Earlier this month, the ANJ raised concerns with the publication of the first data from its new algorithm intended to measure problem gambling in France. According to the regulator, players flagged as high-risk were responsible for 60 per cent of total operator gross gaming revenue (GGR).
The data showed a rise in both the number of problem gamblers and their share of operator revenues. During the second half of 2025, the algorithm identified around 600,000 players with a high likelihood of excessive gambling. This group represented 8.7 per cent of France’s online gambling population across licensed operators.
Of these, approximately 300,000 were classified as “manifestly excessive” gamblers, a category that the ANJ said operators must urgently detect. Such high-risk players generated roughly €1.2bn in GGR, equating to 60 per cent of all online gambling revenue. The regulator said this proportion has been steadily rising since 2023.
https://focusgn.com/french-gambling-regulator-launches-new-data-protection-guidelines