Vulnerable-Customer Marketing Bans: Targeting Restrictions Across UKGC, ANJ, ADM and DGOJ

Across the UKGC, ANJ, ADM, and DGOJ, the obligation to withhold marketing from vulnerable customers is now a discrete, enforcement-grade requirement, distinct from general advertising codes and carrying its own sanction track. The four frameworks differ sharply in how they define vulnerability, which channels and creative formats are affected, and what the regulator expects from an operator’s data infrastructure. What they share is a direction of travel: marketing to identified at-risk players is treated not as a policy aspiration but as a live compliance breach.

Defining “Vulnerable Customer”: Four Regulators, Four Taxonomies

The UKGC does not publish a single statutory definition of “vulnerable customer” for marketing purposes, but the Licence Conditions and Codes of Practice (LCCP) establish operational categories that effectively serve this function. Under LCCP SR Code 3.5.3, any customer who has entered a self-exclusion agreement must not receive marketing communications unless and until they have affirmatively requested to receive them after their exclusion period ends. The code is explicit: “no marketing material should be sent to them unless and until they have asked for or agreed to accept such material.” Beyond self-excluded players, LCCP SR Code 5.1.1 (Rewards and Bonuses, in force from 19 December 2025 following the Autumn 2023 LCCP consultation) requires that incentives not be designed in a way that leads to excessive or harmful gambling. Taken together with the customer interaction obligations in LCCP SR Code 3.4.1, the practical scope covers self-excluded players, those who have used customer-led deposit or loss limits, and customers showing recognised markers of harm.

The ANJ’s taxonomy is more granular and, since May 2026, backed by algorithmic data. Under the 2021 reference framework for protecting players against excessive gambling, French operators must classify players across a risk continuum: recreational, moderate, excessive, and manifestly excessive. Players in the latter two categories are entitled to receive graduated protective interventions, and the ANJ has made clear that offering bonuses or promotional incentives to players already classified as high-risk constitutes a failure of both the identification and accompaniment duties. ANJ’s rules under the ARPP advertising code also restrict the use of celebrities, athletes, or influencers whose appeal reaches under-25 audiences, an age-based vulnerability category that sits alongside, but is distinct from, the harm-based classification.

Italy’s ADM administers the most expansive definition by default: the Decreto Dignità (Decree-Law 87/2018, Article 9) does not require the identification of vulnerable sub-populations at all, because it prohibits gambling advertising directed at the entire population. The ban covers television, radio, digital media, sports sponsorship, social platforms, affiliate marketing, and indirect promotion. Vulnerability is addressed structurally rather than through targeting logic. AGCOM, Italy’s communications authority, is the enforcement body for the advertising prohibition, while ADM governs the gambling licence and can take concurrent action against licensees for non-compliance.

DGOJ in Spain operates the most contested framework of the four. Royal Decree 958/2020 on commercial communications of gambling activities defines protected groups explicitly: minors, persons registered in the RGIAJ national self-exclusion register, and individuals who have self-excluded with the operator directly. The decree also established time-watershed restrictions on broadcast advertising and prohibited marketing directed at persons who had not previously gambled with the licensed operator. Following the Spanish Supreme Court’s Ruling 527/2024, published in the Official State Gazette on 25 May 2024, according to legal analysis, several of these restrictions were annulled for lacking sufficient legal basis under Ley 13/2011, including the prohibition on welcome bonuses and celebrity endorsements. Protections for self-excluded players and minors were not among the annulled provisions and remain in force.

What Does the UKGC Require from Marketing Operations?

Under LCCP SR Code 5.1.12 (Direct Marketing Preferences), all remote casino, bingo, and betting licensees must offer customers opt-in controls for direct marketing on a per-product and per-channel basis, with defaults set to opt-out. These options must be presented at registration and remain updatable. The list of mandatory channel options includes phone, email, and SMS. Where a customer has changed their preference to opt out, the licensee must cease all electronic marketing to that customer unless consent is given again, and must be able to produce evidence of that consent.

