Top Privacy Challenges in iGaming M&A

When iGaming companies merge or get acquired, player databases become a critical focus. These databases contain sensitive information like payment details, betting habits, and geolocation data, making them highly attractive to cybercriminals. Mishandling this data can lead to massive fines, reputational harm, and even reduced deal valuations. For example, Verizon cut Yahoo’s acquisition price by $350 million after discovering data breaches.

Here's what you need to know:

• Regulations are complex: Privacy laws like GDPR, Quebec's Law 25, and the U.S.'s patchwork of state laws require careful navigation.
• Cross-border data transfers: GDPR applies globally if European player data is involved, with strict rules for international transfers.
• Data breaches are costly: Cyberattacks on iGaming platforms have surged by 400% since 2025, exposing vulnerabilities in legacy systems.
• Vendor risks: Third-party services for payments, KYC, and analytics can introduce security gaps.
• Due diligence is key: Early privacy audits, risk assessments, and clear data-sharing agreements can prevent costly mistakes.

To succeed, companies should prioritize privacy compliance at every stage of the deal, from due diligence to post-merger integration. Failing to do so can mean millions in fines or lost trust from players.

Compliance & Data Privacy in Gaming: Insights from Adriana Minovic | SiGMA Podcast

GDPR and Global Privacy Compliance

The General Data Protection Regulation (GDPR) impacts iGaming deals worldwide, not just in Europe. If your transaction involves player databases containing data from users in the European Economic Area (EEA), GDPR applies - regardless of where your company is based. This means even a U.S.-based operator acquiring a Malta-licensed casino must comply with GDPR if the casino serves European players [6][7].

In May 2023, Meta faced a €1.2 billion fine for transferring EU data to the U.S. without sufficient safeguards. Similarly, TikTok received a €530 million fine in May 2025 for related violations [5]. These examples highlight how seriously regulators enforce cross-border data rules - and iGaming companies are no exception.

How GDPR Applies Beyond EU Borders

Under GDPR, any transfer, access, or storage of player data outside the EEA is considered a cross-border transfer. For instance, if a U.S. parent company accesses an EU subsidiary's player database remotely after an acquisition, this qualifies as a transfer [5][6]. To stay compliant, due diligence teams must map all data flows, including those involving third-party tools like analytics platforms, payment systems, and customer support services that might route data internationally.

To legally transfer data, companies typically rely on:

• Adequacy Decisions: For "safe" countries like the UK, Japan, or Brazil.
• Standard Contractual Clauses (SCCs): Often paired with Transfer Impact Assessments.
• Binding Corporate Rules (BCRs): Used by large multinational groups [5][6].

Currently, only 16 jurisdictions have received adequacy status, with Brazil joining in December 2025 and the UK's status extended through 2031 [5]. For most iGaming mergers and acquisitions, SCCs remain the go-to solution, but they require a Data Transfer Impact Assessment (DTIA) to ensure the receiving country has sufficient legal safeguards against unauthorized data access [6].

Adding to the complexity, responsible gambling data is now classified as "Special Category Data" under GDPR's Article 9 [7]. This includes behavioral indicators, self-exclusion records, and signs of problem gambling. Such data requires stricter processing safeguards, and companies cannot delete these records upon a player's request if regulatory obligations mandate retention during active exclusions [7].

These rules illustrate the intricate challenges of navigating global privacy laws.

Managing Multiple Privacy Laws Across Jurisdictions

GDPR is just one piece of the privacy law puzzle. Around 144 countries (79% globally) have enacted data protection laws [9], many of which conflict with one another. For example:

• China's Personal Information Protection Law (PIPL) doesn't allow "legitimate interest" as a legal basis for processing, unlike GDPR. This forces companies to rely on consent or contractual necessity for analytics and marketing [9].
• Brazil's LGPD has a stricter 15-day response period for data subject requests, compared to GDPR's 30 days [9].

In the U.S., the absence of a federal privacy law has led to a patchwork of state regulations. Roughly 20 states, including Indiana, Kentucky, and Rhode Island, have enacted their own privacy frameworks [9]. California's CCPA, for instance, has unique rules for handling user data and defines what constitutes a "sale" of information. For iGaming companies operating across multiple states, this means juggling different compliance protocols.

