2. Vulnerability and excess profits: some insights from beyond the essentials

As Munro and Scoular put it, the ‘exponential … rise and rise’ of the concept of vulnerability in law and policy combines with ongoing confusion about its meaning and parameters.Footnote ¹⁶ Aside from a broad sense that vulnerability is about susceptibility to harm, the term is inconsistently defined, with fragmented literatures in distinct disciplines. Even within law, there are significant differences in how the term is operationalised.Footnote ¹⁷ Hence, ‘vulnerability has become one of the words of the age’, while remaining ‘a notoriously vague term’.Footnote ¹⁸

More specifically, while consumer law traditionally framed all consumers, homogeneously, as the more vulnerable party when compared to businesses, many British and European law scholars have noted the emergence of a newer concern with especially vulnerable consumers who require higher levels of protection.Footnote ¹⁹ In the United Kingdom, for example, several sectoral regulators have duties to consider vulnerability, including Ofgem for energy, Ofcom for communications and the Financial Conduct Authority for financial products and services. Various scholars have examined how such duties are being defined and operationalised, and the wider – often unintended – consequences of the concern to protect the vulnerable.Footnote ²⁰

There are two key, interrelated insights from this literature that are especially relevant to discussion of excess profits: the still-unresolved tension between class-or group-based and more fluid or state-based – or even universal – understandings of vulnerability; and the risks of vulnerability monitoring as a regulatory tool. Vulnerability can be understood as a relatively stable, group-based, minority status attached to certain categories of people – for example, children, the disabled, those with low literacy.Footnote ²¹ These groups are identified a priori, and offered levels of additional protection beyond that provided to the average consumer.Footnote ²² However, vulnerability can also – or instead – be framed as a more transient state, with individual vulnerability stemming from fluctuating factors (such as bereavement, unemployment, the nature of the market in that particular good or service, whether a firm is acting with appropriate levels of care, etc).Footnote ²³ In this light, the OECD notes that ‘all consumers may at times be vulnerable to detriment, depending on the characteristics of the market for a particular product, the product’s qualities, the nature of a transaction or the consumer’s attributes or circumstances’.Footnote ²⁴

Moreover, some legal scholars argue that vulnerability is universal, and has the potential to reconfigure our legal systems towards a model of law grounded in embodied, relational interdependence.Footnote ²⁵ Martha Fineman, for example, argues that vulnerability is not a purely negative condition, signifying harm and injurability. It is inherent to our humanity, and is generative, forging bonds between us, leading us to create institutions and helping us to articulate demands and obligations on the state. Vulnerability is thus a conceptual tool through which to compel state responsiveness.Footnote ²⁶

Advocates of such universal approaches to vulnerability criticise the minority model – in which vulnerability is ‘a [discrete] attribute which is assigned to members of specific groups’Footnote ²⁷ – for potentially stigmatising some groups of people, for removing their agency in the name of protecting them and for ignoring market-related factors that contribute to vulnerability. Universal approaches, in turn, have long been criticised for ignoring that some groups of people are at far greater risk of harm.Footnote ²⁸ While the resolution of this tension is far beyond the remit of this article, its ongoing salience, and the shifting balance between class-based, state-based and universal approaches to vulnerability in the regulation of different sectors of the economy, is critical to bear in mind.

In that light, the OECD notes that several jurisdictions have ‘shift(ed) towards the state-based approach to conceptualising consumer vulnerability’,Footnote ²⁹ in which ‘no specific group of consumers is always vulnerable or always not vulnerable’.Footnote ³⁰ This means vulnerable consumers are now understood much more expansively than those in traditionally ‘at-risk’ demographic groups.Footnote ³¹ For example, alongside ‘vulnerability associated with personal characteristics, such as physical disability, poor mental health or low incomes’,Footnote ³² the UK’s Competition and Markets Authority also focuses on market-specific vulnerability ‘deriving from the specific context of particular markets, and affecting a broad range of consumers within those markets’, alongside ‘vulnerability associated with personal characteristics’, such as physical disability, poor mental health or low incomes.Footnote ³³ Sector-specific regulators in the United Kingdom have also adopted a broader conceptualisation of consumer vulnerability.Footnote ³⁴

That shift has also been discernible in European law. While the Unfair Commercial Practices Directive (UCPD) defines vulnerability as arising out of ‘mental or physical infirmity, age or credulity’,Footnote ³⁵ a 2016 European Commission study recognised that vulnerability ‘is not a static condition. Consumers may move in and out of states of vulnerability and they may be vulnerable in respect of some categories of transaction but not others’.Footnote ³⁶ Moreover, it identified the broader market environment – not just the personal characteristics of the consumer – as an important element of vulnerability.Footnote ³⁷ Hence, a wider range of groups emerge as vulnerable than under the UCPD – including the unemployed, the poor, ‘consumers banned by credit institutions … and consumers in a certain demographic group targeted by particular marketing practices’.Footnote ³⁸ In turn, Waddington found that although EU criminal law and consumer law are still largely focused on identified categories of the vulnerable (children, the disabled, migrants, etc.), there have been ‘isolated instances’ where vulnerability has been regarded as universal, potentially impacting everyone who enters a consumer contract.Footnote ³⁹