The self-exclusion marketing prohibition in LCCP SR Code 3.5.3 is absolute during the exclusion period and survives expiry: even after a self-exclusion ends, the licensee must not send marketing material until the customer has positively requested to receive it. Re-registration online is not sufficient to restart marketing contact, re-engagement must occur by phone or in person. This requirement creates a distinct suppression list obligation that sits outside standard consent management and must be maintained independently.

“Notwithstanding the expiry of the period of self-exclusion chosen by a customer, no marketing material should be sent to them unless and until they have asked for or agreed to accept such material.”, UKGC LCCP SR Code 3.5.3

For incentives, LCCP SR Code 5.1.1 (as amended from 19 December 2025) caps wagering requirements in promotional offers at a maximum of ten times and prohibits mixing product types within a single incentive. The structural requirement that incentives not lead to excessive or harmful gambling means that compliance teams must document not just the terms of any promotion, but the customer risk profile of the audience it targets. Sending a reload bonus to a player who has set a deposit limit or who has received a customer interaction under SR Code 3.4.1 creates a direct tension with SR Code 5.1.1 that the UKGC will treat as a standalone breach.

ANJ: Risk Scoring, Mandatory Filings, and the Bonus-to-High-Risk-Player Problem

France’s advertising framework sits inside a broader operator obligation architecture that makes the marketing question inseparable from player-risk classification. Under requirements in force since 2024, ANJ-licensed operators must file a marketing strategy with the regulator every six months, covering planned campaigns, channels, spend, and targeting methodology. The filing obligation is not advisory: it creates a documented basis against which ANJ auditors can assess whether an operator’s commercial communications are consistent with its stated player-protection approach.

ANJ’s advertising rules, developed in coordination with the ARPP, require that gambling marketing communications target players aged 25 and above. Use of celebrities, athletes, or influencers who appeal to audiences under 25 is restricted. Operators must demonstrate that their communications are socially responsible and do not encourage excessive participation. These channel-level restrictions apply to all licensed operators regardless of the individual risk status of the audience member, they set a floor, not a ceiling.

The more operationally significant obligation concerns identified at-risk customers. Under the 2021 reference framework, once a player is classified as excessive or manifestly excessive, the operator must implement proportionate and graduated interventions. According to ANJ’s July 2026 decision (Décision n°2026-031 du 10 juillet 2026), ANJ made explicit what this means in a marketing context. ANJ fined an unnamed operator €500,000 after finding that 29 high-risk players had been either missed entirely or misclassified at a lower risk tier between October 2023 and March 2024. The decision specifically criticised the practice of offering bonuses to high-risk players as an incentive for continued gambling, framing it as evidence of both a failure to identify and a failure to accompany.

ANJ’s July 2026 decision confirmed that the duties of identification and accompaniment are “distinct and independently enforceable,” meaning an operator that identifies a high-risk player but continues offering them bonuses has breached both obligations simultaneously.

According to ANJ’s algorithmic analysis published in May 2026, approximately 600,000 players, representing 8.7% of France’s online account-based gambling population, were probable excessive gamblers, with around 300,000 classified as manifestly excessive. These players generated approximately €1.2 billion in gross gaming revenue, representing 60% of the country’s total online GGR for the second half of 2025. ANJ has made clear it will use this algorithm as a compliance benchmark, comparing operator-reported problem-gambling identification figures against the algorithm’s findings. Operators whose identification rates fall significantly below the algorithm’s output face investigative scrutiny. The practical implication is that marketing segmentation systems must now interface with player-risk classification outputs, not just consent and preference records.

ADM and AGCOM: Italy’s Blanket Ban and the Informational Exception

Italy’s framework is architecturally different from the other three. The Decreto Dignità (Decree-Law 87/2018, Article 9), which entered into force in 2019, prohibits gambling advertising across all media and channels, not selectively against vulnerable groups, but universally. Television, radio, the press, digital platforms, sports sponsorship, indirect promotion, and affiliate marketing are all prohibited. The rationale was harm reduction through near-total communication suppression rather than targeted intervention.

