Massachusetts Regulators Adopt New Data Privacy Rules

Sportsbooks in Massachusetts will have to take additional steps to protect users’ privacy, state gaming regulators said Tuesday.

The Massachusetts Gaming Commission adopted new regulations requiring sportsbooks to limit the ways they collect, use, and share confidential or personally identifying information collected from customers.

Sportsbooks must secure users permission to use confidential or personally identifying information for any purposes beyond operating their betting product or complying with legal requirements.

The regulations would also prohibit operators from using confidential or personal data to promote wagers based on information that would suggest a likelihood of irresponsible gambling. For example, a sportsbook can t target marketing materials to users who were utilizing play management or “cooling-off” options to limit their betting.

Sportsbooks also must develop and maintain privacy-protection plans, and investigate and report any data breaches.

Massachusetts Attorney General Andrea Campbell’s office was a strong proponent of the new rules.

Data must not be used to promote addiction to, or excessive play on, the platforms,” a representative of the AG’s office wrote in a comment on the proposed regulation. In particular, operators should not encourage inactive bettors to return to the platform, regardless of how long the bettor has been inactive. Such ‘nudging’ to return would contradict efforts to prevent and minimize addictive behavior.”

The five commissioners unanimously adopted the regulations at Tuesday’s public meeting of the MGC.

Sportsbook operators have raised concerns about some aspects of the new rules, including potential conflicts with yet-to-be-developed statewide privacy laws. A DraftKings representative warned the commission in a public comment that the regulation is “likely to present significant conflicts with data privacy legislation that will be adopted in the Commonwealth.” FanDuel, Penn Sports Interactive, Bet MGM, and WynnBet also filed suggesting limits on the new rules.

Members of the Massachusetts legislature have introduced several proposed privacy laws this year that would place limits on how all industries, not just sports betting, make use of consumer data. The state is expected to adopt legislation in the near future modeled on regulations in place in California and other jurisdictions, and MGC staff said gaming regulators could address any potential conflicts between the new regulations and state laws as needed in the future.

Commissioners said they believe it s important to act given heightened concerns in the sports betting space where users are subject to strict verification requirements that require handing over private data.

I don’t think we need to wait for the legislature to come up with new laws when we have the ability to do it through ourselves with regulation,” Commissioner Bradford Hill said at Tuesday’s meeting. “And I think moving forward at this time … would be the prudent thing to do.”

Commissioner Nakisha Skinner raised the possibility of eventually adapting the regulations to apply to retail gaming establishments, but said that would be a discussion to be had at a later date.