The uneven but discernible shift within consumer law towards understanding vulnerability as a universal condition rather than a ‘state of exception’,Footnote ⁴⁰ and as caused in part by market structures that make consumers vulnerable,Footnote ⁴¹ is especially notable for digital markets.Footnote ⁴² The rapid expansion of e-commerce has exposed high numbers of consumers to scams, fake reviews and pricing strategies (such as auto-subscriptions) that exploit individual vulnerabilities.Footnote ⁴³ Hence, ‘to the extent consumer vulnerability online is increasingly systemic, the line between addressing consumer vulnerability and protecting all consumers will increasingly be blurred – even if at times some consumer groups will continue to warrant specific attention’.Footnote ⁴⁴ Helberger et al argue that key features of digital platforms – such as personalised persuasion strategies, and real-time adjusting of choice architectures that ‘essentially offer an infrastructure to automate the continuous search for exploitable consumer vulnerabilities’Footnote ⁴⁵ – create a distinct form of universal dispositional vulnerability:

While some efforts have been made to recognise ‘consumers with less digital access and literacy’ as a distinct vulnerable group,Footnote ⁴⁷ the minority approach inherent to Article 5(3) UCPD and similar tools is radically out of step with the reality that ‘digital vulnerability is essentially a universal condition that potentially applies to all consumers in the digital marketplace’.Footnote ⁴⁸

Online gambling is instructive in this regard. In its discussion of ‘dark commercial patterns’ in digital markets, the OECD notes the harms of personalised advertising via an example of how platforms showed advertisements for casinos ‘to consumers seeking advice about or attempting to stop gambling’.Footnote ⁴⁹ It also recognised the harms to gamers caused by financial losses on lootboxes, which many critical gambling scholars consider a form of gambling.Footnote ⁵⁰ Helberger at al also use the gaming app Pokémon GO as an example of how a lack of privacy can introduce or exacerbate digital vulnerability,Footnote ⁵¹ with microtransactions boosted via tweaking game experience based on data collected about players. Deeper academic conversation about online gambling regulation is therefore potentially valuable to broader debates about class-based, state-based, and universal understandings of vulnerability in digital markets.

A second broad pattern within literatures on vulnerability is an increased recognition that efforts to identify and remedy vulnerability warrant critical examination. As Riefa and Gamper note, vulnerable consumers are often explicitly understood to be inferior consumers, less cognitively able to rationally process market information than their ‘average’ counterparts.Footnote ⁵² This may stigmatise those framed as vulnerable, while also resulting in the imagined ‘average’ consumer being given inadequate protection. In her assessment of vulnerability within personal credit regulation, Brown highlights risks of ‘misdirected protection that may result in unintended harm’,Footnote ⁵³ while in a broader analysis, Mackenzie notes that coercive interventions intended to protect the vulnerable can compound vulnerability, leading to worse outcomes.Footnote ⁵⁴

Heightened and damaging surveillance of those designated as vulnerable is especially clear in studies of welfare reform in some countries, where newly classified vulnerable groups such as ‘disengaged youth’ have been subject to what Bielefeld calls ‘technologically enhanced panoptic oversight’ of their spending.Footnote ⁵⁵ Similarly, Helberger at al argue that dispositional digital vulnerability results not just from the for-profit activities of platforms, but also from government efforts ‘to engage in new forms of data-driven governance and public service provision’.Footnote ⁵⁶ Citizen data and consumer data are increasingly mixed, to help ‘determine who gets access to which commercial/public services at what price, and who is refused access or is provided with access on less favourable conditions’.Footnote ⁵⁷

As Munro and Scoular helpfully summarise, the ongoing popularity of vulnerability as a lens within law and policy results from the complex interaction between its potential to ‘identify, problematise and compel state responses to a universal condition of precarious dependency’ and its tendency to construct ‘vulnerable’ individuals or groups as in need of responsibilisation.Footnote ⁵⁸ Vulnerable groups may subsequently be subjected to autonomy-reducing, paternalistic or coercive treatment in ways that would not be considered appropriate for others.Footnote ⁵⁹ In this sense, ‘claims to redress vulnerability operate both as a lever for progressive change and as a mechanism for increased social control’.Footnote ⁶⁰ This means there are ‘dangers of any uncritical adoption of a discourse of vulnerability, without an interrogation of who is recognised to be vulnerable, under what conditions and why, as well as of the broader socio-economic and state agendas that are served by the responses imposed’.Footnote ⁶¹

