Alberta has a gambling problem it can actually fix. About 70% of online gambling in the province happens on unregulated platforms, according to provincial data informing the new iGaming Alberta Act. That means most people placing bets online are doing so on sites that answer to no Canadian authority, hold no audited security credentials, and offer zero recourse if something goes wrong with a deposit or a payout. The money leaves Alberta, the data sits on servers with unknown protections, and the bettor has nothing but a Terms of Service page written in another jurisdiction to fall back on. The provincial government moved to address this with Bill 48 in spring 2025, and the regulatory structure now taking form will impose strict cybersecurity requirements on any operator that wants to do business here. If you plan to bet on sports in Alberta, the security side of that decision deserves your attention before any picks or parlays do.
What Bill 48 Built and Why It Matters for Your Data
Bill 48 introduced the iGaming Alberta Act, which created 2 new bodies. The Alberta iGaming Corporation, or AiGC, oversees market operations. The Alberta Gaming, Liquor and Cannabis Commission, or AGLC, serves as the market regulator. The minimum betting age was set at 18.
On January 13, 2026, the AGLC opened registration for prospective operators. The market is expected to launch later in 2026, and any operator going live must meet specific security benchmarks before accepting a single wager. These benchmarks are not optional, and they are not self-assessed. Independent auditors verify compliance.
The reason this matters to you as a bettor is straightforward. When you deposit money and provide personal information to a betting site, you are trusting that platform with your banking data, your identity documents, and your betting history. An unregulated operator has no obligation to protect any of it. A regulated one in Alberta will.
Checking an Operator’s Security Credentials Before You Deposit
Alberta’s upcoming regulated market requires licensed operators to hold a SOC 2 Type 1 attestation before launch, with ISO 27001 certification mandated by 2028. These are audited standards, not self-reported claims. Before placing money anywhere, confirm the platform carries AGLC registration, which remains the clearest proof of compliance.
PlayAlberta currently operates as the sole regulated option, though new entrants are expected once the market opens in 2026. Resources covering Alberta sports betting alongside provincial regulator databases can help bettors verify operator legitimacy before committing funds to any platform.
SOC 2 and ISO 27001: What They Actually Require
SOC 2 Type 1 attestation means an independent auditor has reviewed the operator’s systems and confirmed they are designed to protect customer data at a specific point in time. It looks at how the company handles security, availability, processing integrity, confidentiality, and privacy. The operator must demonstrate these controls exist and are properly structured before launch.
By 2028, Alberta will require 2 additional things from operators. The first is ISO 27001 certification, which is an international standard for information security management systems. It requires ongoing risk assessment, documented policies, and continuous improvement of security practices. The second is SOC 2 Type 2 attestation, which goes further than Type 1 by evaluating how effectively those controls operate over a period of time, typically 6 to 12 months.
This phased approach gives operators time to build their security programs properly while still requiring a baseline level of protection from day 1.
The Self-Exclusion System Alberta Got Right
One of the strongest pieces of Alberta’s new framework is its Centralized Self-Exclusion system. The AGLC manages it directly, and all operators must integrate with it through an API connection. If you register for self-exclusion, you are blocked across every licensed platform in the province. That includes online betting sites and land-based gaming venues.
This is worth paying attention to because other provinces have handled self-exclusion differently. Ontario, for example, does not use a centralized model. A person who self-excludes with 1 Ontario operator may still be able to access another. Alberta’s system removes that gap entirely. A single registration covers everything.
For bettors who want the ability to step back, this is a functional safeguard that works the way you would expect it to work.
How to Tell if a Site Is Legitimate
The simplest test remains AGLC registration. If an operator holds that registration, it means the AGLC has reviewed the platform, verified its security credentials, and approved it for operation in the province. If the site lacks AGLC registration, it is operating outside the regulated market, and you have no guarantee about what happens with your data or your money.
PlayAlberta is the only regulated online gambling site currently operating in Alberta. All of its revenue goes back into the province’s General Revenue Fund. Once the market opens in 2026, more operators will appear, but every single one will need that same AGLC registration to operate legally.
A few things to check before you deposit anywhere:
- Look for the AGLC registration number or mark on the site
- Confirm the operator appears in the AGLC’s public registry
- Check for references to SOC 2 attestation or ISO 27001 certification in the site’s security documentation
- Verify the site integrates with Alberta’s Centralized Self-Exclusion system
If the platform cannot confirm any of those, you are taking on risk that a regulated operator would not expose you to.
Unregulated Platforms and What You Give Up by Using Them
The 70% figure is hard to ignore. The majority of Albertans betting online right now are doing so on platforms that sit outside provincial regulation. These sites may function well for years without incident. They may also disappear overnight, freeze withdrawals, or suffer a data breach with no accountability to any Canadian authority.
When you use an unregulated platform, you give up dispute resolution through the AGLC, you lose the protection of audited security standards, and you have no access to the centralized self-exclusion program. Your personal data is governed by the laws of whatever jurisdiction the operator happens to be incorporated in, which may offer you very little in practice.
The appeal of unregulated sites often comes down to sign-up offers and odds. Those incentives exist because the operators are not paying the cost of compliance. The savings come from somewhere, and part of that somewhere is the infrastructure that would otherwise protect you.
Alberta’s regulated sports betting market is being built with specific, audited cybersecurity requirements that apply to every licensed operator. SOC 2 attestations, ISO 27001 certification, and a centralized self-exclusion system form the backbone of a framework designed to protect bettors at the data level. The AGLC registration remains the single most reliable way to confirm a platform meets these standards. Until the market opens later in 2026, PlayAlberta is the only regulated option. After that, more licensed operators will be available, but the same verification steps apply. Check the registration, confirm the credentials, and know what protections you are entitled to before you put money on the line.