The €91 Billion Elephant: Romania’s Regulator Just Told Google, Meta and TikTok the Party Is Over

Seventy percent. That is the share of Europe’s online gambling market operating outside any licensing regime — roughly €91 billion of GGR a year flowing to operators who have never filed a compliance report, never funded a responsible-gambling programme, and never written a cheque to a treasury.

Read that again, because the industry has spent a decade pretending the number was somewhere in the teens. It is not. The licensed European market is the minority shareholder in its own sector.

And here is the part that should genuinely irritate anyone who has ever paid for a licence: that black market is not hiding on the dark web. It is buying ad inventory on Google, Meta and TikTok, sitting in the same auction, targeting the same players, in the same feed, one scroll away from the operators who did everything by the book.

Romania’s National Gambling Office — the ONJN — has finally said the quiet part into a microphone. Its president, Vlad-Cristian Soare, has put the tech platforms, the payment processors and the affiliate ecosystem on formal notice. Not a press release. A legal notification, with the Digital Services Act loaded behind it.

Let’s strip the PR spin off both sides and look at what actually changed.

The Numbers ONJN Put on the Table

Regulators love adjectives. This one brought a spreadsheet.

Metric	Figure
European online black market share	~70% of the market
Estimated annual black-market GGR (EU)	~€91 billion
Sites blacklisted 2013 → April 2025 (12 years)	~1,500
Sites blacklisted April 2025 → August 2026 (16 months)	~1,180
Sites added in two sessions (30–31 July 2026 alone)	800
DSA removal orders issued	200+
Platform compliance rate with removal orders	98%
Platform response deadline	5 hours
Criminal complaints filed (recent months)	40+
Illegal gaming devices seized (last 12 months)	300+

Look at the first two rows of that blacklist section side by side. Twelve years to reach 1,500. Sixteen months to add another 1,180 — 800 of them in a single 48-hour committee sprint. That is not a regulator that suddenly discovered enthusiasm. That is a regulator that finally built a clone-detection tool capable of identifying platforms that share the same technical root and simply respawn under new domains.

Which tells you exactly what the enforcement problem always was: it was never about finding the operators. It was about the fact that they multiply faster than a paper-based procedure can list them.

Among the newly blacklisted names: Polymarket — the prediction market that has spent two years insisting it isn’t gambling, to an audience of regulators who have unanimously decided it is. We covered that specific decision when it landed in Polymarket blacklisted in Romania, and it remains the cleanest available case study in how “we’re a technology layer” holds up in front of a supervisory committee. It doesn’t.

Criminal complaints have gone out against platforms that weren’t even being subtle — NV Casino, Verde Casino, Vulkan Casino. These weren’t obscure Telegram-link operations. They were running mainstream, high-budget, publicly visible acquisition campaigns in a regulated market.

The DSA Lever: Five Hours, 98% Compliance, and Why It Still Isn’t Working

Here is where ONJN did something genuinely clever, and I don’t hand that compliment out often.

Most EU regulators have the Digital Services Act sitting in a drawer, admiring it as a concept. Romania wrote the DSA’s content-removal mechanism directly into national gambling law, with ANCOM as the enforcement partner. ONJN is one of the very few Romanian institutions that has actually detailed the national procedure the DSA permits, rather than waiting for Brussels to explain it again more slowly.

The result is an operational weapon:

• ONJN issues a removal order for illegal gambling content.
• The platform has up to 5 hours to act.
• Non-compliance triggers the full DSA escalation mechanism, via ANCOM.
• Current compliance: 98%.

Two hundred orders issued. Ninety-eight percent honoured. On any regulator’s KPI dashboard, that is a triumph.

And it has barely moved the needle.

This is the trap, and every regulator in Europe is going to walk into it. You can hit near-perfect compliance on the orders you send and still lose, because you are measuring your own throughput, not the market. The black market is 70% of the sector and regenerates domains through mirror sites, subdomains and alternative URLs faster than any takedown queue can drain. Every domain rotation restarts the whole cycle: identify, blacklist, notify the ISPs. Add VPN circumvention on the player side and the picture is complete — blocking is a continuous operational function, not an intervention. It’s a treadmill with a KPI attached.

