Gambling Advertising Rules in Cyprus (2026): NBA Guidance on Bonuses, Sponsorships & Influencers

Gambling advertising rules Cyprus operators must follow are entering a decisive phase in 2026, with the National Betting Authority (NBA) signalling tighter scrutiny of AI-driven targeting, bonus promotions and influencer marketing. For in-house counsel, compliance managers and marketing leads at Cyprus-licensed operators, the practical question is no longer whether advertising is permitted, but how to run campaigns that survive regulatory review. This explainer translates the NBA’s remit, the overlapping EU frameworks and the 2026 direction of travel into actionable guidance, with sample ad redlines, contract clauses and a compliance checklist. Everything below is anchored to primary regulatory sources so your marketing programme can be defended, not just launched.

1. Executive summary: what operators must know about gambling advertising rules in Cyprus (2026)

Before diving into the detail, here are the six compliance actions every Cyprus-licensed operator should prioritise under the current gambling advertising rules Cyprus framework:

• Age-gating. Deploy robust age verification across all channels so advertising is not served to, or accessible by, minors.
• No targeting of minors. Exclude under-age audiences from all targeting, lookalike modelling and creative placement.
• Clear bonus terms. Present the material terms of any bonus, free bet or promotion prominently alongside the headline offer, never buried in footnotes or separate pages.
• Influencer disclosure. Require unambiguous, prominent disclosure that influencer and affiliate content is commercial, and prohibit misleading claims about odds or guaranteed returns.
• Sponsorship transparency. Make branding and commercial relationships clear, and avoid glamorising gambling or associating it with minors.
• AI targeting controls. Govern profiling and programmatic delivery under a lawful basis, with vendor due diligence and documented safeguards.

These actions reflect the direction the NBA has set out and the EU frameworks, the General Data Protection Regulation (GDPR) and the Audiovisual Media Services Directive (AVMSD), that sit alongside domestic rules. The rest of this article explains each in operator-ready terms.

2. Can you advertise gambling in Cyprus? Legal framework & NBA remit

Yes, you can advertise betting products in Cyprus, but only if you hold the appropriate licence and your advertising complies with the conditions set by the National Betting Authority alongside consumer protection and data protection law. Betting in Cyprus is governed principally by the Betting Law (as amended), under which the NBA is the dedicated regulator responsible for licensing, supervision and enforcement. It is important to note that most forms of casino-style gambling are regulated separately and land-based casino activity falls under a different regime and regulator; this article focuses on the betting advertising sphere supervised by the NBA.

The gambling advertising rules Cyprus operators face apply whether the advertising is delivered online or offline. Digital display, social media, affiliate links, influencer content, broadcast spots and physical placements all fall within scope. Because Cyprus is an EU member state, domestic rules interact with EU-level instruments that govern audiovisual advertising and data-driven targeting. The practical consequence is that a single campaign may need to satisfy the NBA’s conditions, the GDPR’s rules on profiling and consent, and the AVMSD’s protections for minors simultaneously.

Where advertising sits within the licensing framework

Advertising obligations are embedded in licence conditions rather than treated as a separate permission. When the NBA grants a betting licence, the operator accepts ongoing obligations that include responsible marketing, accurate promotional claims and the protection of vulnerable groups. Breaching an advertising rule is therefore a breach of licence conditions, which is why advertising compliance should be governed by the same internal controls, sign-off processes and audit trails that cover the rest of your regulated operation. Marketing teams working in isolation from compliance is one of the most common structural risks.

Overlapping rules (broadcast, consumer law, data protection)

Three external frameworks regularly overlap with the NBA’s requirements. The AVMSD, as transposed into Cyprus law, sets rules for audiovisual commercial communications, including protections for minors and restrictions on how sponsorship is presented on television and radio. Consumer protection principles require that promotional claims are not misleading and that material conditions are disclosed. The GDPR governs any use of personal data for targeted or profiled advertising, requiring a lawful basis and, in many cases, valid consent. A compliant campaign is one that passes all three tests, not just the NBA’s.

3. Who regulates gambling advertising in Cyprus? The NBA and overlapping authorities

The National Betting Authority is the primary regulator for betting advertising in Cyprus. It issues licences, supervises operator conduct and takes enforcement action where advertising breaches licence conditions or responsible-marketing expectations. For most advertising questions, the NBA is your first reference point and the body whose published guidance should drive internal policy.

However, the NBA does not operate alone. Several authorities have an overlapping remit that affects how gambling advertising must be designed and delivered:

• Office of the Commissioner for Personal Data Protection. The Cyprus data protection authority supervises how operators and their vendors use personal data for targeted advertising, including cookies, consent mechanisms and profiling. Its guidance is directly relevant to programmatic and AI-driven campaigns.
• Broadcasting and audiovisual regulation. Television and radio advertising is subject to audiovisual rules implementing the AVMSD, overseen by the Cyprus Radio Television Authority, including protections for minors and conditions on sponsorship presentation.
• Consumer protection. The Consumer Protection Service of the Ministry of Energy, Commerce and Industry supervises general rules against misleading commercial practices, which apply to promotional claims.

