New York Proposes Banning AI-Tailored Gambling Offers and Making Sportsbooks Flag At-Risk Bettors

New York's Gaming Commission has proposed barring every gambling licensee in the state, not only sportsbooks, from using AI to tailor offers or suggest bets, and presuming any personalised offer unlawful. A second rule would make mobile sportsbooks flag, contact and if necessary close the accounts of at-risk bettors.

• The New York State Gaming Commission voted on 9 October to propose a ban on AI-driven personalisation of promotions and bet suggestions, and mandatory identification of at-risk mobile sports bettors
• The AI rule covers casinos, sportsbooks, video lottery agents, racetracks and lottery couriers, and their vendors; consent does not exempt them, except for an opt-in racing app
• Any offer that varies with a patron's data would be presumed unlawful unless the licensee proves otherwise from logs kept for seven years
• The at-risk rule sets 11 automatic triggers, including $10,000 deposited in 24 hours, and a three-phase intervention that can end in account closure
• Both follow the New York Times report on DraftKings and now go to a 60-day comment period, with no final vote scheduled

New York Writes an AI Rule While Other States Are Still Reviewing

The commission voted on the two proposals at its meeting in New York City on Friday 9 October, according to the agenda and public meeting book; ProPublica reported the vote was unanimous. Both trace to Governor Kathy Hochul's 2026 State of the State programme, according to the staff memoranda. Drafts circulated in March drew dozens of comments, ProPublica reported. The proposals now face a 60-day public comment period before returning to the commission, and no date has been set for a final vote.

The AI rule would add a new Part 5404 to the commission's regulations. It applies to every licensee, from casino operators and mobile sportsbooks to video lottery gaming agents, racetracks, off-track betting corporations, account wagering providers and lottery couriers, and to any affiliate, agent or vendor acting for them. None may use an automated decision system, algorithmic profiling, machine learning or generative system that processes a patron's data to select, customise, time or deliver any promotion, bonus, odds, limit, message or product recommendation, "regardless of purpose or effect", or to suggest a wager or stake. Human review does not exempt the activity, and patron consent does not waive the ban.

Enforcement rests on a rebuttable presumption: any offer whose recipient, content, timing or amount varies between patrons in a way associated with their data is presumed unlawful, unless the licensee shows by clear and convincing evidence, backed by logs, that it came solely from published, objective criteria. Licensees would have to inventory every system that processes individual data, keep logs of inputs, outputs, model versions and recipients for seven years and have the chief executive certify compliance annually. Each patron affected would count as a separate violation.

Promotions offered uniformly to all eligible patrons remain lawful, as do systems used solely for fraud prevention, anti-money laundering, age verification or responsible-gambling interventions. Promotion criteria may not rest on wagering history, spending, losses or inferred vulnerability, except for volume-based loyalty tiers. The one consent route is for horse racing: a separate opt-in app may suggest pari-mutuel bets from the patron's racing history alone, with consent off by default and reaffirmed every 12 months. The staff memo says the text makes "substantive changes" to the March draft, which was a single paragraph, after industry feedback.

The At-Risk Rule Borrows From New Jersey

The second rule applies only to mobile sports wagering and is based on a New Jersey rule proposal, according to the staff memo, which adds a requirement to assess a flagged patron's financial vulnerability. Each operator would name a responsible gambling lead to keep a list of at-risk patrons and keep marketing away from them. Review triggers include deposits above $10,000 in 24 hours or $100,000 in 90 days, more than $1 million wagered in 90 days, three unfinished visits to the self-exclusion page in 30 days, three straight limit increases in a week and a 50% jump in time logged in.

A patron judged at risk would be emailed about limits and support, then made to watch a commission-approved video before betting again, then called by the responsible gambling lead. One who cannot be reached after three calls would be suspended; one still judged at risk after the call would have the account closed. Withdrawals could not be cancelled for three days, and cooling-off periods would last at least 72 hours with no reversal.

Chairman Brian O'Dwyer said after the vote that "the industry is on notice" and urged the nine licensed mobile operators to share data so a bettor restricted by one cannot move to another, according to CDC Gaming and ProPublica; nothing in the text requires that. ProPublica reported that the Responsible Online Gaming Association, whose members include DraftKings and FanDuel, told the commission in May the triggers should not displace operators' existing risk systems. Joe Maloney, president of the Sports Betting Alliance, said it would keep working with regulators to "strengthen the regulated market", according to CDC Gaming.

The Presumption, Not the Ban, Is What Operators Will Fight

Massachusetts has asked how sportsbooks use AI and Maine says it has no rule on AI in gambling; New York has written one, and reversing the burden of proof is its sharpest edge. Most operator CRM systems vary offers by player as a matter of course, so nearly every targeted bonus would start as a presumed violation, and the defence depends on logs few were built to keep. Counting each affected patron separately turns one campaign into thousands of breaches. The rule also reaches land-based casinos, video lottery venues and racetracks, a far wider net than the online personalisation at issue in the DraftKings allegations, now the subject of a proposed class action. Expect comments to target the presumption and the definition of "individual data", which extends to device identifiers and cohorts.

The Triggers Catch the Big Spenders First

The money thresholds are high: ProPublica reported that its reporter deposited $21,600 in under eight weeks while betting compulsively without prompting a review, and that DraftKings says it already follows the New Jersey thresholds. The behavioural triggers matter more, but the operator still runs the review that decides who is at risk. O'Dwyer named the larger gap himself: with nine operators and no shared data, an account closed at one book can reopen at another. And in a market that taxes mobile revenue at 51%, the state has a fiscal interest in rules tight enough to protect players but not so tight that spend drifts to offshore sites or prediction markets.

New York has gone further on AI than the other states that responded to the DraftKings reporting, and further than its own March draft. Whether it holds depends on what survives 60 days of comment from the operators that would have to prove their offers were not personal.