In the baccarat salon on the thirty-fourth floor, at the Macau property where I worked for eleven years, the paperwork on each whale fit in a single folder. I know this because I kept the folders. A name. A nationality. A credit line. A list of comps extended. A record of buy-ins and cash-outs. A small photograph taken at the registration desk on the first visit. Eleven years of play on a customer who sat down twice a month at the big tables, and the folder rarely went beyond eight pages by the time the customer stopped coming.
I moved to a consulting role with an online operator in 2019. On the first day of my orientation I was shown the data model for a single online player account. The model had two hundred and forty-seven fields.
The gap is the whole subject.
What the Salon Collected
The room knew what it needed to know. It knew who you were, sufficient for the compliance regime of the time. It knew what you bet, because it wrote down the chips on a rating card. It knew when you came in and when you left, because the door log recorded it. It did not know what you were thinking. It did not know what you looked at on the way to the table. It did not know who you spoke to in the lobby. It did not know what you did on the three weeks between visits.
The discretion was partly regulatory and partly cultural. A Macau junket room operates by understanding that its clientele values absence of record. The room that collected more than it needed would lose the customer.
What the Online Operator Collects
The online platform operates by a different logic. The platform's commercial model depends on understanding the player in detail sufficient to serve them the next bet. The two hundred and forty-seven fields of my orientation training fell into categories I will set out here, not in full (the full list is, I am told, commercially sensitive), but in types.
- Identity and contact. Name, address, date of birth, government identifier where required by the jurisdiction, phone number, email, bank or payment method on file. Required by regulation under Anti-Money-Laundering and Know-Your-Customer frameworks in every licensed jurisdiction. Comparable to what my salon kept.
- Device and session. IP address on each login, device fingerprint, browser user agent, screen resolution, time zone, language setting, ISP, approximate geolocation, session duration, time of login, time of logout. This is collected on every session, every time. Used for fraud detection, for jurisdictional compliance, and for marketing.
- Play behaviour. Every wager, every outcome, every game entered, every game exited, every pause between spins, every change in bet size, every deposit, every withdrawal, every chat message to support. Stored in structured tables and queried by the operator's analytics team to generate player segmentation.
- Marketing response. Every email opened, every link clicked, every push notification acknowledged, every bonus accepted, every bonus declined. Used to tune the next marketing campaign.
- Behavioural markers. Session length relative to historical average, deposit frequency relative to historical baseline, time-of-day of play, volatility of games chosen. Used by responsible gambling algorithms to flag accounts for outreach, and in some jurisdictions by compliance algorithms to flag accounts for enhanced due diligence.
- Inferred demographics. Estimated age bracket if not disclosed, estimated income bracket based on deposit patterns, estimated preferred-game category, estimated propensity to churn. Generated by models trained on the platform's own population.
My salon's folder on a given whale would have held a subset of the first category. The online operator's record holds everything else as well, updated continuously, stored for the retention period required by the platform's license, and queryable for any purpose the operator's privacy policy permits.
The Privacy Policy Is the Door
The privacy policy is the document that separates what the operator may do with the information from what the operator may not. It is usually forty to sixty pages long and written in a register that resists casual reading.
A player who wants to know what the operator is collecting should read three specific sections.
- The Data We Collect section. This is the inventory. It will list categories rather than specific fields, but the categories are precise enough to understand the scope.
- The Purposes section. This explains what the operator will do with the information. The purposes typically include providing the service, compliance with law, fraud prevention, marketing to the player, and in some cases sharing with affiliates or marketing partners.
- The Sharing section. This lists the third parties to which the operator may disclose the data. It will include the jurisdiction's regulator, the operator's payment processors, its Know-Your-Customer verification vendor, its customer support platform, and, in many cases, marketing partners.
The policy will also cite the legal basis for each type of processing. In the European Union, this will reference the General Data Protection Regulation article numbers. In the United Kingdom, the UK GDPR. In Ontario, the Personal Information Protection and Electronic Documents Act. In California, the California Consumer Privacy Act and the California Privacy Rights Act.
What a Player Can Do
In most licensed jurisdictions a player has three specific rights that are useful to know.
- The right of access. The player may request a copy of the data the operator holds on them. The operator must provide it, usually within thirty days, usually at no cost. The resulting file is often a thousand pages or more and contains, in structured form, most of what I described in the categories above.
- The right of rectification. Incorrect data, particularly in the identity fields, may be corrected on request.
- The right of erasure, sometimes called the right to be forgotten, with significant limitations where the operator must retain data for regulatory compliance. In practice, a player who closes their account can have most marketing data erased, but transactional data subject to Anti-Money-Laundering retention requirements will be held by the operator, typically for five to seven years, regardless of erasure requests.
What the Room Knew That the Platform Does Not
The older salon, for all its smaller data footprint, knew something the platform struggles to know.
It knew the whale's face.
It knew whether he had slept well, from how he sat. It knew whether he was playing for the game or playing to escape, from how he engaged with the dealer. It knew when to reduce the ambient music and when to raise it. It knew when to send the porter to ask about a meal and when to let him sit in silence.
The platform, despite its two hundred and forty-seven fields, is still reaching for this.
The theatre of the table, at its best, was a form of attention that did not need to be written down. What the platform collects, it collects because it must write it down to know it at all. The discretion of the old room was, I think now, a richer form of knowledge than the exhaustive record that has replaced it.
The whale in the salon left a trace in the memory of the staff. The player on the platform leaves a trace in a server. Neither is invisible. They are visible in different ways, and the player who plays online should understand that the visibility is not optional, only its extent and its use.
Wings for this entry
