New Jersey Makes Player-Risk Monitoring Mandatory for Online Casinos and Sportsbooks

New Jersey has made data-driven player-risk monitoring mandatory for every online casino and sportsbook licensed by its Division of Gaming Enforcement (DGE). Operators must flag accounts that hit set thresholds, review them, keep a list of players at risk and work through three stages of intervention, ending with a live conversation and, if needed, account closure. A flag is not a diagnosis: the rule requires a review of the player's circumstances first.

Attorney General Jennifer Davenport and DGE interim director Mary Jo Flaherty announced the rules on 20 October 2026, now codified at N.J.A.C. 13:69O-1.2. The Attorney General's office calls New Jersey the first state in the nation to impose mandatory data-driven responsible gaming requirements. The DGE first proposed them in September 2025, turning practices that operators had been asked to follow voluntarily into binding obligations.

"Creating clear consistent criteria for identifying problem gambling means every operator follows the same rules," Davenport said at the press conference, adding that "ads are everywhere" and people "can gamble anywhere."

The rules apply to online operators only, not to Atlantic City's land-based casino floors.

The rules at a glance

The ten triggers

Any of these requires a due diligence review:

1. Deposits of more than $10,000 in 24 hours.
2. Deposits of more than $100,000 in 90 days.
3. Opening the self-exclusion page three or more times in 30 days without completing it.
4. Asking for a second cool-off within 45 days of the first ending. (A cool-off lasts at least 72 hours and cannot be reversed.)
5. Three consecutive increases to responsible gaming limits, with no decrease, within seven days.
6. Cancelling withdrawal requests three times in 10 days.
7. Account turnover of more than $1,000,000 in 90 days.
8. A 50% or greater increase in weekly login time compared with the previous two weeks.
9. Two or more sessions in one week ending with less than $1.00 in the account.
10. Two or more sessions in one week ending with more wagers than the session before.

Operators can add their own triggers, and the DGE can add, change or remove criteria by rulemaking or a Director's Order.

The DGE stresses the limit of all this. "A trigger doesn't automatically mean that someone has a gambling problem," said Jamie McKelvey, the Division's responsible gaming coordinator. The rule itself says no single trigger is necessarily determinative, and operators may weigh all the information they hold. A wealthy customer depositing heavily is a reason to look, not a conclusion.

Reviews that clear a player still leave a record: operators must keep that documentation for five years.

Three phases, ending with a human

Once a review finds signs of potential problem gaming, the player goes on the at-risk list and into the intervention process. Operators can start at a later phase if the facts warrant it, and must escalate for severe risk.

Phase 1: information. An email to the player's verified address, or another DGE-approved channel, setting out responsible gaming features (deposit, loss and time limits, cool-offs, self-exclusion) and where to get help.

Phase 2: a mandatory video. The player must watch a DGE-approved responsible gaming video, with sound and pictures, before placing another wager. The operator must record that the player watched it in full.

Phase 3: live contact. The responsible gaming lead, trained staff or an approved designee must reach the player live, by phone or video. Beyond the first outreach, the conversation has to be with a person, not a chatbot. The player must be given contact details for a responsible gaming professional and for the lead. If there is a risk of harm, staff may refer the player to emergency, mental health or law enforcement services.

If the player cannot be reached, the operator tries three times, at least 24 hours apart, leaving a message each time. After three failures it emails the player and suspends the account until live contact happens. If the player is still considered at risk after Phase 3, the account is closed and the player is referred to problem gambling resources.

A player can come off the list after 180 days without a trigger, if a review finds no signs of problem gaming.

The end of VIP offers to at-risk players

The clause with the biggest commercial impact is short. Players in Phase 2 or Phase 3 may not receive direct advertising, including marketing, promotions, event invitations or complimentary items.

Davenport said her office is aware of reports of aggressive marketing to customers showing signs of harm. The most prominent is a lawsuit reported by The Philadelphia Inquirer in July, in which a FanDuel VIP bettor alleges the operator cultivated his addiction, including with a personalized video from MLB star Bryce Harper. The claims are unproven, but the rule closes off exactly that kind of outreach once a player is flagged.

