PLEASE NOTE text in underlined bold denotes an insertion and text between [brackets] denotes a deletion.
11 VAC 5-70-280 Geolocation Systems
A. A permit holder shall keep its geolocation system up to date, including integrating [the latest] current solutions in real time that can detect the use of remote desktop software, rootkits, virtualization, or any other programs identified by the Director as having the ability to circumvent geolocation measures.
B. At least [every 90 days] annually, a permit holder shall provide the Director evidence that the geolocation system is updated to the latest solution.
C. At least [every 90 days] annually, the integrity of the geolocation system shall be reviewed by the permit holder to ensure that the system detects and mitigates existing and emerging location fraud risks.
DraftKings respectfully requests this change to Section A to allow a permit holder to use an effective, regulatorily compliant solution even if it is not the latest iteration. Our proposed change to Section B ensures that all solutions are updated at least annually to the most current solution, and the change to Section C ensures that the integrity of the geolocations system is reviewed annually.
Currently, many operators in the U.S. utilize the same geolocation provider, so requiring each permit holder to provide evidence four times a year that their system is up to date and meets integrity standards is unnecessary, and any minimal benefit is outweighed by the burden this requirement places on the permit holder and the Director. Requiring a permit holder to provide evidence once annually that the geolocation system is updated and the integrity confirmed is a more reasonable requirement and could be aligned with other reviews performed by the Director, effectively utilizing time and resources of the Director and permit holders. The proposed changes also permit the Director the ability to require evidence on additional occasions if determined necessary.
D. In order to prevent unauthorized placement of an internet sports betting wager by an individual not within the Commonwealth of Virginia, the sports betting platform must utilize a geofencing system to reasonably detect the physical location of an individual attempting to access the sports betting platform and place an internet sports betting wager and to monitor and block unauthorized attempts to [access the internet sports betting platform in order to] place an internet sports betting wager when an individual is not within the permitted boundary.
DraftKings respectfully requests that this section be amended to clarify that only the placing of a wager on a platform is prohibited outside of the territorial bounds of the Commonwealth, rather than accessing the platform at all. Sports betting operators commonly make their platforms available nationally for people to access and explore, however the placing of a wager is strictly limited to within permissible geographic bounds.
11 VAC 5-70-290 Player Accounts
B. The information necessary to initiate a player account shall be recorded and maintained for a period of five years, and shall include at least the:
8. Document number of the government-issued identification credentials entered, or other methodology for remote, multi-source authentication, which may include third-party and governmental databases, as approved by the Director.
DraftKings respectfully requests clarification regarding the seeming conflict between 11 VAC 5-70-290 B 2, which requires that document numbers for government-issued identification credentials be maintained for five years, with the requirements of 11 VAC 5-80-50 A 5, which says that such information must be deleted from the permit holder’s records promptly after verification is complete.
E. A permit holder shall notify the player of the establishment of the player account by e-mail, text message, or first-class mail. [Once] When a player account is created, a secure personal identification (e.g., a unique username and password) for the player authorized to use the player account shall be established that is reasonably designed to prevent unauthorized access to, or use of, the player account by any individual other than the player for whom the player account is established.
DraftKings respectfully requests additional clarification regarding this requirement. Usernames are created during the registration process, so we respectfully suggest clarifying that this step does not happen after an account has been created. Furthermore, usernames are used for identification purposes and are publicly displayed on the platform and visible to other users, and therefore would not be considered secure personal information designed to prevent unauthorized access to an account. We suggest specifying that a password is also used to prevent unauthorized access.
G. A player account may be funded using:…
6. Cash;
7. A reloadable prepaid card, which has been verified as being issued to the patron and is non-transferrable; and
8. Any other means approved by the Board.
DraftKings respectfully suggests that cash and player cards be included as specifically authorized means to fund an account since the offering of the sports betting platform in physical locations is contemplated by 11 VAC 5-70-5 A 8.
R. A permit holder shall suspend a player account if:
1. The player asks for suspension for a specified period not [to exceed] less than 72 hours as a self-limiting measure;
DraftKings respectfully requests this change to reflect that 72 hours should be the minimum self-limiting period, rather than the maximum. We believe that the better responsible gaming policy is to provide users with at least a 72 hour cooling off period if they feel the need to self-limit before reengaging in participation.