New York Proposes Ban on AI-Tailored Gambling Offers and Mandatory At‑Risk Flags

The New York State Gaming Commission voted on 9 October 2026 to propose two regulatory packages: one would bar licensees from using AI or automated systems to personalise promotions or suggest wagers, and the other would require mobile sports wagering operators to identify, contact and, if necessary, close accounts of at‑risk bettors. The rules enter a 60‑day public comment period; no final vote date has been set.

What the AI rule would do and who it covers

The proposed AI regulation would be codified as a new Part 5404 in the commission's regulations and applies to every licence holder in New York State: casino operators, mobile sportsbooks, video lottery gaming agents, racetracks, off‑track betting corporations, account wagering providers and lottery couriers, and to any affiliate, agent or vendor acting for them. The text would prohibit any use of an "automated decision system, algorithmic profiling, machine learning or generative system" that processes a patron's data to select, customise, time or deliver any promotion, bonus, odds, limit, message or product recommendation, or to suggest a wager or stake.

The prohibition is broad: human review of an action does not exempt it, and patron consent generally does not create a lawful route. The single exception is horse racing: the proposal allows a separate opt‑in racing app to suggest pari‑mutuel bets based solely on a patron's racing history, with consent off by default and required to be reaffirmed every 12 months.

The presumption and evidential obligations for operators

The rule creates a rebuttable presumption. Any offer whose recipient, content, timing or amount varies between patrons in a way associated with their data is presumed unlawful unless the licensee demonstrates by clear and convincing evidence that it derived solely from published, objective criteria. To support that defence, licensees would have to:

• inventory every system that processes individual patron data;

• keep logs of inputs, outputs, model versions and recipients for seven years;

• have the chief executive certify annual compliance.

Each patron affected would be counted as a separate violation under the proposal. Systems used solely for fraud prevention, anti‑money laundering, age verification or responsible‑gambling interventions would remain lawful. Promotion criteria would be prohibited from relying on wagering history, spending, losses or inferred vulnerability except for volume‑based loyalty tiers.

The at‑risk mobile sportsbook rule and its triggers

The second proposal targets mobile sports wagering only and mirrors elements of a New Jersey approach, according to the commission staff memoranda. Operators would name a responsible gambling lead, keep a list of flagged patrons and prohibit targeted marketing to those patrons. The rule sets eleven automatic triggers that require a review of a flagged patron's financial vulnerability; examples published in the memos include:

• deposits exceeding $10,000 in 24 hours;

• deposits exceeding $100,000 in 90 days;

• more than $1,000,000 wagered in 90 days;

• three unfinished visits to the self‑exclusion page within 30 days;

• three consecutive limit increases in a week;

• a 50% jump in time logged in.

When a patron is judged at risk the proposed intervention is three phases: email informing the patron of limits and support, a commission‑approved video the patron must watch before betting again, and phone contact from the responsible gambling lead. If the operator cannot reach the patron after three calls the account would be suspended; if the patron is still judged at risk after the call the account would be closed. Withdrawals could not be cancelled for three days, and cooling‑off periods would last at least 72 hours with no reversal.

"The industry is on notice," Chairman Brian O'Dwyer said after the vote, urging operators to share data so a bettor restricted at one operator cannot simply move to another.

Regulatory context, provenance and process

Both proposals trace to Governor Kathy Hochul's 2026 State of the State programme, according to the staff memoranda included in the commission's public meeting book. Draft versions circulated in March received dozens of comments; the staff memo says the October text makes substantive changes after industry feedback. The commission placed the proposals on its 9 October 2026 agenda, and reporting from ProPublica and CDC Gaming records the commission's vote as unanimous.

The proposals now enter a 60‑day public comment period required by administrative procedure. No final vote date has been scheduled and the commission will consider comments before any adoption.

Industry implications and points likely to draw comment

Operators will contest the evidential presumption and the definition of "individual data," which in the proposed text extends to device identifiers and cohorts. CRM systems routinely vary offers by player; under the proposal nearly any targeted bonus would start as a presumed violation and the defence depends on logs many platforms were not designed to retain. Counting each affected patron separately multiplies the enforcement exposure for a single campaign.

Market structure will also be central to commentary. The commission notes there are nine licensed mobile operators in New York and a 51% tax on mobile revenue; Chairman O'Dwyer highlighted the risk that a restricted account at one operator could reopen at another in the absence of shared data. Representative industry voices have already weighed in: the Responsible Online Gaming Association, whose members include DraftKings and FanDuel, urged the commission in May that the triggers should not displace operators' existing risk systems, and the Sports Betting Alliance said it would continue working with regulators to strengthen the regulated market.

Links to reporting and next steps for stakeholders

The proposals follow investigative reporting about DraftKings' personalisation practices. Stakeholders now have 60 days to file comments with the New York State Gaming Commission; vendors, operators and compliance teams will focus on the record‑keeping, logging and certification obligations if the rule proceeds. The commission will publish responses and any revised text before a final vote.