What Personal Information Can an Ontario Online Casino Collect?

Quick Answer: Collection Must Have a Real Purpose

A regulated Ontario online casino may collect enough personal information to create and protect an account, confirm eligibility and location, move money, record play, meet anti-money-laundering duties, provide support, reduce gambling harm, and investigate security or fraud. It should not treat that list as permission to collect every possible detail from every player.

iGaming Ontario's privacy policy says the exact categories depend on why information is collected and whether a legal obligation applies. It lists identifying and demographic details, contact information, physical and IP-address location data, professional information, financial or banking details, play and payment history, and customer-service interactions. Other data can arise from the account process, such as login, audit, responsible-gambling, and security records.

Data request -> stated purpose -> only needed fields
                         |
                         v
                  secure handling
                         |
                         v
             access / correction / complaint

This guide applies to adults using regulated sites while physically in Ontario. Casino play is 19+. It was checked against official sources on September 20, 2026. It is desk research, not legal advice, and it does not describe the practice of every operator.

First Confirm That the Casino Is in Ontario's Regulated Market

Privacy rights are easier to use when the legal operator and exact website are known. For a private operator, compare the exact domain with iGaming Ontario's current directory. Do not rely on a brand name, logo, app-store listing, advertisement, or the fact that a site accepts Canadian dollars. OLG.ca is legal under OLG's separate conduct-and-manage structure and is not a private operator in that directory.

The Ontario legal-casino checker explains that verification process. Once the domain is confirmed, read the privacy policy, Ontario notice of collection, terms, and cookie notice shown for that site. The iGaming Ontario policy says operators provide a notice explaining the specific collection purposes for a program, service, or offering.

If the domain is absent, misspelled, or reached only through an unexpected message, stop before uploading identity or banking records. A copied privacy statement does not make a site regulated.

What Counts as Personal Information Here?

Personal information is broader than a name or identity document. Under the definition described in iGaming Ontario's policy, it is recorded information about an identifiable individual. A single item may identify a person directly, while several ordinary-looking items can identify the person when combined.

For an online casino account, that can include account-registration details, a photo or document number, home and email addresses, phone number, IP address, payment-account details, deposits, withdrawals, bets, wins and losses, account limits, self-exclusion status, support messages, complaint records, login events, and fraud or risk flags connected to the player.

Not every possible category is collected in every case. Ask four simple questions: What exact field is needed? For what purpose? Who controls it? How long will it be kept? A useful answer should be more specific than saying that the information is collected for security or compliance.

The Main Data Categories at a Glance

This table describes possible data, not a universal collection checklist. The operator should connect each requested item to a current purpose and notice.

Identity, Contact, and Address Data

AGCO Standard 3.04 requires relevant player information to be collected and saved at registration and shown to be complete, accurate, and validated before an account is created. Its minimum list is the player's name, date of birth, address, a later-login identifier such as a username, contact information, and information required by federal anti-money-laundering law. Standard 3.06 says player information must remain complete and accurate.

Those outcomes do not require the same document from every player. One operator may verify information electronically. Another may need a driver's licence, passport, proof of address, selfie, or additional record when an automated check fails or information does not match. The Ontario casino ID guide separates the required facts from the possible verification methods.

Ask which fact a document will prove and whether a less revealing document is accepted. Do not alter a genuine document, use another person's record, or hide a required field. Do ask whether irrelevant details can be masked before uploading.

Location and Device Data

AGCO Standard 3.02 says games on gaming sites may be provided only within Ontario unless they are conducted with another province. Operators must detect and dynamically monitor the location of a player attempting to play, repeat checks at reasonable intervals, block unverified attempts, and detect tools capable of bypassing location controls.

That can produce location results, timestamps, IP addresses, and technical signals from a browser, app, network, or device. iGaming Ontario's privacy policy specifically lists physical address and the IP address used by a device as location data. It also explains that operator sites can use cookies and similar analytics tools. An operator's own notice should identify any further device or app data it collects.