This article zeroes in on this both/and dynamic as it relates to contemporary British efforts to prevent harm in online gambling. Before I explain these efforts, however, it is necessary to briefly outline why a case study examining excess profits in non-essential, morally dubious sectors like gambling offers a distinctive lens on debates about exploitation of vulnerable consumers. Much legal research on excess or unfair profits is about products, or services, considered essential, such as vital infrastructures of transportation or communication,Footnote ⁶² life-saving drugsFootnote ⁶³ or energy.Footnote ⁶⁴ The force of claims to unfairness in such sectors rests not just on the fact that very high rates of profit are being extracted, but also that consumers – including states buying drugs – are understood to have little choice but to pay whatever is charged.Footnote ⁶⁵ In this light, both UK and EU debates about vulnerable consumers have focused heavily on vulnerable groups at risk of being excluded from markets in goods or services considered essential, such as electricity, gas, electronic communications and banking.Footnote ⁶⁶ Responses have included social tariffs, digital inclusion measures, attempts to provide poor unbanked consumers with access to minimum financial servicesFootnote ⁶⁷ and support measures in the energy sector that address fuel poverty among vulnerable consumersFootnote ⁶⁸ and provide disconnection protection.Footnote ⁶⁹

In particular, efforts to address excess profits in essential sectors have often involved capped prices, applying to all consumers. The aim may be in part to benefit vulnerable groups most at risk of exploitation, but the cap applies to everyone buying that product or service. For example, the Financial Conduct Authority introduced a cost cap on short-term credit in 2015, in part to protect vulnerable consumers facing ruinous interest rates from payday loans.Footnote ⁷⁰ Likewise, the energy regulator Ofgem identified energy customers on more expensive standard variable tariffs as vulnerable consumers subject to exploitation, resulting in legislation to enable a price cap on such tariffs.Footnote ⁷¹

This article uses an alternative analytic entry point: of debates about excess profits in a manifestly non-essential sector – online gambling – understood to pose risks to vulnerable individuals and wider society. Although this may appear to have little in common with consumer law in energy or banking, legal doctrine on price-setting has historically been heavily shaped by cases involving state restrictions on morally dubious, non-essential products – notably alcohol.Footnote ⁷² Moreover, recently EU and UK courts have given wide scope for governments to set higher minimum prices for alcohol, including on the public health grounds that a minimum price aims to deter excessive consumption among lower socio-economic groups in particular.Footnote ⁷³ The broader concern here is about harm being caused by corporations selling their potentially addictive products too cheaply, so vulnerable people are exposed to risks.

Using in-depth analysis of two new regulatory measures designed to address vulnerability in online gambling, I seek to advance this broader conversation about excessive profits within harmful industries. The measures I foreground – involving mandatory monitoring for financial harms, and differentiated stakes for young adults – are distinct from better known efforts to address excess profits mentioned above (such as universal price caps on essential goods or services, or universal minimum prices that aim, indirectly, to especially deter consumption among the poorest). They therefore offer important new lessons, including with regard to how digital vulnerability is being understood in a key sector of online commerce.

3. Regulating online gambling in Britain: the growing concern with vulnerability

New Labour’s gambling reform agenda – which culminated in the 2005 Act – created ‘an essentially permissive’ regime for commercial gambling operations in Great Britain.Footnote ⁷⁵ Gambling contracts became legally enforceableFootnote ⁷⁶ and the newly created national gambling regulator, the Commission, was given a duty to exercise its functions to permit gambling, insofar as the Commission thinks it reasonably consistent with the pursuit of the licensing objectives.Footnote ⁷⁷ In this respect, the Act was an early move in what became a wider global trend towards commercial gambling liberalisation.

In terms of protecting players from harm, the third licensing objective of the Act requires the protection of children and vulnerable adults from being harmed or exploited by gambling.Footnote ⁷⁸ The Act authorises the Commission to produce Licensing Conditions and Codes of Practice (LCCP), and corresponding guidance, to specify ‘the manner in which facilities for gambling are provided’.Footnote ⁷⁹ Within the LCCP, a special set of Social Responsibility (SR) codes elaborates obligations on licensed operators, both land-based and remote. Operating licences are subject to the condition that the operator ensures compliance with those LLCP SR provisions.Footnote ⁸⁰

