What happens to my personal data if a registered Ontario online casino is sold to a different company?

Your real concern here is pretty specific: if the company behind your Ottawa online casino account gets bought out, does your name, address, ID documents, payment history, and gambling activity just get handed to whoever bought the business? Here's how the layered protections in Ontario's regulated market actually work.

The AGCO's grip on who can hold your data

Ontario's regulated online gambling market runs on a dual-oversight structure. The AGCO's regulatory framework helps ensure that igaming in Ontario is conducted, managed, and operated with honesty and integrity, and protects the Ontario public and players. That protection doesn't evaporate the moment a company changes hands — it stays attached to the registration itself.

Ownership changes are a material event under AGCO rules. Failure to notify the Registrar of any material changes to information which occur after an application is filed may result in the refusal, suspension, or revocation of a registration. In practice, this means an operator can't quietly flip ownership and keep running. The AGCO will only register those operators who act with honesty and integrity, and in assessing eligibility, carries out risk assessments and due diligence investigations including assessments of character, financial history, and competence. A new owner would face exactly that scrutiny before being permitted to operate — and to hold your data — under an Ontario registration.

iGaming Ontario retains the right to audit and inspect operators' books of accounts and other records, materials, information, and data as they relate to the operation of the site during the term of the agreements and for a period of seven years thereafter. That audit right doesn't disappear in an acquisition; it travels with the operating agreement.

Federal privacy law adds another layer

On top of the gaming-specific rules, private-sector online casino operators in Ontario are subject to federal privacy law. PIPEDA is federal legislation that governs how private companies and not-for-profit organizations engaging in commercial activities can handle personal information. Under PIPEDA, individuals have rights over their personal information — including accessing, correcting, and controlling how it is used — and organizations must follow fair information principles such as accountability, consent, and safeguarding.

A corporate acquisition is a recognized scenario under PIPEDA. The acquiring company steps into the shoes of the previous data controller, but it inherits the obligations too — it cannot suddenly repurpose your data for something you never consented to. PIPEDA applies to businesses and provides that they must have consent to collect, use, or disclose personal information; in particular, businesses must obtain the consent of consumers to use their personal information. Changing the name on the corporate door doesn't reset those consent requirements.

What iGaming Ontario's own privacy framework says

iGaming Ontario — which became operationally independent in 2025 and conducts and manages the regulated market — has its own privacy policy that governs how player data flows between it and operators. Personal information collected by iGO or operators on behalf of iGO is collected in accordance with Ontario's Freedom of Information and Protection of Privacy Act and other applicable laws. Critically, personal information collected by iGO or operators is collected, used, disclosed, or retained in accordance with that policy, applicable laws, and records retention policies. Those retention rules don't get renegotiated because of a business sale.

Your self-exclusion status is separately protected. If you've registered through BetGuard — Ontario's centralized self-exclusion service, whose logo appears on every fully registered Ontario site alongside the iGaming Ontario logo — that exclusion runs across all registered operators. A new owner of a site cannot lawfully ignore an active BetGuard exclusion; it's held at the registry level, not just in the operator's own database.

What you can actually do

A few practical points for Ottawa players:

• Read the privacy policy before a deal closes. Registered operators are required to give players accurate information. If an acquisition is announced, the updated privacy policy must reflect who now controls your data.
• You can request access or correction. You may contact either iGO or the operator (depending on who has possession of your information) to provide any updates or corrections regarding your personal information.
• Verify the new entity is still registered. After any ownership change, the incoming company must hold its own valid AGCO registration to legally operate in Ontario. Check the official iGaming Ontario registry to confirm the site you're using is still listed — and still shows both the iGaming Ontario and BetGuard logos.
• AGCO has enforcement teeth. A player account shall be deactivated if requested by the Registrar — meaning if an incoming owner fails to meet standards, the regulator can intervene directly at the account level.

The short version: in Ontario's regulated market, your data doesn't simply transfer as a business asset with no strings attached. Both the AGCO's registration requirements and federal privacy law bind whoever ends up holding that data. That said, if you ever want to confirm a specific operator's current registration status, the live source is the iGaming Ontario registry at igamingontario.ca. And if gambling ever feels like it's causing you stress rather than entertainment, ConnexOntario is available at 1-866-531-2600 — 19+ to play in Ontario.