A location check is not permission to track a player for every unrelated purpose. Ask whether precise coordinates are collected, whether the operator keeps the raw location or only a pass/fail result, how long failed checks remain, and whether optional analytics can be disabled. Do not use a VPN, emulator, remote desktop, or other workaround to defeat location controls. See the Ontario location-rules guide for the play requirements.

Payment and Financial Data

Payment information can include the deposit or withdrawal method, transaction amount and time, account-holder name, partial or full account details where necessary, payment references, ownership evidence, and information used for a source-of-funds review. iGaming Ontario's policy lists banking details used for payments or withdrawals and payment history as possible personal information.

AGCO Standard 3.15 requires players to have clear access to deposit and withdrawal history, current balance, and the method and source of funds used for transactions. Federal FINTRAC rules separately require casinos to create and keep defined account, receipt-of-funds, transfer, disbursement, and other records in stated circumstances.

A request for a bank statement should state the reason, date range, fields that must remain visible, and secure upload route. It is not proof that every transaction on the statement is relevant. The Ontario casino document guide explains how proof of address, payment ownership, and source of funds differ.

Play and Account-Transaction Data

AGCO Standard 3.13 requires all player-account transactions to be recorded and logged accurately and completely. Standard 3.14 says account information must be readily available to the player. Standard 3.15 requires clear access to specified transaction information.

The minimum player-facing list includes deposits, withdrawals, current balance, payment method and source, previous login date and time, game-event and transaction history, current and past sports bets where applicable, total money wagered, total money won or lost, and the balance at the start and end of a session. These records can resolve a balance, game, or withdrawal dispute and can also support legal, security, and safer-gambling controls.

A casino should not make an account-history screen impossible to understand. Save relevant statements or exports before closing an account, especially when a complaint, charge, open bet, or withdrawal is unresolved.

Support, Complaint, and Responsible-Gambling Data

A support contact can create a chat transcript, email, call recording, case number, agent note, attachment, and resolution record. iGaming Ontario's policy identifies customer-service interactions and responses to questions, comments, and concerns as collection purposes. Before a recorded call, the notice should explain the recording and its purpose.

Responsible-gambling records may include deposit, spend, loss, or time limits; play breaks; self-exclusion; changes to tools; contacts from the operator; and behavioural indicators. AGCO's guidance for Standards 2.10 and 2.11 says operators should use available data to identify people who may be at risk and provide suitable support. Examples include repeated limit increases, play-break use, prior self-exclusion, player age, and occupation.

This monitoring is meant to reduce harm. It does not make every guess about a player correct. If a restriction or intervention appears to rely on wrong facts, ask what personal information can be accessed and corrected. The Ontario safer-gambling tools guide explains limits, breaks, and self-exclusion.

Security, Login, and Audit Data

AGCO Standard 3.10 requires an auditable trail for account creation, activation, deactivation, and changes, including player identification and verification information and player contracts. Standard 3.12 requires authentication before account access or gambling and says players must have an option to use multi-factor authentication. Standard 3.15 requires the previous-login date and time to be visible.

Security records can therefore include login attempts, password or MFA events, account changes, session identifiers, unusual device or payment matches, alerts, and investigation notes. Some access information can be withheld under a legal exception if disclosure would expose another person, confidential commercial information, security risks, or certain investigations. That does not erase the general right to ask.

Use a unique password and enable MFA. If a login or change is unfamiliar, secure the connected email account first and use the hacked casino account checklist.

What AGCO Standards 5.02 and 5.24 to 5.26 Require

These are operator outcomes, not a player instruction to upload more information. A player can still ask why a field is necessary, who can access it, and which retention rule applies.

Can an Ontario Casino Ask for Your SIN?

Treat a Social Insurance Number request as unusual and sensitive. Service Canada's current guidance says a SIN is confidential, is not an identity document, and should be shared only when legally required. Its 2026 Code of Practice says a private-sector organization should not use a SIN as ordinary identification and cannot require it from a client without a legal need.