Notwithstanding this architecture, the Commission and its lead department (the Department of Culture, Media and Sport, or DCMS) have repeatedly been criticised for failing to use their statutory powers to prevent harmful practices.Footnote ⁸¹ In particular, because of its 24/7 availability, personalised marketing and lack of social interaction, online gambling is widely understood to be more risky than most in-premises play.Footnote ⁸² But it took until 2018 for the Commission to conduct a review of online gambling.Footnote ⁸³ New SR rules for remote operators, and accompanying guidance, were not issued until 2019Footnote ⁸⁴ – over a decade after the Act had unleashed an explosion of online operations. In 2019, the CMA finally took limited action against some online gambling firms that had made it very difficult for customers to access their winnings, although multiple barriers to easy withdrawal remain.Footnote ⁸⁵ In February 2020, the National Audit Office issued a highly critical report on gambling regulation, singling out the Commission’s ‘cautious approach to changing regulations’ on harmful products, including those available online, and its lack of clarity on consumer vulnerability.Footnote ⁸⁶ A few months later, the House of Lords Gambling Industry Committee published a report entitled Gambling Harm – Time for Action, which concluded that ‘Gambling operators have made hay exploiting the laissez faire regime that has existed hitherto, while successive governments and regulators have failed to keep up with the (digital) revolution in the UK gambling sector’.Footnote ⁸⁷ It contained distressing testimony about severe gambling harm, including suicide, and documented widespread industry disregard for player welfare. Again, online operators were of particular concern, in part due to the proliferation of free bet offers, in-play betting options and online slot features that are designed to exploit cognitive biases.Footnote ⁸⁸ Growing concern with the harms caused by online gambling is also reflected in recent court decisions,Footnote ⁸⁹ and the long-awaited 2023 White Paper on gambling law reform.Footnote ⁹⁰

Prompted by this multi-year wave of criticism, the Commission has repeatedly committed to better identification and protection of the vulnerable. Its 2021 statement of principles for licensing and regulation set out that the definition of ‘vulnerable persons’ includes people who spend more money and/or time gambling than they want to, people who gamble beyond their means and people who may not be able to make informed or balanced decisions about gambling, for example because of health problems, learning disabilities, or substance misuse.Footnote ⁹¹ In July 2023, the Commission published a more in-depth ‘vulnerability statement’, further specifying its approach and differentiating it from the approach of other regulators.Footnote ⁹² It uses an expansive, state-based approach to vulnerability, requiring businesses to monitor closely and react to varied situations:

While this definition is similar to that of regulators such as the FCA, Ofcom and Ofgem, crucially the Commission noted that supporting gambling consumers in vulnerable situations may require businesses to help such consumers limit or stop gambling. Whereas the main task of other regulators is to ensure that the vulnerable have access to essential services, it has a more complex task, involving balancing accessibility with proportionate restrictions to prevent harm.Footnote ⁹⁴

The Commission’s formal guidance for remote licensees reiterates this broad definition of vulnerability,Footnote ⁹⁵ and instructs licensees to implement systems and processes that effectively monitor for risk of vulnerability so that, when identified, they can act in a timely manner to minimise harm.Footnote ⁹⁶ Hence, while the regulator has embraced a very wide approach to potential vulnerability, much of the actual risk assessment and designing of responses remains within the purview of operators. That said, clear policies must be in place to identify at-risk players, and to take what the 2023 vulnerability statement termed ‘proportionate action for customers who they know are in a vulnerable situation’,Footnote ⁹⁷ including immediate action when significant risks of harm are identified. Formal guidance provides scenarios outlining how operators may obtain information about different categories of vulnerability, and act in response. For example, if a customer mentions ill-health during a customer service conversation, the licensee could review their account for other signs of harm, or take more drastic action such as ceasing the business relationship, ‘particularly in the case of brain injury or medication which increases risk taking behaviour’.Footnote ⁹⁸

In short, the broad direction of travel is clear: towards greater concern about a harmful industry making excess profits from vulnerable people. In the remainder of this article, I examine the novel implications of two specific mechanisms that have resulted from this wider concern: financial risk assessments and differentiated stakes for young adults. Both emerged from the 2023 White Paper on gambling law reform, both relate to online gambling harm, and both connect – although in distinct ways – with the symposium’s focus on excess profits. The first measure aims to prevent excess profits being made from individuals who are spending more than they can afford, by improving assessments of financial risk, while the second limits the amount that young adults can stake on an online spin, so as to reduce harm to a sub-group identified as vulnerable. Together, they suggest that regulatory efforts to address excess profits produce new classifications and practices worthy of critical analysis. Specifically, increased financial risk assessment deepens the regulatory faith in expansive, opaque, for-profit surveillance practices, including involving AI, which result in new markets for online gambling data. Lower stake limits for younger adults are constitutive in a different way: they generate a new classification of 18–24-year-olds who are more than children but less than fully adult, both because of their poverty and due to their neurobiological immaturity.

4. Enhanced surveillance to identify and protect the financially vulnerable

The Commission have been strengthening rules to identify and protect the financially vulnerable for several years.Footnote ¹⁰⁰ In turn, there is a widespread belief among regulators (and many academics) that software and AI used by online gambling companies to target marketing can be repurposed for good, to identify those who are at risk of harm.Footnote ¹⁰¹ I have argued that online gambling is a resource for state regulatory power here because its technologies are seen to offer unprecedented opportunities for surveillance and subsequent restriction of access, including via pre-emptive identification of potentially problematic, disordered or risky gamblers, or those vulnerable to becoming such.Footnote ¹⁰² Hence, before the 2023 White Paper, the Commission had mandated operators to make better use of remote player data, to address concerns that excess profits were being made from people who had lost control of their spending.Footnote ¹⁰³ Furthermore, since 2020 the Commission has been working with the Betting and Gaming Council (a gambling industry body representing leading remote operators) to develop a ‘Single Customer View’ system for operators to share data about customers’ online gambling across different accounts, in order to be more proactive about identifying and preventing gambling harms.Footnote ¹⁰⁴

However, the White Paper’s proposals represented a significant shift from previous rules because operators had not been required to conduct checks on all customers when they hit specified loss amounts.Footnote ¹⁰⁵ Now, remote gambling operators must investigate customers’ financial circumstances using prescribed checks at certain thresholds, ‘to understand if their gambling is likely to be harmful to them’.Footnote ¹⁰⁶ A new social responsibility code was brought into force in late August 2024, requiring almost all remote licensees to undertake financial vulnerability checks for customers when deposits minus withdrawals exceed £500 in a rolling 30-day period.Footnote ¹⁰⁷ In late February 2025, the threshold was reduced, to £150 in a rolling 30-day period.Footnote ¹⁰⁸

The Commission maintains that these are ‘light-touch’ financial vulnerability checks. In a shift from the White Paper’s initial proposals, they only focus on publicly available data, rather than on individual data (such as postcode or job title). More precisely, the financial vulnerability check must include, at a minimum, ‘a customer-specific public record information check for significant indicators of potential financial vulnerability’,Footnote ¹⁰⁹ including whether the customer is subject to a bankruptcy order, County Court judgment, individual voluntary arrangement, High Court judgment, administration order or decree, or a debt relief order. Licensees are required to consider the financial vulnerability information they obtain from that public information check, alongside ‘the other information they know about the customer and are permitted to use, in order to assess risk’.Footnote ¹¹⁰ Although specific actions resulting from the checks are still not prescribed, licensees are required to have and put into effect policies and procedures on whether decisions on proportionate action are taken in a manual or fully automated manner, or via a combination, and the circumstances in which immediate action (e.g. to suspend an account) is considered necessary.Footnote ¹¹¹

In addition to financial vulnerability checks at set loss thresholds, the Commission is also piloting a more targeted financial risk assessment to identify high-spending remote customers at risk of harm. This aims to provide ‘much greater insight into a customer’s financial situation by accessing more personalised data to consider factors like discretionary income’.Footnote ¹¹² The White Paper proposed that enhanced checks would be triggered on accounts where net losses exceeded £1000 in a day or £2000 in 90 days. The trigger amounts would be halved for adults aged 18–24 years.Footnote ¹¹³ Credit reference agencies would ‘provide an overview of pertinent information for the individual customer, for instance an estimate of overall disposable income … this data will be used to inform an assessment of whether a customer’s level of spend is likely to be harmful to them’.Footnote ¹¹⁴

The proposal for enhanced checks has not yet been enacted, but in September 2024 the Commission launched a six-month pilot involving the largest remote operators, to assess the idea’s viability.Footnote ¹¹⁵ The pilot uses historic customer data. Account details of players who hit high spending thresholds in the past are shared with one or more credit reference agencies (Equifax, Experian and TransUnion), which provide a financial risk assessment to test which risk indicators, if any, were present.Footnote ¹¹⁶ For stage 1 of the pilot, over 530,000 assessments were conducted for approximately 300,000 accounts. 95% of those were classed as ‘frictionless’, meaning that the operator data could be matched to a person by the credit reference agency to allow a risk assessment to be returned.Footnote ¹¹⁷ Stage 2 of the pilot involved 1.7 million financial risk assessments, for some 860,000 accounts, 97 per cent of which were classified as frictionless.Footnote ¹¹⁸ Based on this higher number of cases, the Commission estimated that operators would be unable to meet financial risk assessment requirements proposed in the White Paper in 0.1 per cent of accounts (or for one in 1000 customers).Footnote ¹¹⁹ Neither pilot has resolved uncertainty over what actions should stem from the risk assessment, although the Commission notes that it has created a working group of pilot participants to inform its subsequent guidance on ‘how to embed financial risk assessments into their wider customer interaction processes’.Footnote ¹²⁰

The (enacted) financial vulnerability checks and (proposed) financial risk checks are relevant to a broader discussion of excess profits because they reveal a complex intertwining of class-based and state-based approaches to vulnerability, underpinned by a fundamentally opaque, for-profit approach to scoring risk. As noted above, the Commission identifies a very wide range of potential markers of vulnerability, including having caring responsibilities or living in ethnically diverse postcodes. Some are demographic, such as age, while others are situational (e.g. suffering domestic abuse). Assessments of individual risk are hereby inescapably bound up with concern about group-based vulnerabilities.

