Self-exclusion holds 6 months—the win-back email fires at 5

The email lands on day 152. It's friendly, no hard sell — "we've noticed you've been away, here's 50 free spins, no deposit needed." The only problem is that the person receiving it asked to be left alone until day 182, because that's how long their self-exclusion was supposed to run. Under the national self-exclusion register, BetStop, a minimum exclusion is six months. Six months is 182 or 183 days depending on the calendar. Day 152 is five months. Somewhere in the gap between those two numbers, a marketing trigger is firing early, and it's not an isolated glitch.

The maths of a five-month win-back

BetStop launched in August 2023 and by late 2024 had passed 40,000 registrations — a number that tells you the register is doing real work, not sitting idle. The scheme lets you exclude from every licensed interactive wagering operator in Australia in one go, for a minimum of six months, extendable up to permanently. That's the floor, not a suggestion. Operators are required to check the register before letting anyone open or hold an account, and to stop sending marketing material to registered people.

So how does a win-back email reach someone on day 152? A few plausible routes, and none of them are flattering.

The first is that the exclusion date and the marketing suppression date are stored in different systems. The compliance team knows the exclusion runs to day 182. The CRM platform, which was probably bolted on before BetStop existed, has its own "dormant customer" rule that triggers at 150 days of inactivity. Nobody reconciled the two. The email goes out because the left hand doesn't know what the right hand is legally obliged to do.

The second is subtler. Some operators run win-back campaigns on a rolling basis and treat "self-excluded" and "closed account" as the same category, then apply the same reactivation logic to both. A closed account can be marketed to. A self-excluded one can't. If your segmentation collapses those two into one bucket, you've just built a compliance breach into your automation.

The third is the ugliest: someone knows, and the campaign runs anyway because the expected value of a returning depositor is worth more than the fine they think they'll cop. That's a harder accusation to prove, but the pattern — early, persistent, personalised win-backs to excluded users — is consistent with it.

What the rules actually say, and where they're soft

The Interactive Gambling Act and the BetStop rules are reasonably clear on the obligation: once you're on the register, licensed operators must not send you gambling promotional material. The Australian Communications and Media Authority (ACMA) has been active on this front, issuing infringement notices to operators for marketing to self-excluded customers. Fines have run into the hundreds of thousands of dollars for individual breaches.

But here's the gap. The rules tell operators not to market to excluded people. They don't always specify the technical mechanism, the audit trail, or the reconciliation window between the exclusion end date and the marketing suppression flag. That leaves room for "we didn't know" defences that are technically true and practically convenient. If your CRM can't see the register, you can argue you weren't marketing to an excluded person — you were marketing to a lapsed customer who happened to be excluded. That distinction shouldn't survive contact with a regulator, but it does buy time.

There's also the question of what happens at day 183. When the six months lapse, the exclusion ends automatically unless the person extends it. At that point, marketing is legal again — and you can bet the win-back machinery is primed. The interesting compliance question isn't just "did you email too early," it's "what does your day-183 campaign look like, and did you build it with the same care you'd build any other reactivation?"

Why six months is the number, and why five is a tell

Six months wasn't chosen at random. Problem gambling research consistently points to the first three to six months after a break as the highest-risk window for relapse, which is why the minimum exclusion is set at the longer end of that range. The register exists precisely because willpower alone doesn't hold for everyone, and a cooling-off period needs to be long enough to actually cool something off.

That makes an email at five months more than a minor timing error. It lands inside the window the policy was designed to protect. If the person is still fragile at day 152 — and a decent share are — a "50 free spins" nudge isn't a neutral marketing message. It's a test of whether the exclusion is real or just a suggestion with a countdown.

The tell is in the specificity. A generic "we miss you" blast to a dormant list is sloppy. A personalised win-back with a bonus sized to the person's historical spend, timed to land just before the exclusion lapses, is a system that was built to do exactly this. One is incompetence. The other is design.

What to actually check if you're the one excluded

If you've self-excluded and you're still getting emails, the practical steps matter more than the outrage.

First, document everything. Screenshot the email, note the date, and check it against your BetStop exclusion end date. If the email arrived before day 182, you have a complaint.

Second, report it. BetStop has a complaints process, and the ACMA takes marketing-to-excluded-customer reports seriously because they're easy to prove and embarrassing for the operator. You don't need a lawyer. You need a timestamp.

Third, check whether the email came from the operator directly or from an affiliate. Affiliates are a known weak point — they often run their own lists and don't have register access. That doesn't excuse the operator, because the operator is responsible for its affiliates' conduct, but it changes who you complain to and how fast it gets fixed.

Fourth, if the emails keep coming, extend your exclusion. The register lets you push it out to permanent. That's not a defeat. It's using the tool as designed.

The question nobody's asking loudly enough

The real issue isn't one early email. It's that the compliance architecture for self-exclusion was built to stop new accounts and live marketing, not to govern the messy middle — the lapsed, the dormant, the about-to-return. That's where the automation lives, and that's where the gaps are.

So here's the open question: if an operator's CRM can't reliably suppress a self-excluded customer until day 182, what else is it getting wrong? The win-back email is just the visible symptom. The invisible one is whatever fires at day 183, 184, and 185 — and whether anyone's watching.