ADM, as the licensing body for online gambling operators in Italy, issued guidance in June 2026 clarifying the one permitted communication category: bonuses may be communicated to existing customers, but only in a “purely informational manner.” Any messaging that creates promotional emphasis, encourages participation, or incentivises gambling remains prohibited under the Decreto Dignità and AGCOM’s advertising guidelines. The distinction between informational and promotional content is the central ambiguity in the Italian framework. AGCOM launched a formal consultation on this question in May 2026, acknowledging that the existing framework lacks clarity and that more than twenty stakeholder submissions had called for definitional guidance.

ADM Director General Roberto Alesse has publicly argued that the blanket ban has inadvertently strengthened the illegal market by limiting the visibility of licensed brands, a concern that mirrors findings from regulated markets in the Netherlands and Spain. In 2026 alone, ADM blocked over 500 illegal gambling domains, partly as a consequence of the commercial visibility gap created by the advertising prohibition. The Meloni government has indicated that a review of the Decreto Dignità will follow completion of the land-based gambling sector reorganisation, expected by the end of 2026. No legislative proposal to amend the decree had been tabled as of the time of research.

For operators holding Italian licences, the practical compliance position is stark. No targeted advertising to vulnerable customers is required because no advertising is permitted at any level. Compliance work focuses on maintaining the informational-versus-promotional distinction in CRM, confirming that no communications constitute an “invitation to gamble” under AGCOM’s evolving guidance, and monitoring the forthcoming consultation outcome for any narrowing of the prohibited zone.

DGOJ: The Post-Ruling Perimeter and the Incoming Draft Law

Spain’s framework entered a state of deliberate reconstruction following Supreme Court Ruling 527/2024. The Administrative Chamber found that multiple provisions of Royal Decree 958/2020 lacked a sufficient legal basis in Ley 13/2011 and violated the principle of proportionality in relation to freedom of enterprise. The restrictions annulled by the ruling include the prohibition on welcome bonuses and promotional offers, the ban on celebrities and influencers in advertising, restrictions on advertising through information society services, and limitations on advertising directed at non-existing customers.

What survived the ruling: the prohibition on targeting RGIAJ-registered self-excluded players, protections for minors, the obligation to include responsible gambling warnings in commercial communications, and the watershed restrictions on broadcast advertising. Under Articles 10 and 11 of Royal Decree 958/2020, standardised responsible gambling messages must be included in all commercial communications, the specific wording has been updated from the previous “play responsibly” notice to evidence-based warnings. These provisions were not challenged and remain operative.

The Spanish government responded to the ruling by introducing a Draft General Law on Customer Services designed to reintroduce, on a primary-law basis, many of the restrictions the Court annulled for lack of statutory underpinning. As of mid-2026, the draft was in the final stages of parliamentary passage through the Congreso de los Diputados. The draft reinstates prohibitions on welcome bonuses and celebrity endorsements, restricts advertising on audiovisual and online media, and explicitly requires that all commercial communications not exploit vulnerable individuals including minors and problem gamblers. Compliance teams at operators with Spanish licences should treat the current position as a transitional state: the restrictions that were annulled can currently be used, but the legislative trajectory points clearly towards their reinstatement.

DGOJ enforcement in this space has been active. In May 2026, the DGOJ fined production company Make Money Now SA, the operator behind livestreaming channel Zona Gemelos, €10,000 for promoting an unlicensed gambling operator across social media platforms with significant youth audiences, including Instagram, Kick, X, and Discord. DGOJ characterised the promotion as a serious violation of Ley 13/2011. The case was pursued specifically because of the youth demographic of the platform’s audience, signalling that youth-audience exposure is an aggravating factor in DGOJ enforcement decisions on advertising, irrespective of whether the target audience included formally categorised vulnerable persons. For a full profile of DGOJ’s licensing framework and sanctions regime, see the DGOJ licence requirements profile.

