ECA contribution to the Digital Omnibus’ call for evidence (Digital Package on Simplification)

The ECA welcomes the Digital Omnibus initiative as an opportunity to highlight how targeted simplification measures can help fight illegal online gambling across Europe by providing legal clarity, reducing administrative burdens and enhancing consumer protection. Tackling illegal gambling would bring about €20 billion in annual tax revenues in Europe.

Executive summary

The European Casino Association (ECA) welcomes the simplification push of the EU as announced in the Communication on ‘A Simpler and Faster Europe’ and strongly supports its objective to reduce administrative burdens, accelerate decision-making, and create the conditions for sustainable innovation and growth within the European Union.

Particularly, the ECA welcomes the Digital Omnibus call for evidence and takes this opportunity as it allows it to bring the unique characteristics of the national, licensed land-based and online casino industry to the attention of the European Commission. Land-based casinos and their online business extensions are a vital part of Europe’s highly regulated entertainment and tourism sector, operating under strict national licensing frameworks that ensure integrity, consumer protection, and responsible gaming. Meanwhile, illegal operators, especially those operating online, exploit legal gaps to dominate the market, directly threatening fair competition, causing substantial tax losses and preying on vulnerable consumers. Illegal gambling generated approximately €80 billion in untaxed revenues in 2024 alone, representing an estimated €20 billion loss in tax revenues for EU member states. This illicit activity poses significant risks to EU consumers and damages the reputation of the licensed and compliant gaming industry.

This call for evidence is a great opportunity for the ECA to engage with the European Commission and provide clear recommendations, addressing current contradictions, duplicative reporting, and compliance uncertainties stemming from overlapping EU digital regulations – factors that hinder effective consumer protection, disrupt business activities of legal gaming operators and weaken enforcement efforts against illegal gambling operators online. This includes:

1. A clear legal basis on the interaction between the General Data Protection Regulation(GDPR) and the Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) frameworks.
2. The predictability and consistent implementation of theAI Act across the EU.
3. And, effectivedigital legislative frameworkto reduce administrative barriers and enhance consumer protection.

The issue

Since the Covid-19 crisis, most European countries have allowed an accelerated development of online gaming. Legal, licensed land-based casinos expanded to provide services also online and, in doing so, applied to their online casinos the same level of security and safety as their land-based activity, in compliance with national and EU policies and national licenses.

In contrast, a majority of online gaming platforms were already and continue to operate illegally – without valid national licenses, tax contributions, responsible gaming measures, or safeguards against money laundering and terrorist financing. Through regulatory arbitrage, these unlicensed operators exploit gaps between national legal systems, allowing them to operate freely while eroding trust in the regulated sector, ultimately harming legitimate business investment, employment, and market integrity.

Beyond economic damage, the illegal market bypass national and EU-level consumer protections measures, thus presenting a high risk for consumers. For example, illegal operators online rely on advertisements on platforms regulated by the DSA to target mostly vulnerable EU consumers, including self-excluded patrons and underage users, providing no player safeguards or dispute resolution.

These advertisements often involve copyright and trademark infringement, as illegal operators copy the branding of licensed companies to create deceptive campaigns that mimic legal services. These sophisticated practices often misuse (banking) logos, Member State flags, and marketing materials from legal operators, and even fabricate celebrity deepfakes and actively pursue banned individuals through targeting mechanisms to maximise profits while undermining user safety and public trust. A recent study by Yield Sec, commissioned by the ECA, reveals that 92% of all gambling-related content viewed by EU consumers promotes illegal gambling operations.

The societal consequences extend beyond individual harm to encompass broader criminal activities, as these operations serve as conduits for money laundering, terrorist financing, and human trafficking. The interconnected nature of these criminal enterprises demonstrates that illegal gambling represents not merely a regulatory challenge but a fundamental threat to European security and social stability.

This widespread illegal presence creates a significant and unfair disadvantage for licensed operators. The same Yield Sec study found that in 2024, over 71% of Europe's online gambling market is controlled by illegal operators, generating approximately €80.6 billion in revenue – more than twice the €33.6 billion generated by all licensed operators combined. This dominance of the illegal market results in an estimated €20 billion in lost tax revenue for EU countries.

Our recommendations to policymakers

In this context, the ECA calls for the following key measures to be included by the European Commission in the Digital Omnibus in order to, on one hand, encourage consumers to choose safe, legitimate services over illegal alternatives, and on the other hand, to allow casinos – both offline and online – to flourish in their business operations.

