DraftKings AI probe expands as Michigan joins Massachusetts review

Dean Serpa sent a five-page letter on October 9 to seven licensed mobile sports betting operators in Massachusetts, each one carrying more than seventy individual questions and a November 3 deadline. The letter did not ask whether operators use artificial intelligence. It assumed they do, and asked them to account for every system, every data input, and every human capable of overriding a model's recommendation. That is a different kind of question.

The review began because of a single New York Times report alleging that DraftKings deployed machine learning to identify customers most likely to lose and direct promotions at them. DraftKings denied wrongdoing. The Massachusetts Gaming Commission responded by sending the same letter to every licensed operator — not because it had found a violation, but because it could not yet determine whether it had. MGC Commissioner Paul Brodeur noted that Massachusetts is one of the only states to reference AI in its existing regulations at all. That statutory gap is exactly what the letter is probing.

The Michigan Gaming Control Board has since told reporters it is also reviewing the issues raised by the Times report, though it has not committed to a formal inquiry specific to DraftKings and its statutes do not address AI directly. Two states, two different regulatory postures, one underlying question about whether the system can explain itself.

The MGC's letter defines AI broadly enough to cover any automated tool that ranks, classifies, or generates predictions about a patron — including tools operators describe internally as personalisation or risk assessment. That framing matters. An operator can truthfully say it does not use AI in marketing while running a segmentation model that determines which patrons receive which offers on which days. The MGC is asking operators to close that definitional gap themselves, in writing, under confidentiality.

The most structurally significant section of the letter asks whether an operator could, if required, identify precisely why a specific patron received a specific promotion on a specific day — the data inputs, the model weights, the human review step, if any. In my experience building automated systems, the answer to that question is almost never a clean yes. Models optimised for engagement do not produce audit trails as a byproduct. Producing one requires a deliberate architectural choice made before deployment, not after a regulator asks.

That is where the Massachusetts review is likely to find its friction. Operators may be able to demonstrate that their stated policies prohibit targeting losing bettors. Whether their actual system architecture enforces those policies is a different matter entirely, and the MGC appears to understand the difference. The November 3 deadline will produce disclosures. What happens after depends on whether the commission finds the architectures match the policies — or whether the gap between them is wide enough to require something more formal than a letter.