A casino may need information required by federal anti-money-laundering law, but that statement alone does not show that a SIN is the required document. FINTRAC's casino record list commonly refers to names, addresses, dates of birth, occupations, accounts, and transaction details; do not assume that the mention of federally required information in AGCO Standard 3.04 creates a blanket SIN requirement.

If asked for a SIN, do not send it immediately. Ask in writing:

1. Which law and section require the SIN for this exact purpose?
2. Is the SIN mandatory or optional?
3. What alternative identity document is accepted?
4. Who will receive it, how will it be protected, and when will it be destroyed?
5. How can consent be withdrawn if collection is optional?

Never send a SIN through ordinary email, text, social media, or a link in an unexpected message. A casino should never ask for an online-banking password, card PIN, one-time code, or remote access to a device.

Purpose, Consent, Use, and Sharing

iGaming Ontario's policy says the purpose should be explained before collection and only information necessary for that purpose should be collected. It also recognizes limited situations in which collection, use, or disclosure can occur without consent, such as a legal duty, fraud prevention, law enforcement, or public-safety matter.

Information can move among an operator, iGaming Ontario, service providers, payment providers, identity vendors, and government or enforcement bodies when the applicable purpose and law allow it. Ask whether the recipient is acting only as a processor, is using the data for its own purpose, or is receiving it because of a legal report.

Separate required account uses from optional marketing. Withdrawing optional marketing consent is not the same as deleting the player account, removing an anti-money-laundering record, or cancelling a self-exclusion. If a new use is unrelated to the original purpose, ask what authority or consent supports it.

FIPPA and PIPEDA: Why Both Names Can Appear

Ontario's Freedom of Information and Protection of Privacy Act, or FIPPA, governs provincial public institutions. AGCO Standard 5.26 says player-data collection and protection must meet FIPPA requirements. iGaming Ontario's privacy policy says information collected by iGaming Ontario, or by operators on its behalf, is collected under FIPPA and other applicable laws. It also says iGaming Ontario has control over player personal information in the regulated scheme.

PIPEDA is the federal private-sector privacy law. The Office of the Privacy Commissioner of Canada says it generally applies to private organizations that handle personal information in commercial activities in provinces without a substantially similar general private-sector law. Ontario has no such broad private-sector replacement, although its health privacy law has a limited exemption. PIPEDA also applies to commercial data flows across provincial or national borders.

The result is not a simple public-versus-private label. A private operator can handle some data on behalf of iGaming Ontario under the regulated scheme and may also conduct separate commercial processing to which PIPEDA applies. Custody, control, purpose, and the particular transaction matter. Start with the operator's privacy officer and iGaming Ontario's Privacy Office. Ask which organization controls the disputed record and which law it says governs the request. The IPC of Ontario or the federal OPC can help determine the proper route; this article cannot decide jurisdiction for an individual file.

How to Request Access to Your Personal Information

Begin with a focused written request to the operator's privacy contact. State the verified account name or player ID, the date range, and the records sought. Useful categories can include registration and identity records, account-change audit events, login records, payment and play history, support recordings or transcripts, complaint notes, location results, responsible-gambling interactions, and the purposes and recipients of the information.

Do not send more identification than needed with the first message. Ask what secure method will verify the requester. Keep the sent request, delivery evidence, and case number.

For information in iGaming Ontario's custody or control, its policy publishes a written access route through its Privacy Office. A formal request under FIPPA has statutory requirements, including a written request, enough detail to find the record, and the prescribed fee. For complete FIPPA requests received on or after July 1, 2026, the general response period is 45 business days, subject to permitted extensions or a lawful staged-access plan. That 45-business-day rule does not turn every ordinary operator support ticket into a formal FIPPA request.

If PIPEDA governs the private-sector request, the federal OPC says the organization generally must respond within 30 calendar days, with limited extension grounds. Access has lawful exceptions under both regimes, so a response may provide records with other people's details or protected material removed.

How to Correct Wrong Casino Information

Correct an error before it affects identity checks, payments, location review, responsible-gambling support, or a complaint. Send the operator the exact field, current value, proposed value, reason it is wrong, effective date, and the smallest reliable proof needed. Ask it to confirm whether related systems and recipients were updated.