In practice, the most defensible approach treats the NBA as the lead authority while mapping each campaign against the data protection and audiovisual frameworks that apply to the channel and targeting method in use.

4. What changed in 2026, NBA conference & practical implications for gambling advertising rules Cyprus

2026 has been flagged across the industry as a turning point for gambling advertising rules Cyprus operators must apply. The NBA’s annual conference and the surrounding regulatory commentary have put three themes at the centre of attention: AI-driven targeting, stricter expectations around bonus promotions, and more robust influencer transparency. While the detailed wording of any new guidance should always be read from the NBA’s own publications, the direction of travel is clear and operators should prepare now rather than waiting for enforcement.

The practical implication is that advertising programmes built for a lighter-touch era need to be re-examined. Campaigns that relied on aggressive bonus headlines, opaque influencer arrangements or broadly targeted programmatic delivery are the most exposed. Industry observers expect the NBA to focus its early scrutiny on precisely these high-visibility practices, because they are the easiest to identify from public-facing creative and the most likely to attract complaints.

A sensible compliance timeline is to audit existing campaigns against the themes below, remediate the highest-risk items first, update internal sign-off processes, and refresh contracts with influencers, affiliates and ad-tech vendors to reflect the new expectations. Treat 2026 as the year to close the gap between what your marketing has historically done and what the regulator now expects.

AI-driven targeting & profiling, what the NBA expects

AI-driven targeting is a headline risk area for 2026. Where campaigns use profiling to decide who sees a gambling advertisement, the GDPR applies directly: operators need a lawful basis for processing, must be transparent about profiling, and must respect the heightened requirements that attach to automated decision-making and profiling. For targeted advertising delivered through cookies and similar technologies, valid consent is typically required, in line with the ePrivacy regime and Cyprus data protection authority guidance.

The likely practical effect of the NBA’s focus is that operators will be expected to demonstrate control over the entire targeting pipeline, not just their own systems but those of the demand-side platforms and ad networks that deliver creative on their behalf. That means vendor due diligence, contractual guarantees on data handling, documented exclusion of under-age and vulnerable audiences, and limits on lookalike or predictive modelling that could inadvertently reach minors or self-excluded individuals. Being able to evidence these controls is as important as having them.

New expectations for bonuses, sign-up offers and prominent T&Cs

The second major shift concerns bonuses and sign-up promotions. The expectation is that material terms are prominent, not hidden, and that headline claims are not misleading. The following phrasing illustrates what to avoid in bonus advertising:

• Avoid: “Free €50, no strings attached!” where wagering requirements, minimum deposits or time limits in fact apply.
• Avoid: “Guaranteed winnings” or any claim implying a risk-free outcome.
• Avoid: “Bet now before you miss out” framing that creates false urgency or pressure.
• Prefer: “Get a €50 bonus on your first deposit. Wagering requirements and T&Cs apply, see full terms.” with the material conditions genuinely accessible and clear.

Template only, legal counsel should tailor to your licence and facts.

5. Detailed rules & best practice: bonuses, free bets & promotions

Bonus and promotional advertising attracts a disproportionate share of regulatory attention because it directly influences player behaviour. Under the current approach to bonus restrictions Cyprus betting operators should assume that any promotional claim must be accurate, complete and understandable at the point the consumer encounters it. The core principle is that a reasonable consumer should not be surprised by a condition that materially affects the value of the offer.

The following do and don’t list captures the practical standard:

• Do state the key condition alongside the headline, for example wagering requirements, minimum odds, qualifying deposits and expiry periods.
• Do use plain language that an ordinary consumer can understand without legal training.
• Do ensure the offer is genuinely available on the terms advertised.
• Don’t describe an offer as “free” or “risk-free” if conditions apply that limit withdrawal or require staking.
• Don’t use countdown pressure tactics that undermine responsible play.
• Don’t target promotions at audiences that include minors, self-excluded players or identifiable vulnerable groups.

Here is a side-by-side illustration of compliant versus non-compliant promotional text:

Template only, legal counsel should tailor to your licence and facts.

Clear T&Cs & risk messaging

Terms and conditions should not be treated as a legal formality buried behind a link. The material terms, those that affect whether and how a consumer can benefit, belong with the offer itself. Responsible-gambling messaging should also feature consistently, reinforcing age restrictions and signposting support. A practical T&Cs snippet for a deposit bonus might read: “New customers only. Minimum deposit €10. Bonus subject to 10x wagering on qualifying markets within 30 days. Full terms at [link]. 18+. Please gamble responsibly.” The placement matters as much as the content: the headline and the key condition should be visible together.

