Gambling marketing texts: the Gambling Commission rules

A gambling operator licensed in Great Britain needs two things before it texts a customer a promotion: consent that satisfies privacy law, and compliance with its Gambling Commission licence, which adds rules of its own. The biggest recent change came on 1 May 2025, when social responsibility code 5.1.12 started requiring online betting, casino and bingo operators to let customers opt in to marketing product by product and channel by channel, with text messages (SMS) as one of the channels and every option set to off by default. The Commission announced the requirement on 1 May 2024, after consulting in summer 2023, and moved its start from 17 January 2025 to 1 May 2025 in an update on 27 August 2024.

The older rules still sit underneath: consent you can prove for any electronic marketing, no marketing of any kind to anyone who has self-excluded, and, since 19 January 2026, limits on what the offer in the text can be.

Two rulebooks for one text

The first is PECR, the Privacy and Electronic Communications Regulations 2003. Regulation 22 bans unsolicited marketing by electronic mail, which includes texts, to individuals unless they consented first or the soft opt-in applies. That's the ICO's territory and applies to every business; our guide to SMS marketing rules in the UK covers it.

The second is the licence. The Commission's Licence Conditions and Codes of Practice (LCCP) contain social responsibility codes, and each one carries the same warning: "Compliance with these is a condition of licences; therefore any breach of them by an operator may lead the Commission to review the operator's licence with a view to suspension, revocation or the imposition of a financial penalty and would also expose the operator to the risk of prosecution."

The Commission was open about why it added consent rules of its own. Its consultation response describes the aim as extending "the principles of the Privacy and Electronic Communications Regulations (PECR), which require a very high bar, and granular level of consent", to new and existing customers alike.

Code 5.1.11: consent you can evidence

Code 5.1.11, "Direct electronic marketing consent", applies to all licences. It runs to four sentences:

Unless expressly permitted by law consumers must not be contacted with direct electronic marketing without their informed and specific consent. Whenever a consumer is contacted the consumer must be provided with an opportunity to withdraw consent. If consent is withdrawn the licensee must, as soon as practicable, ensure the consumer is not contacted with electronic marketing thereafter unless the consumer consents again. Licensees must be able to provide evidence which establishes that consent.

For a text programme that means three things you can show the Commission: a consent record for each number (when, how, and what the person agreed to), an opt-out in every message, and a suppression process that acts quickly. The last sentence of the code is the one that matters on a bad day. "They signed up on the app" is a claim, while a timestamped record of the tick box and the words next to it is evidence.

The Commission's regulatory action register shows the code being used. On 26 June 2025 it fined Grace Media (Gibraltar) Limited £60,000 for breaching codes 5.1.11 and 3.5.3, the self-exclusion code, noting the failure was "due to human error in the application of these policies and procedures". On 21 July 2025 it fined Tombola (International) Plc £184,500 for breaches of the same two codes, uncovered after the company reported the problem itself as a key event. The register entries don't say which channel was involved, so don't read them as text cases. They do show the Commission fining on 5.1.11 even where an operator had policies in place and the failure was human error or isolated.

Since 1 May 2025: product by product, channel by channel

Code 5.1.12, "Direct marketing preferences", applies to remote casino, bingo and betting licences, other than ancillary, host, trading-room betting intermediary and limited betting licences. Its six paragraphs say:

• Licensees must offer options to opt in to direct marketing "on a per product and per channel basis", covering all their products and channels and "set to opt-out by default", at registration and updateable afterwards, for new and existing customers.
• Channel options must include "phone call, email and text messages (SMS) as applicable".
• Product options must include betting, casino and bingo, as applicable, and the operator has to make clear which of its products sit in each.
• Any extra confirmation step may only let the customer confirm or decline their choices, with "no encouragement or option to change selection".
• "Customers must not receive direct marketing that contravenes their channel or product preferences."
• Existing customers who hadn't opted out had to be asked at their first log-in after the code started, and old preferences can be carried over only if they match the new format.

The consultation response explains the shape. Post was dropped as a channel because it "would go beyond the scope of PECR and bring only limited benefits for customers", push notifications because people already control them on the device, and fax because the Commission wasn't aware of any gambling marketing being sent that way. Land-based gambling and lotteries were taken out of scope. The research behind the change, from the Commission's Consumer Voice programme, found that "persistent marketing increases engagement in promotional offers that are unrelated to the customer's primary form of gambling". On existing customers the response is blunt: anyone who hadn't set preferences in the new format "will need to do so before they are allowed to gamble".

