Key takeaways
- On September 24, 2026, the Electronic Frontier Foundation reported that DraftKings trains machine learning models on customers’ betting records to identify the players most likely to keep losing, then sends them targeted advertising designed to lure them back. The underlying reporting comes from the New York Times (September 19). Problem gamblers, the people most harmed by this targeting, are the most likely to be caught by the model.
- In Ontario, where DraftKings has operated as a registered operator since May 2022, the regulator requires the same behavioral data to feed harm reduction. The AGCO’s Registrar’s Standards mandate monitoring of player accounts and behavior (Standard 2.10) and intervention on high-risk play (Standard 2.01), and the AGCO has fined theScore C$105,000 and PointsBet C$150,000 for failing to act on those signals.
- The privacy exposure is purpose limitation and consent: PIPEDA permits collection and use only for purposes a reasonable person would consider appropriate (section 5(3)), and Law 25 requires organizations to tell individuals when a decision about them is made by exclusively automated processing, sharing the reasons and main factors on request.
On September 24, 2026, the Electronic Frontier Foundation reported that online sports betting company DraftKings is using its customers’ betting records to train a machine learning model to find losing gamblers. Once found, DraftKings sends those customers targeted advertising designed to lure them back to place more bets, the bets the company thinks will be losing ones. The underlying reporting is from the New York Times, published September 19. The people EFF flags as most likely to be targeted are problem gamblers, the ones repeatedly gambling despite harm to themselves, their finances, and their relationships.
EFF’s sharper point is structural. DraftKings appears to be using only first-party data, the data it collects directly from its own users, with no third-party data brokers involved. Policy responses that only limit the sale or sharing of data with third parties would not touch this at all.
The same data, pointed in two directions
Ontario licenses this company. DraftKings has operated in Ontario’s regulated iGaming market since May 18, 2022, registered with the Alcohol and Gaming Commission of Ontario and operating under an agreement with iGaming Ontario.
Ontario law points the data the other way. The AGCO’s Registrar’s Standards for Internet Gaming require registered operators to maintain policies that identify, prevent, and minimize the risk of harm from gaming (Standard 2.01) and to use a mechanism to monitor player accounts and behaviors (Standard 2.10). The AGCO’s own guidance to operators tells them to “use technology to scale the delivery of tailored interventions” for players at risk. The regulator has put money behind the words: it issued a C$105,000 penalty against theScore for failing to intervene on a patron who wagered $2.5 million and lost about $230,000 over eight months, and C$150,000 against PointsBet for responsible-gambling failures.
Put the two uses of the same behavioral pipeline side by side:
| What the model sees | What Ontario expects (harm reduction) | What EFF reports (re-engagement) |
|---|---|---|
| Escalating losses, frequent high-stakes play | Intervention: limits, breaks, responsible-gambling resources | Targeted promotions to bring the player back |
| Repeated bonus requests, loss chasing | Risk flag; trained staff response | Training signal for the “likely loser” model |
| Deposit velocity, session length | Account review, possible suspension | Timing signal for re-engagement offers |
My read: this is one pipeline with two possible destinations. The regulator expects it to terminate in an intervention. The business points it at revenue. When the same model output can serve both, the compliance question is no longer “are we monitoring players” but “what did we do with what the monitoring found.”
The privacy law layer
Purpose limitation is the pressure point. Under PIPEDA, an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances (section 5(3)), and consent must cover each purpose. A customer who hands over betting history to place wagers has a reasonable expectation that the operator watches that data for harm, because the regulator requires it. Being scored as a likely loser for re-targeting is a different purpose entirely, and it is hard to argue a reasonable person would find it appropriate.
Law 25 adds automated-decision transparency. Quebec’s private-sector law requires organizations that render decisions based exclusively on automated processing of personal information to inform the person concerned, and on request to share the personal information used, the reasons and principal factors behind the decision, and the right to correction and review. Promotional targeting driven by an ML score sits in the profiling zone this rule was written for. Quebec also requires organizations to inform people when identification, tracking, or profiling technology is used, and to explain how to activate those functions.
The federal direction of travel matches. The OPC published nine principles for generative AI in August 2026, the federal AI transparency consultation closed September 23 with Michael Geist recommending a statutory AI Transparency Act built on disclosure of safety and escalation policies, training-data transparency, and annual reporting, and Bill C-36, now at second reading, proposes an explanation right for automated decision systems. Every one of these instruments assumes the same thing: the organization can explain what its models do and why.
What to do on Monday
If your organization scores people with models, including for marketing, run this check:
- Inventory the models. List every model that profiles individuals, including third-party tools. If you cannot name them, you cannot govern them.
- Test purpose against the reasonable person. For each model, write down the purpose the individual actually consented to. If the model serves a second purpose, you need a second basis.
- Check your automated-decision disclosures. Law 25’s transparency duties apply now, not when Bill C-36 passes. If an ML score drives who sees what offer, document the factors and the review path.
- Align the pipeline with the regulator’s expectation. If you operate in a regulated sector, your monitoring data has a legally expected destination. Document what the data fed and when. The AGCO’s theScore penalty shows the regulator reads the logs.
Actionable takeaway: Pull one profiling model this week and trace a single data point from collection to the decision it influenced. If you cannot draw that line, or the line ends somewhere the customer never agreed to, you have found your next privacy review.