Comparative Framework: What the Four Regulators Require

Regulator	Vulnerable-Customer Definition (Marketing)	Core Marketing Prohibition	Under-25 / Minor Restriction	Current Sanction Range
UKGC	Self-excluded players, customers with active markers of harm, customers with deposit/loss limits in place	No marketing to self-excluded players without affirmative re-consent, no incentives to customers at risk of harmful gambling (LCCP SR Code 5.1.1)	Under-18s prohibited from gambling. ASA CAP/BCAP codes restrict appeal to under-18s in advertising creative.	Unlimited, licence suspension/revocation. William Hill: £19.2m, Entain: £17m (for combined failures including marketing breaches)
ANJ	Players classified as excessive or manifestly excessive under the 2021 reference framework (four-tier risk scoring using 23 indicators)	No bonus offers or promotional incentives to high-risk/excessive players, mandatory interventions for players in the top two risk tiers	No advertising using celebrities, athletes, or influencers appealing to under-25 audiences (ARPP/ANJ framework)	Up to €3m per offence. Unibet: €800,000 (January 2025, self-exclusion failure). Unnamed operator: €500,000 (July 2026, high-risk player identification)
ADM / AGCOM	Entire population (Decreto Dignità imposes a blanket ban, no targeting logic applies)	All gambling advertising prohibited across all media and channels, only informational bonus communications to existing customers permitted	Blanket ban inherently covers all age groups	AGCOM administrative sanctions, concurrent ADM licence action for gambling licence conditions
DGOJ	RGIAJ self-excluded players, minors, formerly players with no prior relationship with the operator (this last category annulled by Supreme Court Ruling 527/2024)	No marketing to RGIAJ-registered players, no marketing to minors, responsible gambling warnings mandatory in all commercial communications (RD 958/2020 Articles 10, 11)	Under-18s prohibited from gambling. Advertising appealing to minors is a serious infringement under Ley 13/2011.	Serious infraction: €100,000, €1,000,000 fine + suspension of activity up to 6 months

The Ad-Tech Segmentation Requirement: What Compliance Teams Must Build

Across all four jurisdictions, the shared operational challenge is data segmentation: the need to route marketing decisions through a real-time understanding of player risk status. In the UK, this means connecting the GAMSTOP self-exclusion list and any operator-level exclusion list to the marketing suppression layer in the CRM, and ensuring that the customer interaction flag generated by SR Code 3.4.1 procedures feeds into promotion eligibility logic. A player who receives a customer interaction should not, on the same day, receive a reload bonus email, and enforcement investigations consistently reveal that this connection is absent in operators who rely on separate compliance and marketing technology stacks.

In France, the ANJ’s algorithm creates a de facto real-time segmentation requirement for any operator whose player base is of material size. The algorithm is available to operators on an optional basis, and ANJ has been explicit that operators who do not use it will be measured against its outputs when the regulator conducts its own compliance assessment. Marketing campaigns that send bonus offers to players in the two highest risk tiers constitute direct evidence of a failure under the 2021 reference framework, as the July 2026 Décision n°2026-031 confirmed.

In Spain, the RGIAJ integration requirement means operators must query the register before sending any direct marketing to a player and must maintain records of that query. The register contains over 80,000 active entries as of 2026. Operators running automated CRM campaigns should suppress RGIAJ lookups in a pre-send enrichment step, not rely on a static monthly sync, because the register is updated continuously as new self-exclusions are entered.

For operators in Italy, the compliance infrastructure question runs in the opposite direction: the task is not building targeting logic but documenting that communications do not constitute advertising. Email communications to existing customers explaining a bonus and its terms must avoid any language or design element that creates “promotional emphasis.” Template libraries should be reviewed against AGCOM’s forthcoming guidance once the May 2026 consultation concludes, and legal sign-off on each CRM communication type is prudent until the definitional boundary is codified.

