The shift from what to who
Gambling advertising regulation began as a set of rules about content. The growth area is targeting: who the advertisement reached, who it should not have reached, and whether the operator can evidence the difference.
That shift moves the compliance burden from the people who make creative to the people who build audiences, and those teams are generally less prepared for it. A creative review will never catch a lookalike audience that reached self-excluded customers.
The audiences that must be excluded
Four categories recur across frameworks, in roughly descending order of how universally they apply.
People below the legal age. An absolute requirement everywhere. It applies to direct marketing, to paid media audience construction, and in several frameworks to the placement of advertising in media with a significant under-age audience: the UK advertising code, for example, bars gambling marketing directed at under-18s through the selection of media or context in which it appears.
Self-excluded customers. Where a customer has self-excluded, marketing must stop: in Britain the operator must remove or flag the customer in every marketing database used by the company or group within two days of receiving the self-exclusion. Where a national register exists the obligation extends to anyone on it, not only the operator's own excluders. In Britain most remote licensees must participate in the national multi-operator self-exclusion scheme, GAMSTOP, and a registrant is prevented from using any gambling websites and apps run by businesses licensed in Great Britain. The Gambling Commission expects the same care for customers whose self-exclusion has expired but who have not yet made a positive decision to return to gambling.
Customers displaying risk indicators. Some frameworks now require marketing suppression for customers the operator's own systems have flagged: in Britain, remote operators must prevent marketing and the take-up of new bonus offers where strong indicators of harm have been identified. This is harder than it sounds because it requires the risk system and the marketing system to be joined, and in many operators they are not.
Customers who have opted out. Ordinary marketing preference law, which in the UK and the EU requires consent for most electronic direct marketing and a simple way to refuse it.
Suppression that survives a system boundary
Suppression fails in predictable places, and the regulator judges the whole chain: the Gambling Commission has said it would be unlikely to accept that an operator took all reasonable steps if a single point of failure let marketing reach a self-excluded customer.
Suppression applied to a list rather than at the point of send. A list is a snapshot. If a customer self-excludes after the list was built and before the campaign goes out, a list-level suppression misses them. The fix is to check status at dispatch.
Channel gaps. Email suppressed, push notification not. In-app messaging treated as product communication rather than marketing. SMS handled by a separate vendor with its own list.
Brand and platform gaps. A customer excluded on one brand still marketed by a sister brand in the same group. This is the group identity resolution problem in another costume, and it is entirely within the operator's own control.
Third-party lists. Audiences uploaded to an advertising platform months ago and never refreshed. A customer who self-excluded last week is still in a custom audience sitting on someone else's server. Where a third party sends the marketing, the operator remains responsible for taking all reasonable steps to keep self-excluded customers out of it.
Migration and re-import. A platform change re-imports a segment from an older source and resurrects suppressed contacts. This is the failure that catches operators who had it right, and it is why testing has to be repeated after every platform change rather than done once.
The reactivation campaign. A dormant-customer campaign that pulls from a historical table rather than the live customer record. Dormant and excluded look identical in a poorly built query, and every self-excluded customer is, by definition, inactive.
The control that catches all of these is the same: a seeded test account taken through exclusion and then monitored across every channel and every brand, repeated after every material system change. It is cheap to set up and it is the highest-value test in marketing compliance.
Lookalike and modelled audiences
Modelled audiences are where targeting compliance gets genuinely difficult, because the operator does not choose the individuals.
A lookalike audience is built by giving a platform a seed list and asking it to find similar people. Two problems follow directly.
You cannot exclude who you cannot see. If the platform builds an audience of people resembling your best customers, and some of those people are self-excluded elsewhere or below the legal age, you have no visibility and no suppression route beyond whatever the platform offers.
The seed list determines what is amplified. A lookalike built from your highest-spending customers is, definitionally, a model of the characteristics of heavy gambling. Whether that amounts to targeting vulnerability is a live regulatory question (in Britain the ICO has investigated a complaint that an operator was using personal data to target vulnerable gamblers, finding no evidence of deliberate misuse), and the honest position is that an operator using such a model should be able to explain what it is optimising for.
The practical mitigations: build seed lists from a broad customer base rather than from the top spenders, apply every available platform-side exclusion, verify the platform's own age-gating controls rather than assuming them, and document the reasoning. The documentation is not bureaucracy; it is the difference between a defensible practice and an unexplained one.
Retargeting and frequency
Retargeting follows a user who visited but did not convert. Two compliance dimensions apply.
Who is in the pool. A visitor who did not register was never identified, so you do not know their age or their exclusion status. Age-gating the site before any pixel fires is the control, and it is frequently not implemented because it costs conversion. The pixel also needs consent: in 2024 the ICO reprimanded Sky Betting and Gaming for sharing visitors' data with advertising technology companies through cookies before they could accept or reject them.
How often they are reached. Repeated prompting sits uneasily with the rule that gambling marketing must be socially responsible, with particular regard to protecting vulnerable people, and frequency capping is the control. A retargeting campaign with no frequency cap, following a non-converting visitor across the internet for weeks, is the pattern most likely to generate a complaint.
Consent, lawful basis and data protection
Direct marketing sits on data protection law as well as gambling rules, and the two interact.
Electronic direct marketing generally requires consent, with a narrow exception in the EU ePrivacy Directive and the UK's PECR for existing customers and the sender's own similar products, subject to an opt-out having been offered at collection and in every later message.
Consent has to be specific and evidenced. A pre-ticked box is not consent under the GDPR, as the ICO's consent guidance makes explicit, and neither is a bundled permission covering everything. The operator must be able to show what the customer agreed to and when: the controller must be able to demonstrate that the person consented.
Opt-out must be honoured promptly and across channels. An opt-out from email that leaves SMS running is a failure customers notice and complain about. Under the GDPR, once a customer objects to direct marketing their data can no longer be processed for that purpose at all.
Profiling for marketing engages additional obligations in several regimes: under the GDPR the customer can object at any time to profiling related to direct marketing, and where profiling drives significant automated decisions the operator must give meaningful information about the logic involved.
The conflict worth flagging: gambling and anti-money-laundering record-keeping requirements can require retention of customer data for years (in Britain, customer due diligence records must be kept for five years after the business relationship ends, and then deleted unless another basis applies), while data protection requires that personal data be kept no longer than necessary for the purpose. The resolution is a documented lawful basis and a retention schedule that distinguishes regulatory retention from marketing use, not a choice between the two. A customer can be retained for gambling record purposes and simultaneously removed from every marketing audience, and that is the correct configuration.
Evidencing targeting
The question a regulator asks is not whether you intended to exclude someone. It is whether you can show that you did.
Four records make that answer possible: the audience definition for each campaign, including the exclusions applied; the suppression check performed at dispatch, with a timestamp; the platform-side settings used for paid media, including age and audience restrictions; and the results of the seeded exclusion tests, with dates.
An operator holding those four can demonstrate the control. One holding a policy document stating that suppression is applied cannot.