Self-exclusion & GAMSTOP breaches

Why self-exclusion breaches are taken so seriously

Self-exclusion is not a customer service promise. It is a binding regulatory mechanism, and an act of profound personal vulnerability. When a customer self-excludes, they are explicitly telling the operator: I cannot stop myself. I am asking you to stop me. That is why a self-exclusion breach is treated, in regulatory and tort terms, as one of the most serious failures an operator can commit. The customer has identified themselves as vulnerable. The operator has been put on direct, explicit notice. Every loss after that point is, by definition, foreseeable.

How GAMSTOP works

GAMSTOP is a free, centralised self-exclusion scheme. A registered customer chooses a minimum exclusion period (six months, one year, or five years). Every UK-licensed online operator is technically integrated with GAMSTOP — when a registered customer attempts to open or use an account, the operator is supposed to detect the registration and block access. Where breaches occur, they almost always reflect operator failures of process, identifier-matching, or post-sign-up enforcement — not a defect in GAMSTOP itself.

The most common breach patterns

Re-opened accounts

A customer self-excludes, then — often months or years later — the operator allows the same account to be reactivated, sometimes after a marketing email saying "we miss you". The cleanest and most-litigated pattern.

Duplicate sign-ups

A customer self-excludes, then opens a new account with a slightly different email or name variant. The operator's systems are required to match across multiple identifiers — date of birth, address, payment card, device fingerprint, IP. Where they fail to do so, the breach is on the operator.

Marketing during exclusion

Operators are required to suppress marketing to excluded customers across all channels. Continued marketing — particularly the "we miss you" / "come back" type — is a direct breach.

Cross-brand failures

Many UK operators run multiple brands within a single licence group. Self-exclusion at one brand should propagate across the group. When it doesn't, every account opened at a sister brand is evidence of a systemic breach.

Building the evidence

Self-exclusion breach claims are evidence-rich. We obtain the GAMSTOP registration record, the operator's account file, the operator's marketing logs during the exclusion period, and (where relevant) the operator's identifier-matching framework documentation. The pattern is almost always damning. Operators rarely contest the facts of a clean GAMSTOP breach — the negotiation moves quickly to quantum.

What you can recover

Compensation typically includes: net deposited losses from the date of the breach; interest, typically compounded; enhanced general damages reflecting the gravity of harming a customer who had explicitly identified themselves as vulnerable; special damages for lost earnings, debt-recovery costs and treatment costs; and aggravated damages in cases of repeated breaches or operator concealment.

The US position

Most US states with legal sports betting operate a state self-exclusion list. Operators are required to enforce those lists, and breaches generate claims under state consumer-protection statutes plus negligence. The substantive analysis closely mirrors the UK position.

What to do today

Take our 60-second free claim check. If you are in crisis, please call Samaritans 116 123 (UK) or 988 (US).