DraftKings AI Advertising Privacy: What to Know

DraftKings is reportedly training a machine learning model on customers' own betting records to find people who are losing money, then sending those people ads designed to pull them back in, according to an EFF analysis of New York Times reporting. This isn't the cookie-based tracking you're used to seeing disclaimers about — it's built from account data DraftKings already has on you, and it raises questions that the standard ad opt-out tools don't answer.

How does DraftKings use AI to target users with ads?

According to EFF's write-up of the New York Times investigation, "DraftKings is using its customers' betting records to train a machine learning model to find losing gamblers. Once found, DraftKings sends these customers targeted advertising designed to lure them back to the site to place more bets—bets that DraftKings thinks will be losing ones."

As reported by Malwarebytes, the system examined bet frequency, loss amounts, and daily account balances, and produced what the Times called an "elasticity" score — a prediction of how much more a given user would lose if sent a promotion. Customers who scored high on that measure were the ones most likely to see targeted offers.

DraftKings has pushed back on this framing, and told the Times its promotions reward engagement rather than losses. But a former employee who worked on the system told the Times its purpose was to maximize return on promotional spending, per Malwarebytes' summary of the reporting. The same reporting notes DraftKings' data scientists separately built a model meant to flag users at risk of a compulsive-gambling crisis — and that the company shut that project down after canceling a demo.

What data does DraftKings collect and share with ad partners?

DraftKings' own privacy notice describes a wide net of first-party collection. It automatically tracks "your browser type, operating system, Internet protocol (IP) address, device identifier, domain name, clickstream data, referring/exist pages, geolocation data, and a date/time stamp for your visits." It also pulls in betting activity through social features — the Oregon version of the same notice says DraftKings "may also collect, and other DraftKings users may be able to see, information about the Games you participate in, including the bets you have made and your betting unit data as shown in your betting feed, along with your aggregated betting data on our trending bets page," according to the Oregon privacy notice.

That data doesn't stay internal. The national notice names specific ad-tech vendors that "may collect information about you and your visits to the Website and Applications and other websites and applications," including "Facebook, FantasyPros, LiveRamp, Reddit, Snapchat, TikTok, The Trade Desk, TruSignal, and Twitter," per the privacy notice. Those vendors can collect IP address, internet service provider, email address, browser information, and "certain commercial information such as records of products or services purchased, obtained, or considered."

The same notice says DraftKings associates activity on other sites and apps with your personal information "in order to evaluate risk and to provide, improve, and customize our Services and the ads delivered on our Website and Applications," and that the information it gathers can include demographic data, online identifiers, purchasing histories, "fraud indicators, and risk scores assessing your ability to complete a transaction," per the privacy notice. Device identifiers and browser data function much like the advertising IDs built into phones — see our explainer on how advertising IDs enable behavioral targeting for how those identifiers link your activity across apps and sites.

How is AI-driven ad targeting different from traditional cookie tracking?

Ordinary ad tracking uses cookies and device IDs to follow you around the web and show you ads based on sites you've visited. What EFF describes goes a step further: a predictive model trained specifically on financial outcomes — bet frequency, loss amounts, account balances — to rank customers by how profitable it would be to re-engage them. EFF calls this a form of "online behavioral advertising, which is when companies personalize the ads they show you based on the data they've collected about you. The more data a company has, the more personalized the ad can be," per EFF's analysis. The difference is scale and opacity: "Because AI operates as a black box, the humans building the models can rarely predict which data points are the most useful to the AI, driving them to continuously collect more data. AI also allows companies to process enormous data sets much faster, and, as a result, supercharges the harms of online behavioral advertising," EFF writes.

EFF also notes that DraftKings "seems to be using solely 'first party data' to target their ads, meaning that they're using only the data they collect directly from their users and are not buying any additional data from third parties to fuel their machine learning model," per EFF's analysis. That detail matters for which rules can actually stop this practice.

Why do privacy advocates say DraftKings' AI targeting is harmful?

EFF's concern centers on who ends up on the receiving end of these ads: "Those considered 'problem gamblers' (people who repeatedly gamble despite harm to themselves, their finances, and their relationships) are highly likely to be targeted by this model. By re-engaging these individuals through targeted promotions aimed at keeping them on the platform, DraftKings is capitalizing on their vulnerability for profit instead of mitigating their risk," EFF writes.

