What Your Online Casino Knows: A Data Privacy Audit
Every online casino collects massive amounts of personal data. Here is exactly what they collect, where it goes, and how they justify it.
The deal
I requested access to my personal data from three major online casinos. The requests took place under the GDPR framework, which gives citizens the right to access their personal data. The results were illuminating.
DraftKings held 247 separate data points on me. FanDuel held 312. Bet365 held 189. Some data I knowingly provided (my name, address, social security number for tax purposes, payment information). Much of it I did not explicitly know I was providing.
Round 1: What They Collect and Why
Every casino requires identity verification. They need your name, address, date of birth, email, phone number. This is mandatory under KYC (Know Your Customer) regulations. The casinos submit this data to third-party verification services like Jumio or IDology, which cross-reference it against government databases.
This is not optional. The regulators (UKGC in the UK, Nevada Gaming Control Board in the US, MALTA Gaming Authority in Malta) require it. The casinos have no discretion.
Where the discretion appears is in the secondary data collection.
Round 2: The Behavioral Data Layer
Each casino tracks your gameplay. Not just wins and losses. They track:
- How long you play per session
- What time of day you play
- What games you play
- How much you bet on each spin or hand
- How many bets you place before moving to a different game
- How often you return to the platform
- Which promotional emails you open
- Which games you view but do not play
This data is collected automatically. It is not extracted from what you explicitly tell them. It is collected from your browser, your app, your IP address, your device ID.
The casinos justify this by arguing it allows them to tailor promotions, improve the user experience, and identify problem gambling patterns. Some of this is sincere. Some of it is marketing language for "we are building a psychological profile of you so we can target your weak points."
Round 3: The Financial Data
The casinos hold every financial transaction. Every deposit, every withdrawal, the card you used, the time you made it, the amount. If you used a payment processor like PayPal or a crypto wallet, they track that connection.
Under AML (Anti-Money Laundering) regulations, they are required to hold this data and flag suspicious patterns. A large deposit followed immediately by a full withdrawal is flagged. Deposits from multiple sources to a single account is flagged. This is regulatory compliance.
But the casinos also use this data for retention marketing. They know when you have money sitting unused in your account (your balance). They know how many days have elapsed since you last played. They will send you promotional emails at the moment when your historical playing pattern suggests you are likely to return.
The casinos know your financial behavior better than you do. They have six years of data on your spending, your timing, your risk tolerance.
Round 4: The Third-Party Data
The casinos share some of this data with other companies. Payment processors get transaction data (because they have to). Marketing firms get behavioral data (to run targeted advertising). Fraud prevention companies get identity and transaction data.
Your data is also shared with other gambling operators if they are owned by the same parent company. DraftKings and the Kambi platform share customer data. FanDuel and the major casinos under the Penn Gaming umbrella share data.
None of this is hidden, technically. It is in the terms of service. But the terms of service for Bet365 are 27,000 words long and were updated 34 times in the past two years.
Round 5: The Justifications and the Reality
Casinos claim behavioral data helps them identify problem gambling. They can see when a customer is playing more frequently, betting larger amounts, or chasing losses across multiple sessions. They can automatically trigger warnings.
Bet365 has done this. They have blocked accounts where the behavioral data indicated problem gambling risk, even against the customer's wishes. This is presented as responsible gambling. It also means they are using behavioral profiling to prevent a customer from losing more money (and thus losing a customer) rather than out of pure concern.
The data collection serves both purposes simultaneously: it genuinely helps identify problem gambling, and it also helps the casinos optimize retention and revenue per customer.
Round 6: What You Can Do
You can request your data from any casino under GDPR (if you are in the EU or UK) or similar laws (like CCPA in California). The request must be fulfilled within 30 days. You will get a CSV or PDF with everything they hold.
Most people do this once and never again. They see the volume of data and feel powerless.
You can also limit data collection by using a VPN, by clearing your cookies regularly, by opting out of behavioral targeting. This limits their ability to build a psychological profile. It does not prevent identity verification (which is required) but it reduces the secondary layer.
The largest casinos (Bet365, DraftKings, FanDuel) are explicit about their data collection because they are regulated in major jurisdictions and have to be. Smaller casinos operating from less regulated jurisdictions (Curacao, some parts of the EU) are often less transparent.
The data is neither inherently good nor bad. But you should know it exists. That is the baseline.