In practice, the at-risk flag has to reach CRM, VIP hosts, affiliate campaigns and automated promotions in real time. A flag that sits in a compliance spreadsheet while the marketing engine keeps sending bonus offers is now a breach. The withdrawal rule works the same way: a player who asks to cash out cannot reverse it for three days, and the operator may not ask them to.

New Jersey's DGE already enforces self-exclusion strictly; it fined Super Group's US business $112,000 for self-exclusion failures in 2025. The new rule extends that scrutiny from players who ask for help to players who show signs they may need it.

What operators and suppliers need to build

The rule binds licensed operators, but much of the work lands on platform providers, player account management systems and CRM vendors. A practical checklist:

1. Map each of the ten triggers to real data fields, across every brand and product.
2. Appoint the responsible gaming lead and document their authority.
3. Build one due diligence workflow that records each decision and why.
4. Implement Phase 1 emails, the Phase 2 video gate with proof of viewing, and Phase 3 contact scheduling and logging.
5. Suppress all direct marketing to Phase 2 and 3 players across CRM, VIP and affiliate channels.
6. Lock withdrawals against cancellation for three days and remove any prompts to reverse them.
7. Automate account suspension after three failed contact attempts, and closure after a failed Phase 3.
8. Test data latency: a trigger seen a day late can mean an offer sent to a flagged player.
9. Train VIP, CRM, support, fraud and compliance staff on the same process.
10. Keep five years of records, and be ready to hand the at-risk list to the DGE on request.

Privacy and false positives

Monitoring this detailed raises fair questions. Blunt systems can flag ordinary high-value play and add friction for customers who are fine. The rule's answer is the due diligence step and the 180-day route off the list. Operators that document why a player was flagged, which phase was chosen and when the case will be reviewed will be in the strongest position, both with the DGE and with customers.

Other regulators have faced the same balance. In Britain, the Gambling Commission's financial risk assessments remain controversial, and MPs have pressed the regulator to publish the evidence behind them. Ontario took a player-led route with BetGuard, a one-click lockout across all licensed sites. In Europe, Romania's ONJN has tightened its self-exclusion measures, and Lithuania is planning a player card for full tracking of play by 2029, still a proposal.

Help for players: RecoverMe

Alongside the rules, the Attorney General and the DGE made RecoverMe, a cognitive behavioral therapy app for people with gambling problems, free for New Jersey residents. It includes validated assessment tools, structured therapy sessions, tracking of gambling habits and New Jersey-specific crisis support. It complements the operator rules; it does not replace them.

The wider US signal

New Jersey has been the reference market for US online gambling since 2013, and other states tend to copy its rules. Colorado already moved on credit cards and aggressive ads, and Maine's draft online casino rules build an automated, cross-operator self-exclusion system in from the start. But New Jersey's rule is state law only; any other state would need its own legal basis.

There is a policy trade-off. Supporters say operators hold the data to spot harm early and should have to act on it. Critics warn that heavy-handed interventions could push some players to unlicensed sites or prediction markets with no protections at all.

That is the other half of the 20 October announcement. Davenport used the same press conference to attack Kalshi, which she said claims to offer legal sports betting in all 50 states without following state gaming laws. New Jersey has asked the U.S. Supreme Court to review the Third Circuit's 2-1 ruling that federal commodities law stops states from regulating sports event contracts. Thirty-nine states, Washington, D.C., 146 tribal nations and organizations, and the NFL back the petition. Prediction markets face none of the new duties, which is why regulators across the country, including in North Carolina and Michigan, are watching them closely.

New Jersey's market is also changing in other ways: it banned sweepstakes casinos and raised gambling taxes in 2025, after the governor proposed a 25% online gambling tax.

The Gamingo view

Data-driven protection is only as good as what happens after the alert. New Jersey has drawn a legal line between noticing a warning sign and helping the person behind the account, and it has put the marketing department on the same side of that line as compliance. For operators, the test is no longer whether they have a responsible gambling policy, but whether their systems can prove they followed it.

Status reviewed on 23 October 2026. This is regulatory news and analysis, not legal advice; operators should work from the adopted rule text and any DGE directions. More regulation news and North America coverage.

Related: Ohio has told its gaming licensees to stop serving prediction markets by 30 October. See Ohio tells gaming licensees to cut ties with prediction markets.