Soare knows it. Which is why the notification he sent the platforms isn’t about the blacklist at all.

The Legal Distinction That Should Terrify Every Ad Platform

This is the single most important paragraph in the entire story, and it has been almost universally missed.

Under OUG 77/2009, a platform’s obligation is not “do not carry advertising from operators on the ONJN blacklist.”

The obligation is: accept advertising only from operators licensed in Romania.

Those are not the same standard. They are not remotely the same standard.

• Blacklist-based compliance is reactive. The regulator finds it, names it, you remove it. Your exposure is limited to your response time.
• Whitelist-based compliance is proactive. You verify the licence before the ad serves. Your exposure is every single ad you ever ran from an unlicensed operator, blacklisted or not.

Google’s own statement to the Romanian press actually describes the correct standard — it permits gambling ads in Romania only where the advertiser is registered with ONJN and holds a valid licence, and it confirms it received and responded promptly to the regulator’s request. Good policy on paper. ONJN’s formal notification is, in effect, a polite way of saying: then explain the hundreds of unlicensed operators currently advertising.

Because the enforcement gap between a written policy and an ad auction processing millions of impressions per second is exactly where the black market lives.

If you are a licensed operator in Romania and you have ever wondered why your CPAs look uncompetitive, this is your answer. You are bidding in an auction against operators with zero GGR tax exposure, zero compliance overhead, zero responsible-gambling spend and zero AML function. That is not a market. That is a subsidy for the non-compliant, administered by the ad platforms. For the full picture of what the compliant side actually costs, see our breakdown of the ONJN licence and why it matters and the current Romania licensing costs, process and ONJN requirements for 2026.

The CJEU Just Removed Google’s Favourite Shield

Two weeks ago, the timing got considerably worse for the platforms.

The Court of Justice of the European Union upheld a €750,000 fine against Google, imposed by Italy over gambling advertising on YouTube. The core holding is the part that matters:

Google can be held liable for the YouTube videos of a content creator with whom it has a commercial partnership.

The Court found Google cannot claim intermediary liability protection when it has examined a creator’s channel before entering into a commercial partnership. Google says it is disappointed, wants clarification, and will argue before the Council of State.

Strip away the procedural noise and here is the doctrine that survives: the moment you commercially vet a partner, you stop being a neutral pipe.

Now map that onto affiliate marketing.

Affiliates are commercially vetted. Revenue-share agreements are commercially vetted. Influencer partnerships are commercially vetted. Ad accounts with dedicated account managers are commercially vetted. If due diligence destroys the hosting defence, then the entire “we’re just a platform” position across the acquisition stack is a good deal shakier than the industry has been assuming.

For anyone operating in the Romanian affiliate space, this sits directly on top of the licensing obligation we analysed in Romania’s Class II affiliate licence — the €35,000/year “serious operator” filter. The €35,000 gate looked expensive when it was announced. Compared to being characterised as a commercially-vetted partner of an unlicensed operator, it’s starting to look like cheap insurance.

The Uncomfortable Numbers on the Platform Side

Google’s 2026 ad safety report confirmed the scale for the first time in an official document:

Google Ad Safety Data (2025)	Figure
Gambling-related ads removed	270+ million
Gambling rank among prohibited ad categories	8th largest
Gambling rank among restricted ad categories	3rd largest (123.9m)
Policy-violating ads removed	99%+

Google credits advanced AI — Gemini analysing hundreds of billions of signals including account age, behavioural cues and campaign patterns, understanding intent rather than matching keywords, blocking pre-emptively even when content is engineered to evade detection.

That is an impressive capability statement. It also raises an obvious question: if your models are that good at understanding intent, how is illegal gambling advertising still, in the regulator’s own words, at an alarming scale on Google, Meta, TikTok and the App Store?

