Casino apps and your personal data

What personal data casino apps collect

A shopping app can work with an email address and a card. A real-money casino app can’t, because a licensed operator has legal duties to check your age and identity, monitor for money laundering and look out for signs of gambling harm. The data it holds falls into six broad groups.

Most of this sits on the operator’s servers, not on your phone. The app is a window onto the same account as the website, so deleting the app removes almost nothing from the casino’s records. Our page on whether deleting a casino app closes your account covers that in more detail.

Why a licensed casino needs so much information

Much of the data collection is required rather than optional, which is why a casino can’t simply let you skip it.

• Age and identity. The Gambling Commission requires operators to verify age and identity before you can deposit or play, including free demo games. That is the KYC (know your customer) step, explained in our verification guide.
• Anti-money laundering. The Money Laundering Regulations require casinos to understand their customers and, in some cases, ask where money comes from. The page on source of funds checks explains when that happens.
• Safer gambling. Operators must monitor play for signs of harm and, since 2024, run financial vulnerability checks at set deposit levels; see affordability checks on casino apps.
• Self-exclusion. Operators check new and existing customers against the GAMSTOP register, which means sharing identifying details with it.
• Payments. Banks, card schemes and e-wallets need account details to move money, and UK rules require withdrawals to go back to the method you paid in with where possible.

Other uses rely on your consent, mainly direct marketing and some advertising tracking. Those you can refuse without affecting your account, as our guide to casino app marketing preferences explains.

Who else sees your casino app data

A casino’s privacy notice lists the categories of organisation it shares data with. The usual ones are:

• Identity verification services and credit reference agencies, which confirm your name, address and age.
• Payment processors, banks and e-wallet providers that handle deposits and withdrawals.
• Game studios and live casino providers, which normally receive a player reference rather than your name so they can run and record each round.
• GAMSTOP, the Gambling Commission, the police and other authorities when the law requires it.
• Companies in the same group, if the brand is one of several run by one operator.
• Analytics, advertising and marketing services, often subject to your consent.
• Affiliate websites. Sites that are paid commission for introducing customers, including this one, rely on tracking links; our advertiser disclosure explains how we are funded.

The privacy notice is usually linked from the app’s footer, settings or sign-up screen. Search the notice for ‘share’, ‘third parties’ and ‘retention’ to find the parts that matter most.

Reading privacy labels on the App Store and Google Play

Before installing, you can see a summary of an app’s data practices. Apple shows an App Privacy section on each App Store listing, divided into data used to track you, data linked to you and data not linked to you. Google Play shows a Data safety section covering what is collected, what is shared, whether data is encrypted in transit and whether you can ask for it to be deleted. Both are written by the developer, so they are a declaration rather than an audit.

The labels on our partners’ iOS apps show how much practice varies, even between licensed operators:

‘Tracking’ in Apple’s sense means linking data from the app with data from other companies’ apps or websites for advertising, or sharing it with data brokers. Since iOS 14.5, an app must ask your permission before tracking you this way. The rest of a listing is worth a look too, especially the developer name, which should match the licensed operator.

Phone permissions and what they reveal

Account data and phone permissions are different things. Account data is what you give the casino. Permissions decide what the app can read from the phone itself, and you control them in the phone’s settings.

PlayOJO’s iOS listing, for instance, states that the app may use your location even when it isn’t open. If an app asks for ‘Always’ location, you can usually choose ‘While Using the App’ instead and see whether everything still works. The full list, with what each one means, is in casino app permissions explained.

Face ID, Touch ID and Android fingerprint data never go to the casino. The phone stores your biometric template securely on the device and tells the app only whether the check succeeded.

Your data rights with a UK casino app

UK GDPR gives you several rights over the data a casino holds. Some are limited by the casino’s legal duties, so it helps to know what to expect.

How to request your data from a casino app

A subject access request is the formal way to see what a casino holds about you, including play records, notes from customer contacts and the results of checks.

1. Find the operator’s privacy notice in the app and note the contact address for data protection requests.
2. Write to that address, or ask through live chat, saying you are making a subject access request under UK GDPR.
3. Give the email address and name on the account so the casino can match your request. Expect it to confirm your identity before releasing data.
4. Say if you want specific information, such as transaction history for a date range or records of safer gambling interactions.
5. Keep a note of the date. The casino normally has one month to respond, which can be extended by up to two further months for complex requests, in which case it must tell you.

What a typical response contains, and how to read it, is covered in the separate walkthrough on getting a copy of your casino data.

How long casinos keep your data after you leave

Closing an account doesn’t erase it. Anti-money laundering law generally requires firms to keep customer due diligence and transaction records for five years after the relationship ends, and operators may keep some information longer to handle complaints, legal claims or self-exclusion. Self-exclusion details in particular must be kept so the casino can stop you reopening an account during the exclusion period.

What you can ask for is that data not needed for those purposes is deleted, and that marketing stops. The privacy notice should state retention periods or the criteria used. If you want to leave a casino entirely, our guide to closing a casino app account explains the steps and how closure differs from self-exclusion.

Practical ways to share less from your phone

1. Install only from the official App Store or Google Play listing and check the developer matches the licensed operator.
2. On iPhone, go to Settings > Privacy & Security > Tracking and leave Allow Apps to Request to Track off, or refuse the request when the app asks.
3. On Android, open Settings > Privacy (or Settings > Google) > Ads and delete or reset the advertising ID, depending on your Android version.
4. Set location access to While Using the App, and turn off Precise Location on iPhone if the app works without it.
5. Grant photo access to selected photos only when uploading documents.
6. Switch off marketing by product and channel in the app’s preferences.
7. Review permissions every few months: Settings > Privacy & Security on iPhone, or Settings > Apps > [app] > Permissions on Android.

Keeping data secure and what to do if it goes wrong

Operators must protect your data with suitable security, and most of our partners’ Google Play listings state that data is encrypted in transit. Your part is the account itself: a unique password, two-factor authentication where offered, biometric login, and care on shared or public networks. See keeping your casino account secure for the full checklist.

If you think a casino has mishandled your data, refused a valid request or missed the deadline, complain to the operator first and keep copies of what you send. If that doesn’t resolve it, you can complain to the Information Commissioner’s Office, which regulates data protection in the UK. Disputes about bets, bonuses or withdrawals go through the casino’s complaints process and an approved dispute resolution service instead.

18+. Gambling should be entertainment that costs money, not a way to make it. Set a deposit limit before you play: how to set limits. Free, confidential help: National Gambling Helpline 0808 8020 133.