DraftKings AI Targeted Likely Losers Using Its Own Data

Most privacy fights are about who buys your data. The DraftKings story is about a company that didn't need to buy anything. According to a New York Times investigation, the sportsbook trained a machine learning model on its own customers' betting records to find the people who would lose the most money for every promotional dollar sent their way. Then it sent them more.

Five days later, the EFF used the case to make a pointed argument: none of the privacy rules built around data brokers would have stopped it.

Key Takeaways

• DraftKings built a machine learning "elasticity" model in 2023 that scored online casino customers by how much they were expected to lose for each promotional dollar, according to The New York Times.
• The Times reported that DraftKings personalized roughly $400 million in promotional spending with AI in 2025, delivered as free bets and bonuses through emails and phone alerts.
• DraftKings shelved a separate model meant to flag customers sliding toward problem gambling, and its chief responsible gaming officer said predictive technology for that purpose "wasn't evidence-based."
• The EFF says DraftKings appears to use only first party data, so rules that restrict selling or sharing data with third parties would not prevent this targeting, and it wants online behavioral advertising banned outright.
• The Massachusetts Gaming Commission has directed its staff to engage with DraftKings about how it uses AI, and says any further action will be decided later.

What Did the New York Times Find?

The Times found that DraftKings ranked its online casino players by how profitable they would be to chase with bonuses. The investigation drew on internal memos and betting records, plus interviews with more than 40 current and former employees. The model, internally called an "elasticity" score, looked at how often a customer played, how their account balance moved, how much they bet and lost, and how likely they were to stop gambling. The higher the score, the more free bets and perks the system pointed their way.

Former data analyst Jayden Butts described the logic plainly. The core question, Butts told the Times, was: "Is this person going to give us more than we're giving them?" Another line was harsher: "We are looking for traits and features that we can target that indicate a good investment. The best investment would be a problem gambler." Early 2024 data, Gizmodo reported from the Times piece, showed that highly elastic slots players "blew more money" than less elastic ones.

DraftKings personalized roughly $400 million in promotional spending with AI in 2025, which works out to more than $1 million a day. The company also credited data science with a 13 percent margin lift on promotion driven sportsbook bets that year.

DraftKings disputes the framing. It said its promotions are "directed toward customers who demonstrate sustained, engaged use of our platform, not toward customers based on their losses," and that it had not seen or verified the documents the Times cited.

What Happened to the Problem Gambling Model?

DraftKings shut it down. In 2024, staff on the responsible gaming side built a model to flag customers heading toward a gambling crisis, using the same kind of betting records. In early 2025 the team prepared to present it to company officials, including chief responsible gaming officer Lori Kalani, and the meeting was canceled the day it was scheduled, according to Gizmodo's summary of the Times reporting. Four former employees told the Times that DraftKings "stalled or squashed" that effort.

Kalani said leaders made a "collective decision" not to use predictive technology for problem gambling because it "wasn't evidence-based." Most coverage stops at the hypocrisy, but the sharper point is technical. Both models are predictions built from the same ledger of wagers and losses. A company that trusts a prediction enough to aim $400 million of bonuses with it has already decided that this kind of prediction works. It just chose which direction to point it.

Why Wouldn't a Third Party Data Ban Stop This?

A third party data ban would not stop this because, as far as the reporting shows, DraftKings did not need anyone else's data. The EFF's Devanshi Nishar wrote that DraftKings "seems to be using solely 'first party data'" and is "not buying any additional data from third parties to fuel their machine learning model." That, the post argues, "highlights how policy solutions that only limit third-party data sharing and selling would not be enough to prevent these predatory advertisements."

California's law shows the gap in black letter text. Under Civil Code 1798.140, "sharing" means handing personal information to a third party for cross context behavioral advertising, and that term covers only data gathered from your activity "across businesses" other than the one "with which the consumer intentionally interacts." A bettor who flips every "Do Not Sell or Share" switch has done nothing about a sportsbook mining its own records of that bettor. The same logic covers any company with a big enough first party ledger, from grocery loyalty programs to streaming apps.