Here’s a quick look at key transfer mechanisms and their requirements for M&A deals:

Transfer Mechanism	Best Use Case in M&A	Key Requirement
Adequacy Decision	Transfers to "safe" countries (e.g., UK, Japan, Brazil)	Regular monitoring of Commission updates [5]
SCCs (Standard Contractual Clauses)	Common for mid-market iGaming deals	Requires a Transfer Impact Assessment (TIA) [5][6]
BCRs (Binding Corporate Rules)	Large multinational iGaming groups	Needs approval from a lead Supervisory Authority [5]
Article 49 Derogations	One-off, non-routine transfers	Explicit, informed consent from players [5][6]

Data localization adds another layer of complexity. Over 100 countries now require that certain data remain physically within their borders [8]. iGaming regulations often demand that critical gaming data - like transaction histories, player logs, and betting patterns - be accessible to local regulators. For instance, Germany's Interstate Gambling Treaty (GlüStV 2021) mandates technical infrastructure to ensure regulatory access [8]. Similarly, the UK Gambling Commission and Malta Gaming Authority enforce strict data accessibility standards, even without explicit localization laws [8].

A 2022 data breach at a Singapore-based online marketplace shows why centralized systems don't eliminate local compliance responsibilities. The breach affected millions of users, including 324,000 in Hong Kong. Despite centralized infrastructure in Singapore, both Singapore's Personal Data Protection Commission and Hong Kong's Privacy Commissioner conducted separate investigations. Penalties included a S$58,000 fine in Singapore and an enforcement notice in Hong Kong [10].

To address these challenges, companies should map all data flows before finalizing a deal. Identify what data is collected, where it's stored, and how it moves across borders [10][11]. Techniques like database sharding or partitioning can help ensure EEA player data stays within the EU, while non-sensitive data can circulate globally [8]. If the deal involves a U.S. entity, check its certification on the Data Privacy Framework website - but keep SCCs as a backup, especially given recent uncertainties following the dismissal of Privacy and Civil Liberties Oversight Board members in early 2025 [5].

Data Breaches and Security Risks in M&A

iGaming platforms store vast amounts of sensitive data, making them prime targets for cyberattacks [2]. A successful breach can expose complete digital profiles of hundreds of thousands of players. Since February 2025, cyber incidents targeting online and land-based casino operators have increased by a staggering 400% [2]. This rise, coinciding with a surge in M&A activity, highlights the vulnerabilities in legacy systems and third-party integrations that often accompany such deals [2].

Take the Marriott/Starwood case as an example: pre-existing security flaws came to light after the acquisition. In September 2022, the Office of the Privacy Commissioner of Canada held Marriott accountable for Starwood’s prior security shortcomings [1]. Under Quebec's Law 25, penalties for such failures can reach $25 million or 4% of global turnover [1]. This underscores the importance of identifying and addressing security risks during the merger process.

Common Data Breach Vulnerabilities During M&A

While larger operators may have robust cybersecurity measures, smaller companies often see it as an afterthought [2]. During M&A, this creates a patchwork of outdated systems, leaving no single team with a complete understanding of the attack surface [2].

Third-party dependencies are a major weak point. Common issues include overprivileged API keys, insecure sharing of KYC documents, and insufficient webhook validation [2]. For instance, in 2024, a breach at The Mill Adventure - a platform provider - exposed data from roughly 800,000 players across Merkur's online portfolio in Germany. Ethical hacker Lilith Whittman exploited a vulnerability linked to third-party dependencies, showing how interconnected platforms can jeopardize entire networks [2].

"In many cases, attackers do not need to break in; they simply log in."

This quote from Kuehl highlights a growing trend: attackers often exploit valid credentials rather than hacking systems [2]. Credential stuffing attacks have become particularly dangerous, where stolen login details are tested on a massive scale using patterns designed to evade anti-fraud measures [2]. The longer a breach goes undetected, the more time attackers have to escalate privileges and embed themselves within systems [2].

To reduce these risks, isolate acquired systems from your network until thorough risk assessments and penetration tests are complete [1]. Behavioral analytics can help detect unusual activity, as attackers often exhibit patterns that differ from legitimate users [2]. Enforcing least-privilege access policies for internal teams and third-party vendors is essential - access should be limited to only what’s absolutely necessary [2]. Financial safeguards like purchase price adjustments or indemnity escrows can also cover remediation costs or potential regulatory fines [1].

