I wanted to see if anyone else has dealt with this because GAMSTOP’s data retention policy is seriously pissing me off.
I signed up for a six-month self-exclusion in early 2023, understanding that I wouldn’t be able to gamble during that time after I won 6 figures on a sports bet. My exclusion officially ended in mid-2023, and I assumed that was the end of it. However, when I recently tried to sign up at some online casinos, I’m still getting blocked!
I contacted a few operators, and they told me that because I was previously on GAMSTOP, my details are still flagged, and they won’t let me register. This led me to do some research, and what I found is pretty shocking.
Despite Gamstop telling me 40 times I was not on there system, I was still being blocked for operatators who I had never signed up to ever, nor the sister sites etc etc
I looked into GAMSTOP’s Privacy Policy and Terms of Use and found out that they now retain personal data for seven years after a self-exclusion ends. That means even though my SE expired over a year ago, casinos can still see that I was once on GAMSTOP and refuse to let me play. They have now confirmed this.
GDPR says
From everything I’ve read, contractual terms do not override GDPR. Just because they put "we will keep your data for seven years" in their terms doesn’t mean it’s legally valid. Under GDPR, data retention must be necessary and proportionate, and they must be able to justify it with a legal basis, not just their internal policies.
I signed up for a six-month self-exclusion in early 2023, understanding that I wouldn’t be able to gamble during that time after I won 6 figures on a sports bet. My exclusion officially ended in mid-2023, and I assumed that was the end of it. However, when I recently tried to sign up at some online casinos, I’m still getting blocked!
I contacted a few operators, and they told me that because I was previously on GAMSTOP, my details are still flagged, and they won’t let me register. This led me to do some research, and what I found is pretty shocking.
Despite Gamstop telling me 40 times I was not on there system, I was still being blocked for operatators who I had never signed up to ever, nor the sister sites etc etc
I looked into GAMSTOP’s Privacy Policy and Terms of Use and found out that they now retain personal data for seven years after a self-exclusion ends. That means even though my SE expired over a year ago, casinos can still see that I was once on GAMSTOP and refuse to let me play. They have now confirmed this.
GDPR says
- Data should not be kept longer than necessary for its original purpose (Article 5(1)(c) – Data Minimization Principle??).
- I have a right to erasure (Article 17) when data is no longer needed.
- The performance of a contract cannot be used as an excuse to keep data indefinitely. Once my exclusion ended, the contract was fulfilled.
From everything I’ve read, contractual terms do not override GDPR. Just because they put "we will keep your data for seven years" in their terms doesn’t mean it’s legally valid. Under GDPR, data retention must be necessary and proportionate, and they must be able to justify it with a legal basis, not just their internal policies.