In addition, crucially the legally mandated surveillance of affordability is creating new private sector interests in data about these expansively defined vulnerable gamblers. As Beauvisage and Mellet put it in their discussion of data and ‘assetization’, ‘data-things must be considered as valuable, and this implies that they are necessarily repurposed – transposed from a specific scene to a different scene where they can be valuated and eventually traded’.Footnote ¹²¹ Data brokers are crucial in this respect, since they connect and trade personal data, and, via the spread of tracking technologies that allow fragments of online behaviour to be linked to individuals, they ‘transform datasets into “datassets” that can be commodified’.Footnote ¹²² Financial vulnerability checks and risk assessments involve a distinct configuration of data brokers, including regulators, courts, credit reference agencies and gambling companies (whose customer data are the crucial linchpin in the whole surveillance apparatus). The Commission’s new rules on financial vulnerability monitoring are not just about private companies capturing and appropriating data about our lives, and turning that data into an asset; rather, the tracking of players is being required by the regulator as a harm reduction intervention.

This, in turn, is creating a whole new industry in safer gambling technologies, parasitic on the player-tracking rules. Sometimes the technologies are designed by gambling operators. An example is Playtech’s ‘BetBuddy’, an AI tool that ‘uses behavioural monitoring and predictive risk modelling to detect problematic play early. By enabling the use of automated nudging tools, BetBuddy guides users towards safer habits’.Footnote ¹²³ Other tools have been developed by technology companies that do not themselves operate gambling, but that market their products – to regulators and gambling companies – as able to identify the vulnerable. For example, beBettor promises gambling operators that it can help them meet regulatory requirements for financial vulnerability and risk monitoring while also ‘seamlessly integrat(ing) personalised customer affluence data with your essential business platforms to acquire, nurture and retain more valuable customers’.Footnote ¹²⁴

This statement perfectly encapsulates one of the major risks of tackling excess profits by identifying those who are spending more than they can afford: it relies on for-profit player-tracking tools that can be, and are being, used to enhance marketing to those understood as able to spend more. Regulatory efforts to distinguish between recreational and harmful gambling are hence intertwined to an unprecedented extent with profit-making digital surveillance. Companies can claim to be acting in the interests of the vulnerable while they maximise spending by the majority.

Further, the shared regulatory and tech sector faith in the harm-reduction potentials of online gambling player data supercharges a key claim made by online gambling companies that their platforms are safer, even when evidence suggests that they are riskier.Footnote ¹²⁵ As the financial checks were being developed, the DCMS justified its choice of a £5 stake limit for online slots – higher than most respondents to its consultation wanted – on the basis that online gambling

Besides generating new ‘datassets’ about gamblersFootnote ¹²⁷ that are directly valuable to a wide range of for-profit actors (including gambling companies), this approach to ensuring fairness by identifying the financially vulnerable also further entrenches claims about online gambling as safer, which are resulting – yet again – in looser rules than operate in premises.

5. Limiting profits via differentiated stake limits for young adults

In the aftermath of the White Paper, which proposed to restrict stakes on online slots, the DCMS consulted on a variety of stake limits, including up to £15 per spin. As noted above, it eventually settled on £5. If they hit that limit, players have to wait at least 2.5 seconds before being able to spin again. The £5 per spin limit matches that for high-stakes machines available in land-based casinos, but it is far higher than the majority of respondents to the DCMS’ consultation wanted. Some 64 per cent of those respondents – including this author – favoured a stake limit for online slots of £2 or lower.Footnote ¹²⁹ The choice of a higher limit was thus of great relief to the online gambling industry. As one newspaper noted, shares in major online gambling companies rose faster than the FTSE 100 on the day the DCMS proposal was announced, ‘indicating no concern among investors’.Footnote ¹³⁰

However, one group – young adults – was seen to be so vulnerable that they warranted a different approach. In September 2024, when the DCMS proposed the £5 maximum stake on online slots, it also proposed a lower (£2) level for 18–24-year-olds.Footnote ¹³¹ The statutory instrument to bring the rule into effect was laid before parliament in December 2024,Footnote ¹³² and the measure was implemented in May 2025.Footnote ¹³³