Beyond these common vulnerabilities, threats like DDoS attacks and AI-driven cyberattacks present additional challenges.

Protecting Against DDoS Attacks and Cyber Threats

AI-driven attacks are redefining cybersecurity challenges. These autonomous systems can identify and exploit vulnerabilities without human intervention, making sophisticated attacks faster and cheaper to execute [2]. As Kuehl points out:

"AI does not compensate for weak foundational data practices; it amplifies them."

This means that outdated encryption, weak authentication protocols, or poorly configured APIs become even more dangerous during M&A integrations [2].

To combat these risks, implement multi-factor authentication (MFA) and encrypt player data both at rest and in transit using industry-standard protocols [2][13]. Between May 2018 and October 2023, over 1,878 GDPR-related fines were issued, totaling more than €4.4 billion [13]. Non-compliance can lead to fines of up to €20 million or 4% of global annual revenue [13].

Continuous monitoring is more effective than periodic audits. Regularly assess web services, APIs, and underlying frameworks to identify vulnerabilities before they can be exploited during integration [2]. Review the target company’s cyber liability insurance, focusing on coverage limits and whether specific attacks like DDoS are included [13]. Under GDPR, any security incidents must be reported to supervisory authorities within 72 hours [13], so ensure your response plan accounts for newly acquired systems as well.

Third-Party Vendor and Data Processing Challenges

When iGaming companies merge, they often inherit a web of third-party vendors, which can sometimes introduce privacy risks [14]. Vendors like payment processors, KYC verification services, game providers, and platform operators handle sensitive player data. Each of these relationships could potentially weaken the overall data protection framework. This makes it essential to scrutinize vendor contracts and data controller responsibilities during mergers and acquisitions (M&A).

Reviewing Vendor Data Privacy Practices

Start evaluating vendors before accessing the data room. Look into the target company’s public records - its website disclosures, any reported data breaches, and privacy-related lawsuits. These sources can help identify potential issues early on [3].

Once due diligence begins, examine all third-party contracts for key elements like cybersecurity clauses, data governance protocols, and audit rights. Smaller iGaming operators often treat cybersecurity as a formality rather than a priority, which can lead to agreements that lack even basic safeguards. Common technical weaknesses include overprivileged API keys, insecure methods for sharing KYC documents, and inadequate webhook validation [2].

A notable example is the 2024 breach at The Mill Adventure, a platform provider for Merkur’s online portfolio in Germany. This incident exposed data from around 800,000 players, highlighting how third-party vulnerabilities can have widespread consequences [2]. Esther Arokun from Seattle University School of Law explains:

"As companies consolidate, they inherit not only assets and liabilities but also vendor relationships that may introduce privacy vulnerabilities." [14]

To mitigate these risks, assess vendor agreements before integration. Ensure that Data Processing Agreements (DPAs) are up-to-date and comply with frameworks like GDPR, CCPA, and others [14]. For instance, under the UK GDPR, you need to confirm the original purpose for which player data was collected, determine the lawful basis for sharing it with a new controller, and plan how to notify players - who may have the right to object [15]. This targeted review complements broader M&A due diligence efforts aimed at maintaining compliance and protecting data security.

Data Controller Responsibilities in M&A Transactions

Beyond vendor evaluations, clearly defined data controller responsibilities are critical for safeguarding the merged entity’s data environment. Even in cases of restructuring or insolvency, the data controller must ensure that data transfers are lawful, fair, and transparent [15]. The Information Commissioner’s Office emphasizes:

"You must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations." [15]

Purchasers are responsible for the acquired company’s network security from day one - or ideally, even before integration begins [12]. Under Quebec’s Law 25, penalties for privacy violations can reach $25 million or 4% of global turnover [12]. Financial tools like purchase price adjustments, holdbacks, or indemnity escrows can help cover potential costs stemming from regulatory fines or remediation efforts [12].

To protect data, enforce least-privilege access principles for all vendors. Only give third-party providers access to the specific data they need to perform their functions. Merging IT systems can increase risks of data loss, corruption, or degradation [15], so consulting with technical experts is essential. Once the merger is complete, audit shared data to ensure its accuracy during the integration process [15].