The Pentagon's recent move to switch off advertising IDs on troops' phones is a useful contrast. That fix cuts off the third party pipeline that feeds data brokers. It would do nothing here. The EFF's answer is the one it first laid out in 2022: ban online behavioral advertising entirely, which removes the reason to collect the data in the first place. AI makes that case more urgent, Nishar argued, because "AI operates as a black box" and the people building models "can rarely predict which data points are the most useful," which pushes them to keep collecting more.

Don't Gambling Regulators Already Ban This?

Some already ban something close to it, at least on paper. Massachusetts rule 205 CMR 256.06 says no sports wagering operator may run advertising or marketing "aimed exclusively or primarily at individuals or groups of people that are at moderate or high risk of gambling addiction." The next section, 205 CMR 256.07, bars marketing aimed at people enrolled in the state's self exclusion program and forbids operators from sending them text messages or unsolicited pop up ads.

There is a catch. Those rules cover sports wagering, and the Times describes the elasticity score as a tool built for online casino customers. A regulator also needs to prove that a model is "aimed" at at risk gamblers, when the model itself only optimizes for expected losses. Proving intent against an algorithm is hard.

Chair Jordan Maynard directed executive director Dean Serpa and commission staff to engage with DraftKings about its AI practices, saying "these AI technologies are evolving rapidly across our society." The agency had already ordered a UNLV International Gaming Institute study, released in November 2025, that found a "governance gap" between AI adoption and regulatory guidelines, and it formed an AI task force in response. In Congress, the SAFE Bet Act from Rep. Paul Tonko and Sen. Richard Blumenthal would go further. Its fact sheet says it "prohibits the use of AI to track player's gambling habits and offer individualized promotions." The bill has not become law.

What This Means for Your Inbox

The Times reported that DraftKings pushed its free bets and bonuses through emails and phone alerts, which makes your inbox one of the delivery channels for this model. Gizmodo noted that Redditors describe the company's emails and push notifications as hard to turn off. The reporting does not say whether email opens or clicks fed the elasticity score. But standard marketing email tools record when you open a message and which links you tap, as our email tracking explainer shows, and that engagement log is precisely the kind of first party signal a response model is built to consume.

The data also travels. The EFF points out that information collected to target ads is sold to insurance companies, banks and agencies such as CBP, and that ICE published a Request for Information this year on how "Big Data and Ad Tech providers can directly support investigations activities." We covered that pipeline in detail when the EFF mapped the ad tech and government surveillance nexus. A betting history that says you chase losses late at night is sensitive financial data, whether or not it ever leaves the sportsbook.

What Can Bettors Do Right Now?

You can shrink how often the model reaches you, and in some states you can force it to stop. Start with these steps:

• Unsubscribe from promotional email and texts. In Massachusetts, 205 CMR 256.06 requires every direct marketing message to include "a clear and conspicuous method" to unsubscribe. Use it, then check your account's marketing settings.
• Kill push alerts at the phone level. Turning off notifications for the app in iOS or Android settings works even if the in app toggles are hard to find.
• Enroll in self exclusion if betting feels out of control. The Massachusetts Voluntary Self Exclusion program covers all licensed operators for one year, three years, five years or a lifetime, and you can enroll through the 24 hour line at 1-800-426-1234. Other states run their own programs through their gaming regulators.
• Ask what they hold on you. California residents can use the CCPA right to know and right to delete, subject to certain exceptions. Businesses have 45 calendar days to respond.
• Block third party trackers anyway. The EFF's Privacy Badger limits cross site web tracking. It will not touch a sportsbook's own records, but it shrinks the ad profile that follows you elsewhere.

Looking Ahead

The Massachusetts inquiry is the first real test for the state's AI task force, and the commission has said any further action or policy will come "when or if appropriate." The bigger question is legislative. If a sportsbook can do this with nothing but its own records, then privacy bills written around data brokers and "sale" definitions are aimed at the wrong target. The EFF's position is that only a ban on behavioral advertising closes that gap. DraftKings just gave that argument its clearest example yet.