Regulation
When the Regulator Asks Why This Player Received This Offer
Scrutiny of sportsbook personalisation is reaching the decisions behind the offer: which customer data mattered, which safeguards intervened, and who can explain the result. Developments in Massachusetts, New York and Louisiana show why the answers increasingly belong in the same conversation.
Consider a customer who increases deposits after a losing session and then receives a personalised bonus. The message alone cannot reveal whether it followed a routine campaign, a prediction about the customer's behaviour or a decision made despite a warning sign. Nor does a loss, by itself, establish that someone is experiencing gambling harm.
Understanding that sequence requires evidence from inside the business. Recent regulatory developments suggest that this is becoming a central question for sportsbook marketing: how does an operator explain a particular intervention in a particular customer's experience? The answer involves marketing teams, suppliers and the people responsible for player protection.
Massachusetts asks how decisions are made
As our news report on Massachusetts' review describes, the commission is examining operators' use of AI in marketing. Its official announcement of 14 October requests written responses by 3 November.
The underlying letter, dated 9 October, is unusually revealing. Its definition extends beyond products sold as AI to algorithms, profiling and automated decision systems, including those with human involvement. It asks about internal and third-party tools, their inputs and the people responsible for their use.
Crucially, the commission asks whether indicators such as losses, deposits or betting frequency can reduce marketing, or instead lead to more promotional activity. Operators are being asked to describe how the competing decisions work. A description of a model's technical sophistication would leave that question unanswered.
This remains a voluntary information request for policy development; the letter says responses will be confidential. It is neither an adopted AI rule nor a finding against an operator. Its significance lies in the detail of the questions that the regulator wants answered.
New York proposes a boundary for personalisation
New York's proposed changes take a different approach. The commission's draft minutes for 9 October record unanimous votes to propose both AI restrictions and safeguards for at-risk mobile sports wagering customers. Those votes advanced proposals; they did not bring the proposed obligations into force.
The published rule text would restrict automated use of individual data to personalise promotions and wager suggestions. It would cover vendors and affiliates acting for a licensee, with responsibility resting on that licensee. Human approval of an output would not provide an exemption.
The proposal also addresses proof. Operators would maintain system inventories and retain decision logs for at least seven years. Personalised variation linked to individual data would be presumed to breach the rule unless evidence demonstrated that it arose solely from permitted, published objective criteria. Uniform qualifying promotions and systems used solely for specified protective purposes would remain possible. A limited opt-in exception is proposed for separate pari-mutuel horse-racing applications.
The meeting transcript records a request for outside academic expertise on the proposal. That matters: its scope and practical consequences remain subjects for scrutiny. An operator assessing the proposal needs to consider how ordinary segmentation and campaign timing would work under it, as well as any newer AI product.
Protection has to arrive in time
For someone trying to stop gambling, a bonus sent directly to their phone can become an unwelcome reminder at a moment when keeping their distance already takes effort. In a small qualitative study of 12 people with current or past gambling disorder, participants described direct promotions as prompting urges and creating conflict with attempts to abstain. Those accounts do not establish that a particular offer causes relapse, but they make the human stakes clearer: the person receiving the message may be working hard to avoid precisely the activity it invites.
Great Britain offers a useful comparison because relevant obligations are already in force. Under the Gambling Commission's remote customer interaction provision, 3.4.3, operators within its scope must prevent marketing and new bonus uptake when their processes identify strong indicators of harm. They must use automated processes to act on those indicators promptly, followed by individual manual review and an opportunity for the customer to challenge an automated decision.
Timing is a practical vulnerability. In its August 2026 QuinnBet public statement, the commission found that most indicators entered a report produced the following morning, while required immediate account suspensions depended on manual action. It also identified failures associated with a platform migration. QuinnBet accepted the failings and implemented a remedial plan.
This case illustrates a problem that a policy document cannot resolve on its own. A protection process must reach the account while its intervention can still matter. If a campaign system acts first, a subsequent review cannot reverse the customer's exposure to an offer. Evaluating the elapsed time between detection and action is therefore as consequential as evaluating the accuracy of detection.
Louisiana connects the questions to licensing
The conditional DraftKings permit extension in Louisiana brings a further dimension. According to ReadWrite's report of the hearing, the board allowed continued operation while seeking further information about AI allegations and shareholder suitability. Its conditions included a review and certification of marketing compliance.
The same report records DraftKings disputing that it uses AI to target losing customers, and the board stressing that the extension was not a finding of wrongdoing. Those distinctions are essential. A conditional licence process cannot establish the truth of the allegation that prompted questions, and the review encompasses matters beyond AI.
For the wider industry, the relevant development is the connection between customer marketing and the evidence considered during licensing. A disputed claim can generate detailed regulatory questions before any conclusion about its merits.
Build protection into the sending process
The commercial challenge is to make a customer's experience intelligible across organisational boundaries. A campaign report can show that an offer converted well. A protection report can show that an account was flagged. Placed side by side, those reports may still fail to explain why the customer received the offer at that moment.
One practical design starts with a customer data platform (CDP), or an equivalent shared data service, linking account identifiers to timestamped events from payments, play and safer-gambling systems. Identity resolution provides the underlying pattern. A real-time event stream should carry protection changes as they occur, with delivery delays measured and monitored. The responsible-gambling (RG) service should remain authoritative for protection status; marketing needs a minimal eligibility signal, without receiving sensitive case notes as targeting data.
We recommend a final suppression check immediately before each outbound marketing API call. It should apply shared rules for the relevant jurisdiction, consent and RG eligibility. Every sending service should pass this check; campaign settings must not be able to override an RG block. Separating policy decisions from their enforcement makes this possible across different channels. Recheck queued campaigns when dispatched, including retries. Require external providers to honour subsequent suppression updates or cancellations; where they cannot, keep scheduling under operator control until the last controllable handoff.
Freshness matters as much as connectivity. Policy systems can hold outdated copies of customer data. Set explicit freshness limits and prevent delayed events from overwriting newer protection decisions. When status is stale, unavailable or contradictory, hold the promotion and route the exception for review. Release should require a fresh authorised decision; manual review should never silently bypass a protection restriction.
Record the account reference, input timestamps, rule version, eligibility decision, suppression reason and provider response in an access-controlled audit trail. Limit stored personal information and define retention periods. Monitor confirmed delivery separately from API acceptance. This is an implementation recommendation, not a prescribed technology stack: Britain's existing rules require applicable operators to prevent marketing after strong harm indicators and act promptly, but do not mandate buying a CDP.