Internal record-keeping & audit trails for promotions

Every promotion should leave an audit trail. Retain the creative, the full terms, the approval sign-off, the targeting parameters and the dates the promotion ran. If the NBA queries a campaign, the ability to produce a complete record of what was advertised, to whom and under what terms is the difference between a swift resolution and a protracted investigation. Align promotional record retention with your wider regulatory record-keeping policy so nothing falls through the gaps.

6. Sponsorships, partnerships & event marketing, compliance checklist

Sponsorship is a powerful marketing channel but one that carries specific obligations under the sponsorship rules betting Cyprus operators must observe. The overriding duty is to avoid glamorising gambling and to avoid any association with minors. Stadium branding, broadcast sponsorship and event partnerships must be designed so that they do not appeal to or target under-age audiences, and so that commercial relationships are transparent.

A practical sponsorship compliance checklist includes:

• Audience assessment. Confirm the sponsored property, event or broadcast does not have a predominantly under-age audience.
• Branding placement. Ensure logos and messaging comply with audiovisual sponsorship rules and are not placed where they would primarily reach minors.
• Responsible messaging. Include age restrictions and responsible-gambling references where format allows.
• Transparency. Make the commercial nature of the sponsorship clear in line with AVMSD requirements for audiovisual sponsorship.
• Documentation. Keep records of the compliance assessment for each partnership.

Draft contract clauses (safety valve / exit on breaches)

Sponsorship and partnership contracts should give the operator the ability to protect its licence if the counterparty’s conduct creates compliance risk. Useful clauses include a compliance warranty requiring the partner to adhere to applicable advertising and responsible-gambling rules; an audit right allowing the operator to review how its brand is used; an immediate takedown or correction obligation on notice of non-compliance; and a termination right where a breach is material or repeated. A model warranty might read: “The Partner warrants that all use of the Operator’s brand will comply with applicable Cyprus betting advertising rules, data protection law and audiovisual regulation, and will not target or appeal to persons under 18.

” Template only, legal counsel should tailor to your licence and facts.

7. Influencer & affiliate marketing, disclosures, contracts & monitoring

Influencer and affiliate marketing is the area where the gap between marketing practice and regulatory expectation is often widest. For influencer gambling ads Cyprus operators remain responsible for content published on their behalf, even where the influencer controls the account and the creative. That responsibility cannot be contracted away. The 2026 direction of travel points to firmer expectations on disclosure, accuracy and the protection of minors.

The core obligations for influencer and affiliate activity are:

• Clear disclosure. Every post must prominently and unambiguously disclose that it is a paid or affiliate promotion, not hidden in hashtags or dense captions.
• No targeting of minors. Influencers whose audiences skew under-age should not be used for gambling promotion, and content must not appeal to minors.
• No misleading claims. Prohibit statements about guaranteed wins, inflated odds or risk-free betting.
• Monitoring and takedown. Operate a process to monitor live content and secure rapid takedown or correction of non-compliant posts.

A model disclosure line for an influencer might read: “Paid partnership with [Operator]. 18+. Gamble responsibly. T&Cs apply.” The disclosure should appear where the viewer sees it first, not at the end of a long caption. Affiliate commission structures should also be reviewed so that incentives do not reward volume at the expense of compliance, for example, commissions tied purely to sign-ups can encourage aggressive or misleading promotion.

Tracking, cookies & consent, combining influencer posts with targeted ads

Influencer campaigns frequently feed into tracking and retargeting, which brings the GDPR and Cyprus data protection authority guidance directly into play. Where cookies or similar technologies are used to track users who click through from an influencer post, valid consent is generally required before non-essential tracking begins. Operators should not assume that legitimate interest covers behavioural advertising; the data protection authority’s guidance on cookies and consent should drive the mechanism you deploy. Document the legal basis for each processing activity and ensure your consent management platform genuinely blocks non-essential cookies until consent is given.

8. Age-gating, targeting and programmatic advertising (AI risks)

Age-gating is foundational. The age-gating gambling ads Cyprus standard requires that advertising is not served to, or readily accessible by, people under 18, and that targeting actively excludes under-age audiences. This applies to self-operated channels and to every platform, network and vendor in the delivery chain. The weakest link in that chain defines your exposure.

Practical measures include deploying age-verification on landing pages and account creation flows; applying age and audience exclusions in every ad platform; constraining lookalike and predictive modelling so that it cannot infer or reach under-age users; and excluding self-excluded players from all marketing audiences. Programmatic delivery amplifies the risk because placement decisions are automated and distributed across networks, which is exactly why the NBA’s 2026 focus on AI-driven targeting matters. Operators should be able to show that their programmatic stack enforces the same protections as their direct channels.