And then there’s Meta, where the reporting is considerably less flattering. Per internal documents surfaced by Reuters:

• A December 2024 document indicates Meta shows users approximately 15 billion “higher-risk” scam ads — ads carrying clear fraud signals.
• Meta earns roughly $7 billion annually from that category of fraudulent advertising.
• Meta bans an advertiser only when its automated systems are at least 95% certain the marketer will commit fraud.
• Below that threshold — where the advertiser is still assessed as a probable scammer — Meta charges higher ad rates as a penalty, the theory being that pricing will deter them.
• A November 2025 internal projection reportedly put around 10% of ad revenue as coming from illegal activity.
• Because Meta’s personalisation engine optimises to user interest, a user who clicks one fraudulent ad is served more of them.

Sit with the mechanics of that third and fourth point. The system does not remove the probable fraudster. It surcharges him. The suspected bad actor is not excluded from the market — he is repriced into a premium tier.

As former Meta safety investigator Sandeep Abraham put it: regulators would not tolerate banks profiting from fraud, and they should not tolerate it in tech.

He is right, and the analogy is sharper than he made it. In financial services this has a name: it is the logic of high-risk merchant acquiring. Elevated risk, elevated rate, risk priced rather than refused. Every payments professional in this industry recognises that model instantly — because it is the model that got a generation of PSPs fined into oblivion. Applying it to ad inventory is the same trade with better margins and, until now, no regulator watching.

The Payments Squeeze: Complicity Is Now on the Table

Here is where it gets operationally serious, because ONJN did not stop at content.

Legislative amendments already adopted have hardened the obligations on payment processors:

• PSPs must block transactions to unlicensed platforms.
• PSPs must report identified cases periodically to ONJN.
• ONJN has sent PSPs a formal notification: fail these obligations and the regulator will treat you as acting in complicity with black-market operators — with sanctions that include criminal liability.

Read that word again. Complicity. Not “non-compliance.” Not “administrative breach.” Complicity — which converts a compliance failure into a participation offence, and moves the exposure from the company’s P&L to named individuals.

ONJN also acknowledges what every acquirer already knows: illegal operators use increasingly sophisticated evasion — masking transactions and using false merchant category codes. MCC manipulation is the oldest trick in the high-risk playbook, and the fact that a gambling regulator is now naming it explicitly in enforcement correspondence means the acquiring side of this business has stopped being a technicality and started being evidence.

Named in the regulator’s cooperation appeal alongside the tech platforms: Mastercard, Visa and Revolut, plus the wider processor ecosystem. Anyone still under the impression that payment rails are a neutral utility in this sector should update their model.

What’s Actually Coming: The Legislative Rewrite

Soare has confirmed the framework itself is being reopened, with the headline change being easier licence revocation. The specific items flagged for the new normative framework:

• Minimum standards for game rules — an end to house-drafted terms nobody can parse.
• Regulation of test account conditions — directly tied to identified GGR manipulation risk.
• Rules on live streaming — the acquisition channel that has outrun every existing advertising rule.
• Stricter advertising content rules.
• Clearer rules on what actually constitutes a white label.

That last one deserves its own paragraph. The white-label question has been the industry’s favourite grey zone for fifteen years: who is the operator, who is the brand, who holds the liability, and who does the regulator get to fine. Romania proposing a legal definition means every white-label arrangement in the market is about to be re-characterised by someone other than its own lawyers. If your structure depends on ambiguity, read our comparison of white label versus turnkey casino solutions and then read your own contracts with fresh eyes.

This lands on top of an already busy amendment cycle — the 2026 Romanian gambling regulation update covering the local council veto and the 10-year B2B licence renewal cycle and the broader Romanian gambling regulation overhaul. B2B suppliers should be reading all of it against their own position — the Romania Class 2 B2B licence: fees, timeline and documents sets the baseline.

Enforcement capacity is being extended too. Remote gambling from devices not belonging to the account holder has been prohibited — killing the clandestine bar-tablet operations that had quietly scaled across the country, with 300+ devices seized in a year. And because ONJN’s inspection headcount cannot physically cover Romanian territory, a legislative proposal endorsed by the Ministry of Internal Affairs will extend control powers to Romanian Police officers.

That is a structural change, not a procedural one. It converts gambling enforcement from a specialist regulatory function into general policing capacity.