Involve privacy specialists early in the deal-making process, ensuring they understand the deal’s objectives and post-acquisition plans [3]. As Liisa M. Thomas and Snehal Desai from Sheppard, Mullin, Richter & Hampton LLP point out:

"Often when privacy 'specialists' are brought into deals, it is without a clear understanding of the goal of the deal and post-acquisition plans. Keeping these in mind can be crucial to conducting appropriate and risk-based diligence." [3]

After the transaction, standardize data retention policies across all integrated records to maintain accountability [15]. Streamline cybersecurity tools and data protection platforms - such as those used for consent management and data subject access requests (DSARs) - to create a unified compliance framework. Consider implementing Governance, Risk, and Compliance (GRC) software to map regulatory obligations to business processes across multiple jurisdictions [2].

Cross-Border Data Transfers and Integration Risks

Transferring player databases across international borders during an iGaming merger brings both legal and technical hurdles. Centralizing data doesn’t eliminate the need for local entities to comply with their respective privacy laws. These complexities demand careful attention to the legal and technical measures outlined below.

Legal Requirements for Cross-Border Data Transfers

Under GDPR, data transfers to countries lacking an "adequacy decision" require safeguards like Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) [10]. Similarly, China’s Personal Information Protection Law (PIPL) mandates a security assessment by the Cyberspace Administration of China or specific certifications for large-scale transfers. Non-compliance could lead to penalties of up to RMB 50 million or 5% of annual revenue [10].

Adding to the challenge, several jurisdictions enforce data localization laws, requiring certain data to remain within their borders. Regulatory bodies such as the Malta Gaming Authority and the UK Gambling Commission also demand that critical gaming data remain accessible from local infrastructure [8].

Privacy policies must clearly disclose all recipients of player data. For example, in January 2026, the Lithuanian Data Protection Authority fined an online gambling operator for transferring player data to a service provider for event invitations without properly notifying users. The regulator ruled that players couldn’t reasonably expect their data to be used for purposes beyond core gambling services [16]. Catalin Veliscu from WH Partners explains:

"Players generally expect their data to be used for gaming services, account management, regulatory compliance, etc., and not for ancillary activities which were not properly notified to them." [16]

In Canada, PIPEDA allows personal information to be shared without consent during due diligence, provided a formal agreement ensures the data is used solely for the transaction and protected with specific measures [12]. Additionally, non-disclosure agreements should be executed before sharing any player data [12].

Reducing Post-Merger Integration Risks

Merging different data systems introduces unique challenges, particularly across borders. The Marriott-Starwood case serves as a cautionary tale. A breach originating in Starwood’s systems before the acquisition went undetected for years, ultimately compromising 339 million records. The Office of the Privacy Commissioner of Canada held Marriott accountable for vulnerabilities inherited from the acquired entity [12]. The Office emphasized:

"When acquiring systems or databases that handle personal information, organizations should ensure appropriate security safeguards, early - ideally before taking control, and certainly before integrating data into existing systems." [12]

To mitigate risks, isolate the acquired company’s systems from your network until a thorough risk assessment is complete. Conduct penetration testing, vulnerability scans, and security audits on the target’s databases before merging them with your infrastructure [12]. Quebec’s Law 25 imposes administrative penalties of up to $10 million or 2% of worldwide turnover, with serious offenses carrying fines as high as $25 million or 4% of worldwide turnover [12]. Jasmine Samra from Gowling WLG stresses:

"In today’s environment, privacy is not a box to check - it is a material risk that must be proactively assessed and addressed." [12]

Additionally, update the acquired company’s privacy policies, consent frameworks, and data retention schedules to align with both your internal standards and local regulations. Review vendor agreements to ensure cross-border transfer permissions comply with the new ownership structure. Finally, conduct tabletop exercises to test your combined incident response plan, preparing for potential post-merger breaches [12]. Handling these challenges effectively is essential for safeguarding player data and maintaining compliance throughout the merger process.

M&A Due Diligence and Privacy Audits

Privacy due diligence in iGaming mergers and acquisitions (M&A) is a critical factor that can either secure a deal or lead to major setbacks, including hefty financial penalties. A well-known pre-merger breach - caused by undetected vulnerabilities lingering for years - highlights the importance of thorough privacy testing before integrating systems [12]. This example underscores why privacy audits should never be overlooked in M&A processes.

