GDPR

GDPR binds gambling businesses hard: player data is voluminous and sensitive (financial behavior, potentially health-adjacent RG data), processors are many (platforms, CRMs, affiliates, payment providers), and fines scale to global revenue.

Affiliate-specific surfaces

Tracking consent (ePrivacy + GDPR on cookies and fingerprinting), lawful basis for marketing lists affiliates build, data-processing agreements in the operator-affiliate chain, and breach liability when a partner leaks. Program terms increasingly include data-protection annexes; affiliates running email lists into EU GEOs are controllers with their own obligations, whether they’ve noticed or not.