The Tech Build: Two Systems, Q2 2027

Two IT systems are entering approval at the CTE (the Technical-Economic Committee for the Information Society), targeted for Q2 2027:

1. An integrated digital platform for all internal and external institutional flows — eliminating paper, increasing decisional traceability, automating repetitive processes, electronic document management and archiving, automatic data extraction, and integration with existing and future systems.
2. An integrated GIS system for traceability, monitoring, verification and publication of data on slot machines and VLT terminals across Romania.

Slot and VLT operators should read point two carefully. Geolocated, published, per-terminal data is a permanent audit trail on the entire land-based estate. Combined with the local council veto powers already in play, the land-based footprint in Romania is becoming a fully mapped, publicly visible object. For anyone holding or planning a Class 1 slot machines licence, that is a material change to the operating environment.

Separately — and sooner — ONJN is building a metadata analysis system with ADR support, operational by the end of 2026. It will:

• Monitor transactions performed by licensed organisers.
• Automatically flag suspicious operations.
• Detect sites operating without a licence.
• Automate the issuance of removal orders and blacklist inclusion.

Automated removal-order issuance is the piece that changes the arithmetic. The 800-site blacklist sprint in July was the manual proof of concept. Automate that pipeline and the treadmill finally starts running at domain-rotation speed.

Note the first bullet, though, because it is aimed at the licensed side of the market. ONJN has explicitly identified suspicious transactions and GGR manipulation risk among organisers it regulates. If you hold a Romanian licence, the metadata system is not a black-market tool. It is an audit of you.

Romania Is Not Alone: The UKGC Comparison

The UK Gambling Commission’s numbers on the same problem:

UKGC Enforcement	Figure
URLs reported to Google for de-indexing/ad removal	100,000+
Cease-and-desist / disruption orders issued	770+
— targeting operators	262
— targeting advertising	205
Sites removed	64,000

UKGC chief executive Andrew Rhodes described the strategy plainly: stop the illegal market operating at scale in Britain, by concentrating effort as far upstream as possible — at hosts, payment providers, software suppliers and search engines.

That is the same doctrine ONJN is executing, and it is the correct one. Chasing individual domains is whack-a-mole. Chasing the chokepoints — hosting, payments, search, app stores, software supply — is enforcement with leverage. Two regulators of very different sizes have independently converged on it, which usually means it’s the only thing that works.

For operators comparing regulatory postures across jurisdictions before choosing where to sit, the upstream-enforcement trend is now a material planning input — whether you’re assessing the Isle of Man, Curaçao, or the Dutch reform package.

Operational Impact: What This Actually Means for You

If you are a B2C operator licensed in Romania

• Your acquisition economics are about to improve — if enforcement holds. Every unlicensed competitor removed from the Google and Meta auction is downward pressure on your CPA. This is the first credible attempt to make the licensed market’s cost base competitive rather than merely lawful.
• Your affiliate stack is now a liability surface. Post-CJEU, commercial vetting defeats the neutrality defence. Audit every affiliate and influencer relationship for licence status in every market they push traffic into — not just Romania.
• Assume your transaction data is being read. The metadata system goes live at the end of this year and explicitly targets GGR manipulation. Reconcile your reporting now, while reconciliation is still a housekeeping exercise rather than an interview.
• Licence revocation is getting easier by design. The framework that made revocation slow and contestable is exactly what’s being amended.
• Test accounts, live streaming and game rules are all being brought in scope. These are the three areas where nearly everyone’s internal practice is undocumented. Document it.

If you are a B2B supplier or platform provider

• The white-label definition is the existential item. A legal definition determines who the regulator considers the operator — and therefore who carries liability when a brand on your platform goes wrong.
• Software and game producers are named in ONJN’s responsibility appeal, alongside the platforms and PSPs. Supplying an unlicensed operator is being framed as facilitation, not as a commercial relationship.
• Your B2B licence renewal cycle just became a 10-year strategic decision, not an administrative one.