1. Resolving conflict between GDPR and AML-CFT obligations

The objectives for Digital Omnibus are to reduce compliance costs for businesses across all sectors and to align the general rules on the protection of personal data under the EU data protection law.

While recalling that data used in the Anti-Money Laundering and Terrorist Financing obligations (AML/CFT)context are personal data and that the Court of Justice^[1] and the AML Regulation 2024/1624 (recital 151) provided guidance on the interaction between General Data Protection Regulation (GDPR) and AML obligations, the ECA stresses the continued fundamental tension faced by land-based operators between the data-intensive demands of AML compliance and the restrictive framework of the GDPR. As a result, the current situation reflects a conflict between risk-based AML policies, the need to comply with both AML and GDPR obligations, and the ongoing need for case-by-case negotiations with national regulators.

Therefore, the ECA calls for legal certainty between the balance of strict record keeping or reporting obligations and robust data protection safeguards, which can be effectively met with clear rules on data protection and better coordination between AML and data protection authorities.

2. Maximising clarity and effectiveness of the AI Act

A specific objective of Digital Omnibus is to ensure a predictable and effective application of the Artificial Intelligence (AI) Act, as well as minimise costs for businesses that need to report cybersecurity and data-related incidents.

The ECA welcomes the AI Act as the first comprehensive policy framework for AI – and specifically its risk-based approach to AI systems. In addition, the ECA also strongly supports the review of the Cybersecurity Act to better implement the cybersecurity framework and make it “more user and business friendly”. The ECA members are committed to complying with the AI Act obligations, including reporting and documentation and recognise the potential of AI to strengthen responsible gaming, fraud prevention and customer service, while safeguarding fundamental rights.

However, the effectiveness of the AI Act depends on its predictable and consistent application across the Union. For that, the ECA calls on the European Commission to ensure:

1. Clearguidanceon how the AI Act interacts with existing frameworks (AML regulation, consumer protection, data protection and cybersecurity);
2. An effective risk-based approachthat differentiates between AI tools that support compliance and entertainment services, and those that pose systemic risks – for example, by applying simplified conformity assessments to lower-risk AI applications used in regulated land-based casinos.
3. consistent supervision and interpretation of the AI Act across Member Statesto avoid market fragmentation and prevent competitive imbalances between national markets;
4. competitiveness and innovation by allowing regulated operators to develop and test AI-driven solutions responsibly, without disproportionate compliance burdens, and supporting digital advancement in a secure and controlled environment.

3. Digital tools to break down administrative barriers and protect consumers

Finally, the Digital Omnibus aims to ensure that effective digital solutions, such as the European Digital Identity Wallets, are available to cut bureaucratic hurdles. The ECA welcomes the development of a European Digital Identity Framework, as well as the Commission’s guidance on Article 28 of the Digital Services Act (DSA), the Guidelines for the Protection of Minors Online, and the introduction of age verification tools.

The ECA recalls that gambling carries specific risks for consumers online – especially minors – and reaffirms its commitment to ensuring that access to gambling content fully aligns with EU digital rules. However, the effectiveness of tools like the European Digital Identity Wallets and broader protections for minors will only be achieved if strict standards are enforced, and those operators who breach them should be shut down immediately as they are a threat to consumers.

In this context, illegal operators represent a serious and ongoing threat. Therefore, the ECA calls on the European Commission to ensure:

1. EU digital rules governing access to age-restricted content, such as gambling, are enforced uniformly across all online operators, taking into account the different legal age limits set by each Member State. It is essential that age limits are also respected in the online environment, and that action is taken against those who ignore them and undermine both consumer protection and the integrity of the internal market.
2. the upcoming Digital Fairness Act (DFA) strengthen the EU digital rules established in the DSA, ensuring they are not weakened in the Omnibus. Enhanced cooperation between Europol, national regulatory authorities, and digital platform providers is essential, along with criminal prosecution of illegal operators engaged in unlawful gambling, intellectual property theft, and consumer fraud. These measures are crucial for effectively combating illegal online gambling operators.

^[1] ECJ judgment of 17 November 2022, Rodl & Partner, C-562/20, paras 73-76 ; ECJ judgement of 22 November 2022, Luxembourg Business Register I, C-37/20, para 53.