From Checklists to Outcomes: The Next Meaning of “Reasonable Measures”

Three speeds: industry, research, regulation

Product development, research and regulatory change follow different schedules. A feature can be launched before its long-term effects are understood. A study can identify a risk without showing whether a particular intervention will work. Turning either finding into a legal requirement takes a further decision.

Mark D. Griffiths’ 2009 article on real-time behavioural tracking explains the opportunity to study actual online gambling behaviour. His 2010 paper with Monica Whitty also examines methodological and ethical issues in using such data. These are useful foundations for the debate; they are not evidence that a contemporary AI product reliably diagnoses gambling problems or reduces harm.

The practical challenge is to make the evidence cycle shorter without skipping validation. Operators can supply data, researchers can test interpretations, and regulators can ask whether the resulting intervention works outside the setting in which it was developed. Transparency about funding, access and limitations is part of that assessment.

Financial risk and privacy: proportionate checks

British financial-vulnerability checks and enhanced financial-risk assessments were at different stages in December 2025. The former were already required at £150 in net deposits over a rolling 30-day period, following an initial £500 threshold. They use publicly available information to identify financial vulnerability. The latter were being tested in a pilot; the Commission explicitly distinguished them from checks of what a customer could afford to spend.

Data protection requires a separate assessment of each processing activity. The ICO’s lawful-basis guidance does not prescribe one universal combination of legal obligation and legitimate interests for gambling checks. The appropriate basis depends on the purpose and circumstances, and must be identified and documented.

The ICO also explains the principles of purpose limitation, data minimisation and transparency. A prevention objective does not justify collecting every potentially useful piece of information. Operators should be able to explain which data are needed, how they are used, how long they are kept and how a person can challenge a consequential decision.

In our interview with Rickard Vikström of Internet Vikings, he discusses shared VPN endpoints and suspicious clusters of activity. Infrastructure monitoring and individual financial-risk assessment answer different questions. Patterns across accounts or devices may help an operator investigate integrity concerns; they do not, by themselves, establish whether an individual is experiencing financial difficulty. Calling one method privacy-preserving without examining its actual data flows would be premature.

The strategic choice is therefore not simply between more data and less protection. It is to select a proportionate intervention and test whether the information collected is necessary to deliver it.

Channelisation: reach is not the same as protection

Marionneau and colleagues’ 2025 study found no evidence that higher tax rates were associated with lower channelisation in its European cross-country analysis. It does not support a general conclusion that taxes, advertising limits or product restrictions caused offshore migration. Market estimates and observational comparisons cannot resolve every causal question.

Sweden’s 2024 estimate put channelisation in the competitive market at 85%. Denmark’s regulator reported 91.5% for online gambling in 2024, using H2 Gambling Capital estimates. Different sources, market coverage and methods mean these figures should not be treated as a controlled comparison of the two countries’ policies.

Channelisation remains useful: it indicates how much activity is thought to take place under domestic licensing requirements. But it does not measure whether gambling-related harm has fallen. A high licensed share can coexist with harmful gambling; a falling share can reflect changes in estimates as well as changes in behaviour.

A stronger evaluation would report licensed revenue, estimated unlicensed activity and measures of harm separately, with dates and methodological limitations. It would also distinguish players from spending, and stakes from gross gambling revenue. An apparently precise global or European total is not a substitute for that work.

The next meaning of “reasonable”

The common thread is accountability. An operator should be able to explain why a signal mattered, why it chose a particular response and what it learned from the result. A regulator should be able to explain which outcomes its rules are intended to improve and how those outcomes will be assessed.

That approach leaves room for technology without treating it as proof of effectiveness. It also makes room for privacy and proportionality as design requirements, rather than obstacles to overcome.

By 2030, a more demanding standard could combine validated risk detection, well-trained decision-makers and transparent evaluation. The important shift would be from documenting that a tool exists to demonstrating what it contributes. The evidence may support an intervention, reveal a weakness or show that it should be changed. All three are more useful than an unchecked assurance that the system is working.