AGCO Standards 3.04 and 3.06 support complete and accurate player information. iGaming Ontario's policy says a player may contact it or the operator, depending on who possesses the information, and request correction. Under FIPPA, a person who has obtained access can ask to correct an error or omission. If a correction is refused, the person can require a statement of disagreement to be attached and, in appropriate cases, sent to recipients from the preceding year.

Under PIPEDA, where it applies, a person can challenge accuracy and completeness. The organization should correct proven factual errors or record the unresolved challenge when it disagrees. Opinions, risk assessments, or dispute findings may not be replaced simply because the player dislikes them, but the underlying factual errors can still be identified and challenged.

Can You Ask the Casino to Delete Your Data?

Yes, you can ask, but deletion is not automatic or immediate. iGaming Ontario's policy expressly says a person may request deletion of personal information in its custody or control and will be told if it cannot be deleted. The policy also says records are securely disposed of after the applicable retention period ends.

For processing governed by PIPEDA, the federal principles say information should be kept only as long as needed for the identified purpose and then destroyed, erased, or anonymized. Consent may be withdrawn, subject to legal or contractual restrictions and reasonable notice. This is not an unlimited right to erase records that must still be kept for anti-money-laundering, tax, security, dispute, audit, self-exclusion, or other legal purposes.

Ask for a field-by-field answer: what will be deleted now, what will be anonymized, what must be retained, the authority and period for each retained category, whether backups follow a deletion cycle, and when completion will be confirmed. Closing or deactivating an account is not proof that all underlying information was erased. Use the Ontario account-closure checklist before requesting deletion.

How Long Can an Ontario Casino Keep Your Data?

There is no one universal casino-data retention period. Different records have different purposes, laws, starting dates, and deletion triggers. An operator should publish or explain its retention policy rather than give one vague number for everything.

FINTRAC's casino guidance creates several limited five-year minimums. For example, copies of specified reports are generally kept for at least five years from submission or creation, many transaction records for at least five years from creation, and certain account applications, operating agreements, signature cards, and intended-use records for at least five years after the account closes. The exact rule depends on the record.

That does not mean every chat, cookie, failed login, ID image, location point, or responsible-gambling note has a universal five-year period. It also does not mean every record must disappear exactly five years later. Other legal duties, a dispute, a legal hold, security evidence, or a longer stated purpose may affect retention. Ask the operator to name the category, start date, minimum and maximum period, disposal method, and legal basis.

What If the Data Is Stored Outside Canada?

iGaming Ontario's privacy policy says personal information used to provide and administer iGaming services may be stored by operators outside Ontario or Canada. Foreign storage is not automatically proof of a violation, but the information may be subject to the laws and lawful access powers of the place where it is processed.

Where PIPEDA applies, the federal OPC says an organization remains accountable for personal information transferred to a third party for processing and must use contractual or other means to provide comparable protection. It should be transparent about foreign processing and assess its risks. FIPPA and iGaming Ontario requirements may add separate obligations for data under iGaming Ontario's control.

Ask which countries are involved, which companies process the data, whether subcontractors are used, what safeguards and breach terms apply, how access or deletion reaches those systems, and whether an in-Canada option exists. Do not assume that the phrase cloud storage tells you where a record is kept.

How to Make a Privacy Complaint

Use the lane that matches the issue. A privacy complaint is different from a wager, withdrawal, or game-result dispute.