Sanctions Precedent: Where Enforcement Has Landed

The ANJ’s Décision n°2026-031, issued on 10 July 2026 and published on ANJ’s website, is the most operationally instructive recent enforcement action across the four jurisdictions for this specific question. The €500,000 fine was imposed for failures occurring in a six-month window between October 2023 and March 2024. The operator’s defence, that the legal definitions of “excessive gambler” and required “accompaniment” were insufficiently precise, was rejected outright, with ANJ affirming the authority of the 2021 reference framework. The decision treated the offering of bonuses to high-risk players as aggravating evidence of the underlying failure, not as a separate infringement. Compliance teams should read this as confirmation that promotional contact with at-risk players will be treated as proof that the identification duty was not properly implemented.

In Spain, the DGOJ’s enforcement trajectory has focused heavily on advertising to youth audiences via social media, with the May 2026 action against Make Money Now SA marking the first time a content production company, rather than an operator or affiliate directly, was sanctioned for facilitating promotion to youth demographics on unlicensed platforms. The broader Q1 2026 enforcement round resulted in over €10 million in penalties, with youth-audience exposure cited as a specific aggravating factor in multiple cases.

UKGC enforcement on marketing breaches has historically been rolled into composite settlement packages alongside AML and social responsibility failures, making it harder to isolate the marketing component. According to iGamingBusiness reporting in June 2026, the Betting and Gaming Council’s open letter to tech platforms focused on illegal operators targeting self-excluded individuals on social media and created additional political pressure on licensed operators to demonstrate that their own marketing suppression systems are functioning correctly. A licensed operator whose self-excluded customers receive third-party retargeted advertising sourced from data shared by the operator faces a clear LCCP SR Code 3.5.3 exposure.

Cross-Jurisdiction Implications for Multi-Market Operators

Operators holding licences in more than one of these four jurisdictions face the practical challenge that each framework’s vulnerable-customer category is defined differently and triggers different operational responses. A player who is classified as “moderate risk” under ANJ’s four-tier scoring would not necessarily be captured by the UKGC’s customer interaction triggers. A player registered in Spain’s RGIAJ register has no automatic echo in the UK’s GAMSTOP system. Marketing suppression systems must therefore be jurisdiction-partitioned, not shared, and the data fields that drive eligibility must reflect each regulator’s taxonomy individually.

The trajectory across all four frameworks points toward more, not less, regulatory intervention in this space. ANJ’s algorithm deployment and the explicit use of bonus-to-high-risk-player evidence in the July 2026 enforcement decision represent a significant escalation of what regulators will treat as provable harm. The UKGC’s white paper implementation continues to embed affordability and vulnerability assessment more deeply into product and marketing obligations. Spain’s Draft General Law, once enacted, will close the regulatory gap created by the 2024 Supreme Court ruling. Italy’s advertising review, pending AGCOM’s consultation outcome, may create a more workable but still heavily restricted framework for licensed operators.

Compliance officers at multi-market operators should prioritise a gap analysis against each framework’s current vulnerable-customer definition, map those definitions to their CRM and ad-tech data models, and confirm that risk-classification outputs from player-protection systems are feeding into, not running parallel to, marketing eligibility logic. Operators should seek qualified legal counsel for jurisdiction-specific application of these obligations, particularly given the transitional state of the Spanish framework and the pending AGCOM consultation in Italy. To ensure your compliance programme remains aligned with evolving regulatory expectations, review the Vulnerable Customer Marketing Framework on a quarterly basis and update your segmentation rules accordingly as new enforcement decisions and consultations are published.

Key Resources

UKGC Licence Conditions and Codes of Practice (full text): gamblingcommission.gov.uk/licensees-and-businesses/lccp

ANJ Décision n°2026-031 du 10 juillet 2026 (€500,000 fine): anj.fr/sites/default/files/2026-07/Décision-n°2026-031-du-10072026.pdf

Real Decreto 958/2020 de comunicaciones comerciales del juego: boe.es/buscar/act.php?id=BOE-A-2020-13749

Decreto Legge 87/2018 (Decreto Dignità), Article 9: normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legge:2018;87~art9

Gaming Law 2025, Spain (Chambers Global Practice Guides): practiceguides.chambers.com/practice-guides/gaming-2025/spain