Vendor / tech checklist for DSPs & ad networks

Before contracting with a demand-side platform or ad network, operators should secure:

• Contractual compliance warranties. The vendor warrants it will enforce age exclusions and comply with applicable advertising and data protection rules.
• Data protection terms. Clear roles, lawful basis and GDPR-compliant processing terms covering any profiling.
• Audit rights. The ability to inspect how targeting is configured and how exclusions are enforced.
• Takedown and remediation. Obligations to correct non-compliant placements promptly on notice.

9. NBA enforcement, penalties & how to respond to investigations

Breaching the gambling advertising rules Cyprus operators are bound by is a breach of licence conditions, and the NBA has a range of enforcement tools. These typically escalate from formal notices requiring correction, through imposition of additional licence conditions or administrative fines, to more serious sanctions including licence suspension or revocation in the most significant cases. Rather than focusing on speculative monetary figures, operators should assume that any confirmed breach is a reportable regulatory event that must be handled with the seriousness it deserves. The precise sanctions and procedures are those set out in the Betting Law and the NBA’s published materials, which should be consulted for the current enforcement approach.

The complaint and investigation process generally begins with the NBA raising a concern, whether prompted by a complaint, its own monitoring or a public report, and requesting information. How an operator responds in the opening days shapes the outcome. A defensive, poorly documented response invites escalation; a prompt, evidenced and cooperative response supports proportionate resolution.

Template response checklist for operators (first 72 hours)

1. Appoint a lead. Designate a single point of contact, ideally your senior compliance lead, and loop in legal counsel immediately.
2. Preserve evidence. Freeze and retain the relevant creative, terms, targeting parameters, approvals and distribution records before anything is altered.
3. Pause if necessary. Suspend the advertising in question where there is a credible compliance concern, to limit ongoing exposure.
4. Assess and document. Conduct a factual assessment of what was published, to whom and under what terms, and record it.
5. Communicate carefully. Respond to the NBA within any stated timeframe, factually and without speculation, coordinating all external messaging through the lead contact.

Template only, legal counsel should tailor to your licence and facts.

10. Comparison table, NBA 2026 expectations vs earlier common practice

11. Practical compliance checklist & sample ad redlines

Use the following checklist to pressure-test any campaign against the gambling advertising rules Cyprus operators must meet:

• Is the operator licensed and the product within scope of the licence?
• Are all material bonus terms prominent and accurate?
• Is responsible-gambling and 18+ messaging present and visible?
• Are age and audience exclusions applied across every channel and vendor?
• Do influencer and affiliate posts carry clear commercial disclosure?
• Is there a lawful basis and valid consent for any profiling or tracking?
• Are records retained for creative, terms, approvals and targeting?

Sample redlines illustrate the standard in practice:

• Redline 1: “FREE BET, guaranteed!” → “Free bet offer for new customers. T&Cs and wagering apply. 18+.”
• Redline 2: “Can’t lose this weekend” → “Enhanced odds on selected markets this weekend. 18+. Gamble responsibly.”
• Redline 3: Influencer caption with #ad at the very end → Disclosure moved to the first line: “Paid partnership with [Operator].”
• Redline 4: “Deposit €10, get €50 free” (no conditions) → add “10x wagering applies. Full terms at [link].”
• Redline 5: Broad programmatic audience with no exclusions → add explicit under-18 and self-excluded audience exclusions.
• Redline 6: Sponsorship creative with no age reference → add “18+” and responsible-gambling signposting where format allows.

Template only, legal counsel should tailor to your licence and facts.

13. Next steps & related resources

Meeting the gambling advertising rules Cyprus operators face in 2026 is an ongoing programme, not a one-off project. The highest-value next steps are to audit current campaigns against the themes above, remediate bonus and influencer content first, refresh vendor and partner contracts, and document the controls you have in place so they can be evidenced to the NBA. Marketing and compliance should operate from a single playbook, with clear sign-off and record-keeping.

For deeper operational guidance, consider supporting work on responding to NBA investigations, influencer marketing contract clauses and disclosure templates, gambling licensing and advertising licence conditions, age verification and player-protection technology, and vendor due diligence for programmatic and AI targeting. Reviewing these alongside this pillar will help you build an advertising compliance framework that is both defensible and commercially effective. For a tailored review of your campaigns against the current gambling advertising rules Cyprus requires, a specialist compliance audit is the most efficient way to close gaps before they attract regulatory attention.

Sources

1. National Betting Authority (NBA), official site
2. GDPR (EU Regulation 2016/679)
3. Audiovisual Media Services Directive (Directive 2010/13/EU, as amended)
4. Office of the Commissioner for Personal Data Protection (Cyprus)
5. CyLaw, Cypriot consolidated laws database