KVA warns: massive leak of personal data in illegal casinos
•
20 Aug 2025 •
Reading time: 3 minutes A study recently published by the KVA sounds the alarm. Despite the protective measures put in place by the local regulatory authority (Ksa), Dutch players are being targeted by offshore operators. What’s more, their personal data is circulating unchecked in an unregulated digital black market.
How the study was conducted
The KVA’s approach was as simple as it was effective. Anonymous accounts were opened on six illegal platforms (including Booms Bet, Vegas Hero and Tomb Riches) to test their practices. Analysis of the terms and conditions revealed a vital problem: all of them allow unlimited data sharing with third parties, sometimes located outside the European Union, without any guarantee of legal protection. The clause ‘extended and unlimited data sharing with commercial partners’ is thus identified as a major risk for players.
Continuing its investigation, the KVA examined the terms and conditions of these illegal operators. The result? Clauses deemed by the organisation to be ‘unilateral and unreasonable’. Players could find their accounts abruptly closed, their winnings withheld or their withdrawal requests rejected, without justification. Worse still, the absence of an approved gaming system means that the reliability of the results is unknown: the algorithms can be biased at will. This total lack of transparency signals a lack of fair play and fundamental guarantees.
Minors in the spotlight
Could it get any worse? Three of the six operators accept deposits via bank accounts intended for young people (authorised minors), which means that players under the age of 18 could gamble on these platforms. This alarming finding highlights the laxity of offshore operators and the urgent need for effective regulation.
Is the regulatory authority powerless?
In the dock, the national regulatory authority, the KSA, is struggling to defend players. Although it has introduced protective measures, such as deposit limits and a ban on sponsorship, these paradoxically benefit unauthorised operators. Worse still, the latter are slipping through the net. The situation raises a thorny question: have efforts to regulate legal gambling inadvertently facilitated the rise of illegal gambling?
The data speaks for itself. Since the introduction of deposit limits (€700 per month for adults, €300 for 18-25 year olds), traffic to illegal sites has exploded. In October, the study counted 172,576 visits to these operators. In November, the figure rose to 294,255, then climbed to 412,997 in February. At the same time, the number of illegal domains referenced in searches such as ‘casino without Cruks’ rose from 19 in October to 72 in March. The message is therefore clear: every significant protective measure has an unexpected downside.
An underestimated digital drift
This KVA study reveals a worrying paradox. Regulatory efforts to regulate and prevent abuse of legal gambling are inadvertently opening the door to illegal offshore operators. These operators thrive in an environment where data protection does not exist and security mechanisms are absent. The surge in traffic, potential manipulation, access by minors and lack of control highlight the urgent need for a stricter, more comprehensive and, above all, better coordinated approach at European level.