The account wants your finances, not just your bet: affordability and source-of-funds checks file your income and statements, and exclusion registers share you across operators. Many keep the file five to ten years after your last log-in.
Identity, finances, and addiction-sensitive data. Keep the record.
Anti-money-laundering and self-exclusion rules keep records for years; self-exclusion lists are held to protect you.
Play requires full identity verification and source-of-funds checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
A betting history gets used against people: by a partner, in a custody case, by an employer. Leaked with the ID and bank details an account requires, it is an exposure and a fraud kit at once.
The account wants your finances, not just your bet
To open and keep an account you hand over more than a payment card. In the US, a Social Security number and your precise location are a condition of playing at all. In the UK, many operators also ask for payslips, bank statements, and proof of where your money comes from, verified straight from your bank. British operators go on to watch every stake and loss with automated systems that can limit your account.
Shared to keep you out, and to keep sport clean
Your account does not stay between you and one company. In the UK, operators check every customer against a national self-exclusion register at each login and share any exclusion across every brand the group owns, and customers judged high-risk are pooled with competing operators. In the US and UK alike, your betting activity also flows to sports leagues, integrity bodies, and gaming regulators.
Closing the account does not close the file
Leaving does not mean deletion. By their own account, many operators keep your data for five to ten years after you close the account or last log in, pointing to anti-money-laundering rules, while others name no figure at all and keep it as long as they judge necessary. Self-exclusion makes it last longer, not shorter: the record can be held a further seven years after the exclusion ends, and a permanent exclusion with no end at all. The person who asks to be kept out is kept on file the longest.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Source-of-funds checks and stakes reveal it.
Play patterns are scored for addiction markers.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
Gambling rules keep these long-term so a self-exclusion stays in force.
Money-laundering rules require ID and transaction records after an account closes.
To prove they checked your age or identity and to block known fraud, sometimes held by a separate verification company.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
The records a betting account holds have a market. One US operator disclosed a breach that put roughly 1.5 million customer files up for sale: names, home addresses, dates of birth, and scrambled Social Security numbers. A UK court record separately documents one problem gambler profiled at scale for direct marketing.
Play data is used to target and to retain, within regulation.
Betting patterns train risk and retention models.
Anonymised is their word. A verified identity file names you outright, and betting patterns are as distinctive as any transaction history: four of them identify 90% of people (de Montjoye et al., 2015).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“a soft check that will not affect your credit score”
Lets them pull records from a credit-reference agency: your identity, insolvency and bankruptcy history, court judgments against you, and an estimate of what you can afford. The reassurance covers your score only. It does not limit what they receive, and one policy adds that the outcome is passed back to them.
THE MOVE A request for your data brings back what the credit-reference agency handed them about you. Their reply goes on your record.
“documents proving your source of wealth”
Lets them demand payslips, bank statements, dividends, and proof of business ownership. Those files reveal far more about your finances than any bet, and they sit under the same multi-year retention as the rest of the account.
THE MOVE A request lists the financial documents they hold and why. The reply, or the silence, goes on your record.
“retained indefinitely to prevent you from creating new accounts”
Keeps your identity on file with no end once you have shut yourself out for good or been barred. The stated reason is enforcement: you cannot be kept out unless you are remembered.
THE MOVE A request surfaces what stays behind after you are gone and on what grounds. Their reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →