Developing New York Did Not Write an AI Rule. It Wrote a Ban on Knowing Who You Are

Editor's note: TrueEdge builds odds tools and earns affiliate commissions from licensed sportsbooks, including two named in this piece. This piece argues a position on betting regulation. Weigh it accordingly.

Read the headline on New York's Friday action and you get an AI story. Read the rule and the phrase "artificial intelligence" turns out to be almost decorative. The prohibition in proposed 9 NYCRR § 5404.1(b) does not attach to a technology. It attaches to a purpose, and the purpose is knowing which customer you are talking to.

The Gaming Commission met at Empire State Development on Third Avenue on October 9 and voted unanimously to propose two things: a new Part 5404 governing automated systems, and a separate overhaul of at-risk-patron duties. Both memoranda, signed by general counsel Edmund C. Burns and dated October 5 and October 8, trace themselves to Governor Kathy Hochul's 2026 State of the State. ProPublica reports a 60-day comment window. Covers reports that no date was set for a final vote and that staff were told to go get more expert input on AI. Both can be true; this is the beginning of a rulemaking, not the end of one.

What is already finished is the drafting, and the drafting is the story. It is also not a surprise to anyone who was paying attention in the spring: when Hochul rolled the package out on March 30, the announcement already named a ban on operators using artificial intelligence to target customers with personalised bets or promotions, and O'Dwyer was alongside it saying that "no other form of gambling has pervaded our consciousness like sports wagering." Friday was the day the sentence became a regulation.

The word that does the work is "individual data"

Section 5404.1(b) bars a licensee, "or any affiliate, agent or vendor acting on its behalf," from using "any automated decision system or algorithmic profiling, including artificial intelligence, machine learning, or generative systems" that processes individual data to do three things: to "select, customize, time or deliver any promotion, bonus, offer, odds, limit, message or product recommendation, regardless of purpose or effect"; to "suggest any wager, wager type or wager amount, regardless of purpose or effect"; or to otherwise influence wagering "where the purpose or foreseeable effect is to increase wagering, engagement or revenue."

"Individual data" is defined at 5404.1(a)(1) to include "pseudonymous identifiers, device and cookie data, inferred attributes, and data obtained from third parties," and — this is the line that closes the obvious workaround — "segments and cohorts built from such data." You cannot comply by aggregating ten thousand customers into a lookalike audience. The cohort is individual data.

Two sentences later the rule forecloses the other two standard defences: "Human review or approval of system output does not exempt such activity and patron consent does not waive this subdivision." A human in the loop does not launder the output. Neither does a checkbox.

Then subdivision (c) inverts the burden of proof. Any offer, bonus, message, odds, limit or wager suggestion "whose recipient, content, timing or amount varies among patrons in a manner associated with individual data" is presumed to violate the section. The presumption can be rebutted "only by clear and convincing evidence," and only with the logs the rule separately requires. Clear and convincing is the standard New York uses for fraud and for involuntary commitment. New York proposes to apply it to a push notification.

The logging duty at (f) is what makes that survivable or fatal, depending on your view. Every system that touches individual data must be inventoried with the Commission, stating purpose, inputs and outputs. Logs of inputs, outputs, model version, recipients and criteria applied must be kept seven years and opened to audit. Any material change — defined to include a change to data inputs that "could alter the recipient, content, timing or amount of any output" — must be reported in writing at least 30 days before it ships. A chief executive signs an annual compliance certification. And under (i), each affected patron is a separate violation, which turns a single mis-targeted campaign into an arithmetic problem rather than a fine.

None of that appeared in Friday's coverage, which mostly reported that New York would stop sportsbooks using AI to customise bonuses. That is the press release. The rule is a recordkeeping regime with a reversed burden attached.

The carve-out tells you what the Commission believes

Section 5404.2 permits exactly one thing the rest of the Part forbids. A licensee conducting pari-mutuel wagering on horse racing may run a separate application whose stated purpose is to suggest wagers — if the patron affirmatively opts in. The conditions are long: it must be a standalone product; it may use only the patron's own pari-mutuel history and what the patron volunteers, with no cross-product data, no third-party data, and no "inferred vulnerability, emotional or biometric signals"; it must be unavailable to self-excluded patrons; it may not suggest a wager exceeding a limit; its outputs may not be reused for marketing. Consent must be unbundled, default off, revocable in one action, reaffirmed every twelve months, and may not be purchased with an incentive. Decline it, and you cannot be asked again for 90 days.

And the opt-in screen must be "written in plain language stating that the application is designed to increase wagering."

Sit with that. New York's regulator has drafted, as a condition of permitting a personalised wagering product, that the operator must tell the customer in writing that the product exists to make them bet more. The Commission did not reach that sentence by accident, and it did not restrict it to horse racing because racing is uniquely dangerous. It restricted it to racing because racing asked and got a hearing, and because the Commission is willing to tolerate personalisation only where the customer has been handed a warning label.

Which is the implicit judgment about everything else in the betting stack. If a suggestion engine needs a plain-language disclosure that it is designed to increase wagering, then so does the one that decides when your same-game parlay boost arrives. New York is not saying personalisation is impossible to do safely. It is saying nobody has been doing it safely, and the September reporting is why anyone believes that. Jake Pearson spent ten weeks at DraftKings and FanDuel losing more than $10,000 on purpose. He capped himself at two hours of app use a day and $100 of deposits per 24 hours. Promotional alerts arrived while he was setting those limits, and a VIP Showcase invitation arrived the day after he chased a loss of nearly $1,800. DraftKings' chief responsible gaming officer, Lori Kalani, said the system "worked the way it was supposed to." That answer is the reason this rule has a rebuttable presumption in it.

The best argument against this rule

It is not that personalisation is harmless. It is that subsection (b)(3) is drafted so wide it has no edge.

Read it literally: an automated system may not process individual data to influence wagering "where the purpose or foreseeable effect is to increase wagering, engagement or revenue." A product that remembers you follow the Knicks and surfaces Knicks markets first has the foreseeable effect of increasing engagement. A search ranking has that effect. A push notification telling you your bet won has that effect. The rule's own exception at (d)(2) saves only systems used "solely" for fraud, anti-money laundering, age verification or responsible-gambling interventions "designed to reduce, and do not promote, wagering." Everything else in a modern consumer app sits inside the prohibition and has to climb out through a clear-and-convincing presumption. That is not a compliance burden; for some features it is a prohibition with extra steps. Expect the comment letters to say so, expect a First Amendment argument about compelled disclosures and restricted commercial speech, and expect a State Administrative Procedure Act argument that the Commission has not shown the rule's reach is rationally related to the harm.

That argument is serious and it will narrow the final text. It does not persuade us that the proposal is wrong, for one reason sitting in the rule itself: subdivision (d)(1) leaves promotions entirely lawful so long as they go "uniformly to all eligible patrons at the same time and through the same channels, under published objective criteria not derived from predicted behavior." Published, under 5404.1(a)(7), means public and filed with the Commission before the offer takes effect.

So New York has not banned bonuses, odds boosts or loyalty programmes. Volume-based loyalty tiers are explicitly preserved at (e). What it has banned is the private offer — the one whose existence, size and timing depend on a model's read of you, and which no other customer can see and no regulator was shown. That is a coherent line, and it is roughly the line securities regulation drew decades ago about selective disclosure.

The weakest part of the Commission's position is the one we would concede immediately: the racing carve-out is unprincipled. A horseplayer's bankroll is not less destructible than a parlay bettor's. The honest description is that one industry got an exemption with a warning label attached, and the rest got a prohibition. If the Commission believes the warning label is adequate protection at the track, it owes the public an explanation of why it is not adequate protection everywhere — and if it is adequate everywhere, this rule should have been a disclosure rule.

There is also what the proposal does not touch. O'Dwyer spent Friday asking operators to build a shared responsible-gambling data system so that a customer restricted by one book cannot simply open an app next door, and warned that "if the industry does not address it, then we will address it, and they may not like the situation or the solution that we come up with." Nothing in Part 5404 requires that sharing. The rule reaches inside each licensee and not across them. That gap is the subject of the Commission's other proposal, and of our next piece.

One more asymmetry is worth naming, because it is the shape of the next two years. Part 5404 binds "licensees" — a definition at 5404.1(a)(2) that runs to casinos, mobile operators, skins, video lottery agents, racetracks, off-track betting corporations, account wagering providers and lottery couriers. It does not reach a federally designated contract market, because New York does not license one. We searched the CFTC's own October 9 interim final rule for any analogue: the word "advertise" appears in it only where the Commission is quoting PASPA and a state statute. There is no federal rule about how a prediction market may market. New York is about to tell DraftKings it may not time a message. It cannot tell an exchange anything at all.