The lower stake limit for young adults was framed as an attempt to ‘ensure that there are extra protections for a potentially vulnerable group, without unnecessarily restricting their ability (as adults) to participate’.Footnote ¹³⁴ More precisely, the age-related maximum stake differentiation is grounded in the claim that 18–24-year-olds are at higher risk of gambling harm. The April 2023 White Paper asserted that, ‘[y]oung adults have the highest average problem gambling score of any age group, generally lower disposable income, ongoing neurological development impacting risk perception, and common life stage factors like managing money for the first time or moving away from support networks’.Footnote ¹³⁵ Likewise, while the Commission’s July 2023 vulnerability statement mentioned ongoing research into a range of ‘key groups of interest’, including women, and Black and minority ethnic communities, it asserted that knowledge was firm about young adults as a vulnerable group ‘due to a combination of biological, situational and environmental factors’.Footnote ¹³⁶ This was reiterated in the formal guidance for operators relating to SR provisions for online gambling, which claimed that young adults (aged 18–24 years) are vulnerable to gambling harm and are more likely to have

Hence the claim about young adults’ vulnerability rests on a variety of sub-claims, including that they are subject to peer pressure; they are poor at weighing risk and reward; they are spending more than they can afford (even if what they are spending is relatively low); they are neurologically immature; and people who went on to have very serious gambling problems developed such problems within this age bracket.Footnote ¹³⁸ On these grounds, even though ‘the age of 18 is widely recognised as the age at which one becomes an adult, and gains full citizenship rights and responsibilities’, at the same time, ‘younger adults may benefit from greater protection than other groups’.Footnote ¹³⁹ When announcing the lower £2 stake limit, the DCMS reiterated that this ‘aligns with the wider government approach to gambling of targeted and evidence-based interventions for those at risk, while not unduly restricting others’.Footnote ¹⁴⁰ Age-targeted protections ‘seek to support equalities’ because harms are more prevalent for young people.Footnote ¹⁴¹

As the White Paper and other evidence make clear, the higher rates of gambling harm experienced by young adults in part relate to the fact that they are often managing very low levels of disposable income, such that any amount spent on gambling may be seen as harmful. Young people aged from 18 to 24 years appear to have the lowest average gambling spend of all age groups for some key types of online gambling.Footnote ¹⁴² However, young adults also have the lowest average discretionary income of any adult age band.Footnote ¹⁴³ Part of the risk profile of young adults is thus explained by their poverty.

The White Paper also claims, on the basis of Commission advice, that 18–24-year-olds ‘may be at particular risk of gambling related harm’ because of ‘lower impulsivity control.’Footnote ¹⁴⁴ It references research into adolescent brains in this regard. The introduction of neurobiological risk into regulatory debates about harmful or exploitative prices in gambling is noteworthy. Medical sociologist Scott Vrecko has argued that research into the gambling brain – funded, over decades, by gambling companies – has produced particular ways of understanding and regulating gambling problems. For Vrecko, the identification of pathological gambling as a neurological disorder repositioned the harmful consequences of gambling from being a social problem, requiring better regulation of gambling companies, to being a neurobiological problem, requiring treatment of people with malfunctioning brains.Footnote ¹⁴⁵ Hence, he argued that ‘understandings of the biology of pathological gambling have themselves been involved in the emergence of new social and economic networks, as well as new formations of politics and regulation’.Footnote ¹⁴⁶

With the introduction of differentiated stake limits for young adults on the basis, in part, of their neurological immaturity, we are arguably seeing another chapter in this regulatory story. To paraphrase Vrecko, ‘the ontology of the social problem has changed’Footnote ¹⁴⁷ significantly, with implications for regulation. Law-makers and gambling reform advocates are not managing individual pathology here, but creating a new regulatory target group defined in part by poverty and in part by risky brains. Rather than solely peering into personal data to sort the vulnerable from the rest, the new regulatory approach to online gambling also involves a lower stake limit for a sub-group considered, by definition, too vulnerable to play as real adults.

While many features of this approach merit discussion, at the very least it is worth pointing out that one of the Commission’s key regulatory enforcement actions taken against gambling operators for social responsibility failures involved a company that exploited very elderly players.Footnote ¹⁴⁸ The company International Multi-Media Entertainments Limited (IMME) – which allowed customers to bet on the outcome of international lotteries – targeted elderly players, causing severe harm to some who were confused and vulnerable. It allowed a customer who was 100 years old to gamble £23,829.90 within five months, and another who was 78 to spend £63,951 in three months. In the latter case, IMME withdrew funds from the customer’s bank account while he was in hospital and later a care home. Despite this clear evidence of age-related targeting, the White Paper said nothing about restricting the stakes of the elderly, and they are not prioritised as a vulnerable group in current Commission discourse.

Moreover, young adults are generally offered no specific legal protections from other ravages of late-stage capitalism. Young adults’ poverty, neurobiological immaturity and correspondingly poor ability to weigh risk and reward are considered no barrier to them taking out student loans or joining the armed forces. Unlike the elderly, young adults are given no age-related support for energy bills even though households headed by young people are up to four times more likely to be on pre-payment meters, the most expensive way of paying for energy.Footnote ¹⁴⁹ This confirms the vital importance of regulatory innovations in non-essential, morally dubious sectors (such as online slots) for our wider debates about excess profits, if only as a contrast point for failures to act in essential sectors.

