CRM guides
Suppression Lists for Self-Exclusion and Objections
A suppression list keeps the minimum data needed to make sure a person is never marketed to after they self-exclude, join a national register or object to marketing. It must sit outside every campaign tool and be checked on every send.
In short
- Suppression is the safe way to honor an objection: the Information Commissioner's Office (ICO) describes it as keeping "just enough information" to respect the preference in future.
- In Great Britain, self-excluded customers must be removed from marketing databases or flagged within two days of the completed notification.
- Ontario requires reasonable steps to stop marketing to self-excluded people, within 24 hours for people added to its central registry; Australia bars direct marketing to people on BetStop.
- Old exports and recycled lists are a documented cause of failures, so suppression must apply at send time, not at list-building time.
Scope and limits. Covers Great Britain, Ontario, Australia and one United States example (Pennsylvania). Other Canadian provinces and US states have their own programs. This is research, not legal advice.
What a suppression list is
A suppression list is not a deletion. When someone objects to marketing or self-excludes, deleting their data would remove the very record that stops them being contacted again, for example if their address arrives later from another source. The ICO puts it this way: "Suppression involves retaining just enough information about them to ensure that their preference not to receive direct marketing is respected in future."
Hold only what is needed to match: an internal customer ID, hashed contact details for matching new imports, the reason, the start date and the end date where one applies. How this fits with deletion requests is covered in data minimization.
Types of suppression
| Reason | Blocks | Source of the fact |
|---|---|---|
| Operator self-exclusion | All gambling marketing for the exclusion period | Your responsible gambling system |
| National or provincial register match (GAMSTOP, BetStop, BetGuard) | All gambling marketing while registered | The register's check service |
| Objection to direct marketing | All direct marketing, indefinitely | Customer request, any channel |
| Channel opt-out | Marketing on that channel | Unsubscribe link, STOP reply, preference center |
| Safer gambling flag | Marketing and bonus offers, per your policy | Customer interaction process |
When a safer gambling flag stops marketing is explained in safeguarding overrides.
How fast it must apply
Great Britain. Social responsibility code 3.5.3 requires licensees to "take all reasonable steps to prevent any marketing material being sent to a self-excluded customer", and to remove or flag the customer's details "within two days of receiving the completed self-exclusion notification." Under social responsibility code 3.5.5, most remote licensees must also "participate in the national multi-operator self-exclusion scheme", which is GAMSTOP. The code lists exceptions, such as host, gambling software and some ancillary and lottery licenses.
Ontario. The Alcohol and Gaming Commission of Ontario's (AGCO) Standard 2.14 asks operators to "take all reasonable steps to prevent any marketing material, incentives or promotions from being sent" to self-excluded players. Ontario's centralized program for regulated online gambling, BetGuard, is run by iGaming Ontario and launched on May 14, 2026. Since then, Standard 2.14.1 requires operators, "no later than 24 hours after an individual is added to the Centralized Self-Exclusion Registry," to "take all reasonable steps to prevent any marketing material, incentives or promotions from being sent to that individual."
Australia. The Australian Communications and Media Authority's (ACMA) guidance for wagering providers says the Interactive Gambling Act bars "direct marketing to a self-excluded individual" registered with BetStop. The law does "not prescribe when a wagering provider must check BetStop", and "The onus is on the wagering provider to prove" it took reasonable precautions.
Pennsylvania, as a US example. The state's iGaming self-exclusion leaflet says operators must "ensure that self-excluded persons do not receive junket solicitations, targeted mailings, telemarketing promotions" and other promotional material.
General consent and opt-out law for each market is in direct marketing consent rules by market.
Where failures come from
The Gambling Commission's guidance on self-excluded customers lists failures that operators reported, including "individual members of staff using manual “workarounds”" and "the recycling of old customer lists which had not been updated". In June 2025 the ACMA found that four wagering providers had sent marketing to people registered with BetStop.
Each of these failures bypasses a check that existed. That is why the suppression list should be read by the send itself, through the decision point described in CRM architecture, and not only when a segment is built.
When buying a CRM, ask for a demonstration of exclusion precedence; the test is in the CRM platform criteria.
A minimum record
Example, illustrative only:
| Field | Example value |
|---|---|
| customer_ref | C-1042 |
| match_keys | SHA-256 of normalized email and phone |
| reason | national_register |
| register | GAMSTOP |
| started_on | 2026-10-12 |
| ends_on | none recorded |
| last_checked | 2026-10-28 |
Integration tests for exclusion feeds are listed in the CRM integration checklist. How the record reaches each system is covered in propagating preference changes. What a customer can do to reverse an opt-out is covered in withdrawal and opt-out handling. Other topics are in all CRM guides.
Questions
Can a customer on a suppression list ever be marketed to again?
After an opt-out, only if they give fresh consent. After self-exclusion, only once the exclusion has ended and the market's rules allow it; some programs offer lifetime exclusions that never end.
Should suppression match on hashed contact details?
Matching on hashed email and phone helps stop a re-imported address from slipping past, while keeping less readable data.
Sources
- Gambling Commission, LCCP 3.5.3 Self-exclusion - remote SR code, no date shown.
- Gambling Commission, LCCP 3.5.5 Remote multi-operator self-exclusion SR code, no date shown.
- Gambling Commission, Ensuring self-excluded customers do not receive your marketing materials, last updated April 13, 2022.
- Information Commissioner's Office, Right to object, page dated March 25, 2025 (under review after the Data (Use and Access) Act).
- Alcohol and Gaming Commission of Ontario, Registrar's Standards for Internet Gaming, marketing and self-exclusion sections updated May 14, 2026.
- Alcohol and Gaming Commission of Ontario, Self-exclusion and breaks in play, updated May 14, 2026.
- Alcohol and Gaming Commission of Ontario, AGCO's centralized self-exclusion standards are now in effect, May 14, 2026.
- Alcohol and Gaming Commission of Ontario, Safer gambling, no date shown.
- Australian Communications and Media Authority, FAQs for wagering providers: BetStop, the National Self-Exclusion Register, no date shown.
- Australian Communications and Media Authority, Four betting services breach gambling self-exclusion rules (MR 15/2025), June 2025.
- Pennsylvania Gaming Control Board, iGaming Self-Exclusion (Responsible Play), modified May 8, 2026.
Every source was read on October 28, 2026. How we choose sources: data sources.
Safer gambling support is listed on the safer gambling page.