Wrong or unexplained data practice
              |
              v
     Operator privacy officer
              |
              +-- iGO custody/control or FIPPA issue -> iGO Privacy Office -> IPC Ontario
              |
              +-- PIPEDA commercial issue -> federal OPC
              |
              +-- gaming-standard or player-service issue -> operator complaint -> iGO Player Support

1. Write to the operator's privacy officer. State the event, date, data involved, policy or notice relied on, and requested outcome.
2. If the information is in iGaming Ontario's custody or control, contact its Privacy Office. Its policy publishes privacy@igamingontario.ca for access, correction, deletion requests, inquiries, and complaints.
3. For a FIPPA access or correction decision, use the IPC Ontario appeal route. As of July 1, 2026, an appeal from a decision notice generally must be filed within 30 business days. A privacy complaint about improper collection, use, or disclosure by a public institution can also go to the IPC.
4. If PIPEDA applies and the organization does not resolve the issue, use the federal OPC's complaint route. The OPC recommends contacting the organization's privacy officer first.
5. If the issue is also an unresolved private-operator gaming complaint, preserve the operator's formal complaint number and use iGaming Ontario Player Support. Do not expect a privacy regulator to decide a wager or payment dispute.

Keep copies, but redact unrelated personal information before sending it to a new recipient. Never publish identity documents or account records on social media to pressure an operator.

Safe Steps After a Casino Privacy Breach

A breach notice should describe what happened, the information affected, steps the organization took, and actions the person can take. Verify the notice through the casino's known domain or app before clicking a link or calling a number in the message.

1. Save the notice and write down the affected fields, dates, operator case number, and contact person.
2. Secure the email account connected to the casino, then the casino account. Use unique passwords, enable MFA, and ask the operator to end unknown sessions or block changes.
3. Check the casino balance, login, deposit, withdrawal, and play histories. Preserve unfamiliar entries without continuing to gamble.
4. If card or bank data may be exposed, contact the issuer through its official app, statement, or card number. Review transactions and follow its replacement or alert advice.
5. If government ID or a SIN may be exposed, follow the issuing authority's guidance. Service Canada says to monitor credit and financial records and report proven SIN misuse promptly.
6. Review both Canadian credit reports and consider fraud alerts if identity fraud is suspected. Report unauthorized accounts to the creditor and bureaus.
7. Report actual fraud or identity theft to local police and the Canadian Anti-Fraud Centre. A privacy concern without fraud can still use the operator, iGaming Ontario, IPC, or OPC route.
8. Watch for follow-up recovery scams. Do not pay a fee, send cryptocurrency, install remote-access software, or share a password, PIN, one-time code, or wallet phrase.

The federal OPC advises affected people to read and keep the notice, change passwords, monitor accounts, consider credit alerts or reports, and contact the organization's privacy officer with questions. No step guarantees that misuse will not happen, so keep monitoring appropriate to the information exposed.

A Privacy Checklist Before You Upload a Document

1. Verify the exact private-operator domain in iGaming Ontario's directory, or start from OLG.ca for OLG.
2. Open the account yourself instead of using an unexpected message link.
3. Confirm the same request inside the secure account.
4. Ask for the purpose, legal authority, fields, date range, recipient, retention period, and secure upload route.
5. Ask whether unnecessary fields may be masked. Follow the written answer; do not alter required evidence.
6. Never send a password, PIN, one-time code, or remote-access permission.
7. Do not provide a SIN as routine ID. Ask for the exact legal need and an alternative.
8. Use the approved encrypted uploader, not ordinary email or social media.
9. Save the request, the file name, upload confirmation, privacy notice, and case number.
10. After the check, ask how to access, correct, or later delete information that is no longer required.

A legitimate request can still be broader than necessary or poorly explained. Asking precise questions protects the player and gives the operator a chance to clarify or narrow it.

Explain It to a 12-Year-Old

Imagine a casino account is a locked school file. The casino may need your name and birthday to make sure the file belongs to an adult. It may check where the phone is because Ontario games can be played only in Ontario. It also writes down money and game activity so the balance can be checked.

The casino should not grab every fact about you just because it has a file. It should say why each fact is needed, let only the right workers use it, lock it safely, and remove it when there is no good reason to keep it.

You can ask to see your file and fix wrong facts. You can ask for deletion, but some parts may need to stay for a law or an open problem. If the answer is unfair or confusing, start with the casino's privacy officer. Then the Ontario or federal privacy office can help find the right rule.

A SIN is like a master number for important government and money records. It is not a normal casino ID card. Do not share it just because someone asks.

Frequently Asked Questions