ANJ, France’s gambling supervisory body, has published updated guidelines on data protection in the local industry. The regulator clarified how GDPR practices should be applied across the national gaming market.
The set of recommendations was drafted in partnership with CNIL, the country’s committee handling IT and civil liberties. The document is designed for all authorised businesses in the state, from web sportsbooks and casinos to land-based halls and legacy monopolists, such as PMU or FDJ.
Essential Details from the Published Paper
The new instructions are framed more as guidance than mandatory requirements. Nevertheless, the provisions described have been in effect since 2018, when the GDPR came into force. The document emphasises the scope and sensitivity of the involved information.
The regulator encouraged operators to take a careful approach to managing the following data:
- ID inscriptions;
- promo preferences;
- signs of responsible play;
- history of bets and transactions;
- payment and contact details, etc.
The authority expects businesses to hire a dedicated officer to protect these records. Additionally, mapping all activities related to information gathering, management, and storage is important. Those establishing privacy policies, documenting processes, and conducting impact evaluations where needed will receive a significant boost in reputation.
Focus Areas Highlighted in the Instructions
Gambling marketing strategy nuances are also included in the updated paper. Entrepreneurs are required to get user approval for any gaming-related commercial activity, regardless of a communication channel — e-mails, SMS, phone/automated calls, posts, etc.
Project owners should ensure that customers agree to the next steps beyond simply accepting general terms. Explicit consent is needed to share client information with 3rd-party commercial organisations. These associates must be clearly specified.
Let us explore other provisions described in the document:
- Cookies and monitoring techs. Generally, user approval should be gained before their device data is stored or accessed. Nevertheless, core elements, such as anonymous visitor measures or authentication services, are exceptions. Businesses must ensure that refusing and accepting cookies are equally straightforward.
- Responsible gaming. If the system detects signs of problematic play, it can initiate processing of health-related details to confirm or rule out the risk of ludomania. AI may perform client profiling, but restrictions must be checked and applied by human staff. There is also a need to explain classification methods, parameters, and aftereffects to the customer.
- AML and CTF. Project owners are allowed to gather ID, payment, and transaction details. Fund origins can be asked about if alert systems justify it. At the same time, CNIL’s specialists stress the misconduct of indiscriminate document invocations. For instance, banks' statements or duplicates of cards are not proportionate.
Regarding data storage duration, gaming account information is usually retained for 6 years following page closure, and anti-money-laundering details may remain in place for half a decade. The paper emphasises that under AML-mandated measures, some customer rights, including erasures, objections, or portabilities, are not applicable.
Casino Market's team helps entrepreneurs smoothly enter and expand in the industry. Our managers can consult you on the most suitable solutions specifically for your case.
Feel free to contact us if you would like to access the latest technology. We offer payment gateways, CMSs, CRM platforms, promotion tools, casino security software, and other reliable products.
Have questions or want to order services?
Contact our consultants:
- e-mail: manager@casino-market.com
- feedback form.
Check the information used to contact us carefully. It is necessary for your safety.
Fraudsters can use contacts that look like ours to scam customers. Therefore, we ask you to enter only the addresses that are indicated on our official website.
Be careful! Our team is not responsible for the activities of persons using similar contact details.