A casino offer can go by text only to customers who have ticked both casino and SMS. A customer who opted in to betting by email and nothing else gets no texts at all. The Commission also said an email campaign doesn't have to be repeated by text for customers who chose SMS only, so a channel preference allows you to text someone without obliging you to.

No marketing to self-excluded customers, by any channel

Self-exclusion is the tool customers use when they want an operator to refuse them service. Code 3.5.3 says licensees "must, as soon as practicable, take all reasonable steps to prevent any marketing material being sent to a self-excluded customer", and must remove or flag the person in "any marketing databases used by the company or group" within two days of receiving the completed self-exclusion notification. Operators also have to take part in the multi-operator scheme for their sector, which online is GAMSTOP.

The Commission's guidance on keeping self-excluded customers out of marketing is specific about how it goes wrong. Operators that sent marketing in error blamed "individual members of staff using manual 'workarounds' of systems designed to ensure that the accounts of self-excluded customers are excluded from e-mail and SMS marketing campaigns", "the recycling of old customer lists", and confusion between self-exclusion and shorter time-outs. The Commission says it would be "unlikely to accept that you had taken all reasonable steps if there was a single point of failure", expects every incident to be reported as a key event, and adds that such incidents are likely to breach PECR and should be reported to the ICO as well.

Three published cases show what it costs.

The 2018 case is the one that names texts. The 2022 case is worth reading for its second number, the quarter of a million people who had simply unsubscribed and got the offer anyway. Andrew Rhodes, the Commission's chief executive, said in the 2022 announcement that self-excluded customers "should absolutely not be sent direct marketing that could tempt them back into gambling", and that the fine "would have been a lot higher" had the company let any of them gamble, failed to cooperate or not acted to stop a repeat.

What can the offer in the text say?

Since 19 January 2026, code 5.1.1 on rewards and bonuses has said licensees must not "Apply wagering requirements, which requires a customer to play through bonus funds, over a maximum of 10 times", and must not "Include more than one type of gambling product (betting, casino, bingo, and lottery) within an incentive". The terms of any incentive have to be "clear, transparent, and fair and readily accessible". In a text that usually means one product per offer (free bets on the football, or free spins on a slot) and a link to the full terms. The CAP Code's rules on promotions apply too, and our post on the CAP Code and your promotional texts covers those.

The Commission's own survey shows why the offer gets this much attention. Asked in June 2021, 65% of people who had gambled in the previous 12 months said a gambling company had sent them an incentive in that time. Email was the commonest route at 47%, with text messages at 17%.

The same survey asked how often. Among people receiving incentives by email, text, app or social media, 10% said they got them daily, and the share rose steeply with gambling risk: 4% of non-problem gamblers, 7% of low and moderate risk gamblers, and 35% of problem gamblers.

Respondents were also asked what the offers did to them. 28% agreed that "I gambled for the first time as a result of receiving a bonus offer", and 21% that "I restarted gambling after taking a break as a result of receiving a bonus offer". Those are the effects the preference and self-exclusion rules are there to contain.

Affiliates and agencies

A lot of gambling marketing is sent by someone other than the operator. The Commission's guidance says operators using affiliates for direct marketing must comply with LCCP, the Data Protection Act 2018 and PECR, and that "We, and the ICO, consider that you are primarily responsible for any breaches." It warns that an operator will be held responsible if an affiliate mishandles the data, and code 1.1.2 makes licensees answerable for the third parties they contract with.

PECR says the same in its own words: regulation 22 covers anyone who sends "or instigates" a marketing text. Our post on the ICO's text marketing fines shows how that word has been used against firms that paid someone else to press send.

Before a gambling promotion goes out by text

A short pass, in the order the rules come up:

• Does every number on the list have consent you can evidence, given in wording that mentions texts? (PECR regulation 22, LCCP 5.1.11.)
• For online casino, bingo and betting, has each recipient opted in to this product and to SMS? (LCCP 5.1.12, since 1 May 2025.)
• Has the list been screened against your self-exclusion records today, including GAMSTOP registrations, with no manual workaround anywhere in the process? (LCCP 3.5.3.)
• Does the offer sit within one product, with wagering of no more than 10 times and the full terms one tap away? (LCCP 5.1.1, since 19 January 2026.)
• Does the text carry a free way to opt out, and will an opt-out take effect as soon as practicable? (LCCP 5.1.11, PECR regulation 23.)
• If an affiliate is sending, do you know which list it's using and where that list came from?

The Commission's guidance also asks for the same care with customers whose self-exclusion has expired but who haven't yet made "a positive decision to return to gambling". Those numbers stay off the marketing list until the customer has actively come back.