ANJ Issues New GDPR Guidance For Operators

France’s National Gaming Authority (ANJ) has published new guidelines outlining how gambling operators should apply General Data Protection Regulation (GDPR) requirements when handling player information.

The 59-page document was developed in collaboration with the National Commission for Information Technology and Civil Liberties (CNIL) and applies to all licensed gambling operators in France. This includes online betting, poker and horse racing operators, as well as casinos, gaming clubs, FDJ and PMU.

Rather than introducing new rules, the guidelines explain how existing GDPR obligations should be applied within the gambling sector. The regulator noted that operators process large volumes of sensitive information, including identification documents, payment details, gambling activity, transaction histories, promotional engagement and responsible gambling indicators.

One of the document’s central themes is accountability. Operators are expected to appoint data protection officers, maintain records of data processing activities, implement privacy policies, document procedures and conduct impact assessments.

French Regulator Tightens Consent Requirements For Marketing

The guidance highlights commercial marketing practices in detail. According to the ANJ and CNIL, consent remains the legal basis for all gambling-related marketing communications. This applies across all channels, including email, SMS, telephone calls, postal mail and automated systems.

Operators must obtain marketing consent separately from general account registration agreements. Additional consent is also required before player data can be shared with third-party commercial partners.

The guidance states that operators must clearly identify those partners and explain how player information will be used.

Player Profiling And Responsible Gambling Face Increased Scrutiny

According to the guidance, identifying a player as being at risk of excessive or pathological gambling may constitute the processing of health-related data because it could reveal information about behavioural addiction.

Operators may use algorithmic systems and automated tools to assess gambling risk. However, any action that could restrict a player’s access to gambling services must involve human intervention.

The ANJ also requires operators to clearly explain how profiling works, including the criteria used, player risk classifications and any potential consequences resulting from those assessments.

The guidance further states that cookies and tracking technologies require consent unless strictly necessary for service functionality, authentication tracking, or audience measurement tools for anonymous statistics.

Guidance Clarifies AML Data Collection And Retention Rules

The guidance also outlines expectations around anti-money laundering and counter-terrorist financing obligations. Operators may collect identity documents, payment details and transaction records. They may also request evidence on the source of funds.

However, the CNIL stressed that such requests should not be routine or indiscriminate. The guidance specifically notes that collecting bank statements or copies of payment cards is not considered justified.

Data retention periods vary depending on the purpose of processing. Player account information covered by French gambling regulations is retained for six years after account closure, while certain anti-money laundering records must be kept for five years.

The document also confirms that some player rights are restricted when data is processed for anti-money laundering. Rights on data erasure, objection and portability do not apply where processing is legally required by operators.

The French regulator has released a new guidance, reflecting the importance of data protection in regulated markets. This document mandates operators to be more transparent about the processes involved in collecting, processing, and using player data. The ANJ also updated its current AML and counter-terrorist measures in the guidance.

Further updates on regulatory developments will be available in the Regulation Section.