If you are an affiliate or influencer

• You are explicitly named in the regulator’s list of parties with legal, not merely moral, obligations.
• The CJEU ruling means a commercial partnership is precisely the fact pattern that removes intermediary protection.
• Promoting operators into markets where they hold no licence is now a documented enforcement priority in at least two EU jurisdictions.

If you are in payments

• Blocking obligations and periodic reporting are already law.
• Complicity — with criminal exposure — is the stated framing for non-compliance.
• MCC misuse and transaction masking are named in enforcement correspondence. Your risk team should be treating merchant category integrity as a regulatory matter, not a chargeback-ratio matter.

The Second-Order Effect Nobody Wants to Discuss

Here is the part the regulators consistently under-model, and I’d be doing this newsletter a disservice not to say it plainly.

Soare himself acknowledges the mechanism: the black market creates a major imbalance against licensed operators who carry the full compliance load, and this can encourage those licensed operators to migrate toward the grey or black market.

That is a remarkably honest sentence from a sitting regulator, and it deserves to be taken seriously rather than filed as rhetoric.

Because enforcement pressure alone does not eliminate demand. It relocates supply. Squeeze the advertising channel without addressing the underlying economics — tax burden, product restrictions, marketing limits — and you don’t get a compliant market. You get a market where the compliant operators bear costs their competitors don’t, until enough of them conclude the licence isn’t worth the arithmetic.

The Romanian approach is currently better than most precisely because it isn’t just enforcement. Easier revocation is paired with “a fair market for both organisers and players.” Whether the fairness half arrives with the same energy as the enforcement half is the entire question. Regulators are consistently better funded on the punitive side than the structural side.

And there is a governance dimension that can’t be ignored either. ONJN is pursuing an aggressive credibility-based enforcement campaign against some of the largest companies on earth — while its own institutional history includes a DNA bribery investigation. Moral authority is the primary asset in an upstream enforcement strategy, because you are asking private actors to police a market voluntarily. That asset has to be maintained.

The Bottom Line

Soare framed his statements as “a final call for dialogue, responsibility and cooperation” — explicitly not populist, explicitly not offensive.

Let’s translate from regulator into operator. “Final call for dialogue” means the dialogue phase is over. What follows is the DSA escalation mechanism with ANCOM, criminal referrals against payment processors, and a legislative rewrite designed to make revocation fast.

He also made the correct structural point: this is a European problem and it cannot be solved by sector regulators alone. Platforms, PSPs, software producers, affiliates and influencers all take financial benefit from the black market’s existence. All of them therefore carry the obligation to stop facilitating it. A €91 billion untaxed market, outside regulatory oversight, capable of facilitating organised crime and terrorist financing, is not a gambling-policy footnote. It is a financial-crime problem that happens to wear a casino logo.

Here is the veteran’s read.

Nothing in this file is unprecedented. We’ve watched this exact sequence run before — in payments, when acquirers discovered that “we just process transactions” stopped being a defence; in affiliate marketing, when the FTC decided disclosure was mandatory; in every jurisdiction that eventually concluded intermediaries are participants. The pattern is always identical: an intermediary profits from a market it claims not to be part of, until the day a court decides the profit is the participation.

The CJEU just wrote that decision down for ad platforms. Romania is stress-testing how far it goes.

For licensed operators, this is — genuinely, if enforcement holds — the best regulatory news in years. You have spent a decade competing against operators with a structural cost advantage built entirely on non-compliance. Someone has finally aimed at the distribution layer that made that advantage possible, rather than at you.

The smart move is not to wait and see whether it works. It’s to be immaculate on the specific items being tightened — affiliate licensing status, test accounts, streaming, white-label structure, transaction integrity — before the automated systems go live at the end of the year. Because when removal-order issuance and suspicious-transaction flagging become automated, enforcement stops being a queue somebody has to work through and becomes ambient.

The state will always find a way to tighten the rake. It always has. But the operators who survive every squeeze are never the ones who complained loudest about it — they’re the ones who read the amendment three months early, restructured quietly, and were already compliant on the morning the rest of the market discovered there was a deadline.

The wheels keep spinning. Just make sure yours are the licensed ones.

Frequently Asked Questions