The scale isn't trivial. Malwarebytes cites a World Health Organization estimate that "1.2% of the world's adult population has a gambling disorder, and that people betting at harmful levels generate around 60% of gambling losses" — exactly the population a loss-prediction model would be most effective at finding and marketing to, per the Malwarebytes report.

EFF's conclusion is blunt: "this is why EFF believes that all behavioral advertising should be banned. If companies can't send personalized ads, they'll have less incentive to collect the behavioral data powering them," according to EFF's analysis.

Do existing privacy laws protect me from this kind of first-party targeting?

Mostly not, and the gap is specific. California's Consumer Privacy Act gives residents a "right to opt-out of sale or sharing," meaning you can tell a business to stop selling or sharing your personal information, according to the California Attorney General's CCPA guide. But EFF points out that DraftKings appears to run this entirely on first-party data it collected itself, not data bought from brokers, and argues that "policy solutions that only limit third-party data sharing and selling would not be enough to prevent these predatory advertisements," per EFF's analysis. An opt-out of the sale or sharing of your data doesn't reach a company using your own account history to target you directly.

The CCPA's definition of personal information does technically cover the output of this kind of modeling: it includes "inferences from other personal information that could create a profile about your preferences and characteristics," according to the Attorney General's guidance. California residents also have a "right to know," letting them request "the categories and/or specific pieces of personal information" a business has collected, its sources, purposes, and who it's shared with, up to twice a year for free. Our guide on requesting your data from a company walks through how to file that kind of request. Enforcement, however, is limited: "You cannot sue businesses for most CCPA violations. You can only sue a business under the CCPA if there is a data breach, and even then, only under limited circumstances." In practice, users can see what's being collected, but can't sue DraftKings over the targeting itself.

Gambling-specific rules in some jurisdictions go further than general privacy law. Ontario's Alcohol and Gaming Commission requires that after a player registers for the province's Centralized Self-Exclusion Program, "no later than 24 hours after an individual is added to the Centralized Self-Exclusion Registry," operators must "take all reasonable steps to prevent any marketing material, incentives or promotions from being sent to that individual for as long as they continue to be a Centrally Self-Excluded Person," according to the AGCO bulletin. The program lets players "voluntarily self-exclude from all regulated igaming sites in Ontario through a single registration process," with terms of six months, one year, or five years, and operators must cancel and refund outstanding wagers within 24 hours of registration. A separate Ontario advertising standard states that marketing "shall not target high-risk, underage, Self-Excluded Persons, or Centrally Self-Excluded Persons... to participate in lottery schemes" and "shall not knowingly be communicated or sent to high-risk players." No equivalent nationwide rule exists among the US sources reviewed for this piece, so the strength of your protection currently depends heavily on where you live.

How can I opt out of DraftKings' targeted ads and data sharing?

A few concrete steps, drawn from DraftKings' own privacy notice:

• Use the industry opt-out tools DraftKings points to for its named ad vendors: "If you would like more information about these practices to understand your options for not having your information collected and used by such companies, please click http://www.aboutads.info/choices and https://www.networkadvertising.org/," according to the Oregon privacy notice. These tools let you opt out of interest-based advertising from participating ad companies; they do not necessarily cover every vendor DraftKings names.
• If you're in California, file a CCPA "right to know" request to see what categories of data DraftKings has collected and shared about you, and a "right to opt-out of sale or sharing" request for data it shares with outside vendors, through the process described in the CCPA guide.
• If you're in Ontario, register once with the province's Centralized Self-Exclusion Program to cover every regulated igaming site, choosing a six-month, one-year or five-year term, per the AGCO bulletin.

For a direct request to DraftKings itself: write to DraftKings using the contact details listed in its privacy notice and ask what categories of personal information and inferred risk data the company holds on your account, and that it stop using your betting and transaction history for ad personalization. None of these steps stop DraftKings from collecting the underlying betting data in the first place — only the kind of behavioral-advertising ban EFF is calling for would do that.