In sum, the lower stake limit for young adults is unlikely to seriously limit gambling industry profits: one can re-stake within seconds. However, my interest is less in the limit itself than in the wider implications of its differentiated nature. I suggest we are witnessing the emergence of a new set of logics for managing gambling harm, reliant on new conceptualisations of an at-risk group of not-quite-adults who need to be protected from interlinked vulnerabilities stemming from neurobiology and poverty. This is likely to have further implications within gambling (e.g. for differentiated thresholds for financial risks checks) and potentially beyond. The regulatory interest in excess profits being extracted from the vulnerable is constitutive here; it is generating a new classification of 18–24-year-olds who are less than fully adult. Even if the stake limit itself will have little effect, that new classification is worth noting.

6. Wider lessons about regulating access and vulnerability

Like energy law and banking law, gambling law both matters in its own right and can help illuminate broader lessons about regulatory responses to vulnerability. In the latter sense, the two examples explored above confirm the ongoing tension between legal frameworks premised on identification of at-risk individuals or sub-groups, and recognition that all consumers are vulnerable, especially in digital markets. The enhanced attention to vulnerability within online gambling is intended to address systemic injustices by increasing restrictions on an industry widely understood to exploit at-risk people who can suffer life-changing (and sometimes life-ending) harms. At the same time, this attention results in increased and sometimes profit-making surveillance of those identified as vulnerable, while channelling regulators away from more universal measures to tackle harm. In particular, a vulnerability lens results in access limits for individuals and sub-groups, rather than product limits that would more effectively reduce exploitation.

Specifically, the online gambling example can contribute distinctly to our understanding of how vulnerability is operationalised to address the perceived harms of non-essential, morally suspect industries. Unlike regulators such as the FCA, Ofcom and Ofgem – which are concerned, in part, to ensure minimal access to essentials – the Commission is charged with designing proportionate restrictions to prevent the vulnerable being exploited by a harmful industry, including by requiring businesses to limit, or stop, play where risks are considered sufficiently high. Restricting access is thus a key part of the regulatory response to social and political concern about growing vulnerability to online harms. However, this does not result in enhanced universal protections. Instead, we see the expansion of individual tracking, and the creation of a new sub-group of the inherently a priori vulnerable, to be protected via spending limits.

The regulatory awareness of widespread vulnerability to harm from digital markets is indeed generative of new laws and institutions here, but not in the universally protective ways that advocates of a vulnerability lens on law would support. The gambling example suggests that regulatory interventions to address vulnerability in non-essential sectors may enhance the tracking of all individual consumption, exposing us to new forms of data-driven governance. In this regard, laws aiming to address harm are constitutive of digital vulnerability, creating more markets in individual gambling data while failing to adequately restrict companies from retooling that data for harmful purposes. In particular, regulators are enhancing the dispositional vulnerability of all online gambling consumers to surveillance by for-profit credit scoring companies, and ‘safer gambling’ technology companies.Footnote ¹⁵⁰ In this sense, increased financial risk assessment deepens the regulatory faith in expansive, opaque for-profit surveillance practices, including involving AI, resulting in new markets for online gambling data and compounding the risks of personalised targeting embedded in digital markets.

Wider lessons can also be drawn from the regulatory creation of a new category of less-than-fully-adult adults, restricted from accessing harmful products that are available to others. The basis of the categorisation is noteworthy, reflecting concerns about vulnerability due to poverty, impulsivity, limited life experience and incomplete brain development. This suggests a potentially important new chapter in the bio-social-legal understanding of harm, significant for disability law and poverty law, not just for consumer vulnerability. Within the realm of consumer law, however, we know that young adults are not offered group-based protections to ensure access in essential sectors of the economy. Moreover, minimally restricting their spending on a risky service (for 2.5 seconds) does not offer them meaningful protection from targeted exploitation by harmful online industries. However the illusion of tightly targeted digital protection for a priori vulnerable sub-groups offers legitimacy for those industries (and the governments regulating them), and results in a lower level of universal protection than offered for slots play in premises. The creation of a sub-group-specific access limit may hereby justify lighter touch universal rules.

These risks add an additional layer to long-standing debates about minority, state-based and universal approaches to vulnerability. Paradoxically, growing recognition of the widespread harms created by personalised targeting and corporate data misuse in digital markets result in yet more for-profit surveillance, data-sharing and individuated assessment of risk. The regulator grants technology companies and gambling platforms linchpin roles in sorting the vulnerable from the rest, enhancing the ability of corporations to do harm. The regulator also positions young adults as needing enhanced protections via spending limits – albeit in a very circumscribed way unlikely to seriously impact the industry’s social licence to operate. When operationalised like this, a vulnerability lens is not just generative of laws and institutions; it is potentially very profitable for companies.