Running Privacy Audits Before the Merger

Start privacy audits early - before accessing the data room. Begin by examining the target company’s website disclosures, public statements on data practices, and any media coverage about breaches or privacy-related lawsuits. These steps can help identify potential risks. Liisa M. Thomas and Snehal Desai from Sheppard, Mullin, Richter & Hampton LLP emphasize:

"Often when privacy 'specialists' are brought into deals, it is without a clear understanding of the goal of the deal and post-acquisition plans" [3].

Understanding whether the target will be fully integrated or operate independently is vital for tailoring the scope of your privacy risk evaluation.

Requesting key documents such as Privacy Impact Assessments (PIAs), consent records, and previous audit reports is essential [12]. In the iGaming industry, where player databases and mailing lists are valuable assets, verifying the legitimacy of individual consent records is especially important. For instance, under Quebec's Law 25, administrative penalties can climb to $10 million or 2% of global turnover, while more severe violations can result in fines of $25 million or 4% of global turnover [12]. If significant risks are uncovered, consider adjusting the purchase price, setting up indemnity escrows, or requiring the seller to address the issues as a condition of closing [12].

Post-Transaction Privacy Integration Plans

Once pre-merger audits are completed, having a clear integration plan is critical to ensure ongoing compliance. Privacy and cybersecurity teams should have a seat at the table from the beginning of the integration process. Identify which data sets and workflows will be essential post-merger, and involve key personnel from both companies who are familiar with the data architecture to ensure a smooth transition. As Thomas and Desai point out:

"In many deals, the privacy and cybersecurity team is not involved in the integration process. Or, a different team handles these steps" [3].

Align the acquired company’s privacy policies, consent mechanisms, and data retention protocols with your own standards and applicable regulations. Provide privacy training for employees who will handle sensitive player data [12]. Ensure that any privacy-related concerns and data transfer procedures are clearly outlined in the final deal documents and schedules [3]. Finally, coordinate a seamless hand-off between the due diligence team and the post-merger integration team to prevent any privacy gaps or missteps [3].

Conclusion

Privacy concerns in iGaming mergers and acquisitions (M&A) carry serious risks, including potential deal failures, hefty fines, and damaged player trust. For example, Quebec's Law 25 allows fines of up to $25 million or 4% of annual revenue, while legacy issues, like the Marriott/Starwood data breach, can cause long-term challenges [1]. This makes it essential to address privacy risks proactively at every step of the transaction process.

Achieving success in iGaming M&A requires early involvement of privacy experts, comprehensive pre-merger audits, and carefully planned post-transaction integration strategies. Key steps include verifying consent records, reviewing vendor contracts, and keeping acquired systems separate until thorough security checks are completed. Buyers can also reduce risks by using contractual tools like purchase price adjustments, holdbacks, and specific indemnities.

As the iGaming market surpasses $100 billion globally, operators face mounting pressure to scale up, especially with increasing regulatory costs [4]. In many cases, regulatory licenses hold greater value than the technology or customer base being acquired [4]. Successfully navigating challenges like change-of-control provisions, cross-border data transfer rules, and shifting privacy laws demands a high level of expertise.

For operators navigating this complex landscape, platforms like MyReadyMade offer valuable solutions. They provide verified listings, expert M&A advisory services, and support for license transfers across more than 50 jurisdictions - helping streamline transactions in regulated industries where strong privacy compliance is non-negotiable.

FAQs

Does GDPR apply if my iGaming company is based in the U.S.?

GDPR generally does not impact U.S.-based iGaming companies unless they deal with personal data from individuals located within the European Economic Area (EEA). This could involve activities like processing, storing, or transferring such data as part of their operations or transactions.

What’s the safest way to transfer player data after an acquisition?

Transferring player data securely after an acquisition requires a carefully planned, privacy-focused approach. Key steps include conducting early due diligence to identify and resolve any potential privacy concerns, establishing clear contractual agreements to safeguard data, and implementing thorough post-acquisition compliance measures. These practices not only minimize the risk of privacy violations and legal troubles but also ensure the transition is as seamless as possible.

Which third-party vendors pose the biggest privacy risks in iGaming M&A?

When it comes to iGaming mergers and acquisitions, third-party vendors involved in online tracking and data collection present some of the biggest privacy challenges. These vendors often use services that merge clickstream data with personal details or gather personally identifiable information (PII). This practice can create serious privacy issues, especially during the transfer of player databases.