The direct messaging channels that iGaming operators rely on most, email and browser or app push notifications, have both undergone significant structural changes in 2024. Google and Yahoo tightened bulk sender requirements in February, Apple continued expanding its Mail Privacy Protection footprint, and major mobile operating systems raised the bar for push permission prompts. Operators who have not audited their messaging infrastructure since late 2023 are very likely losing deliverability, reach and ultimately revenue.
What Changed on the Email Side
Google's bulk sender policy, which took effect for Gmail in February 2024 and reached full enforcement by June, introduced three non-negotiable requirements: authenticated sending via SPF, DKIM and DMARC, a one-click List-Unsubscribe header present in every commercial message, and a sustained spam-complaint rate kept below 0.10 percent. Yahoo adopted nearly identical rules on the same timeline.
For gaming operators, the practical implications go beyond a technical checklist. Many brands rely on third-party affiliate-driven email lists that were built without rigorous double opt-in practices. Those lists are now a liability. A single campaign to a poorly maintained segment can push complaint rates above threshold and trigger throttling or outright blocking across Gmail infrastructure, which handles a substantial share of player inboxes in most regulated markets.
DMARC Is No Longer Optional
Setting a DMARC policy of at least p=none is now the minimum to clear Google's requirements, but operators should be targeting p=quarantine or p=reject as soon as their sending infrastructure is properly aligned. A DMARC policy at reject level also reduces spoofing risk, which is a genuine brand-protection concern in an industry that remains a frequent target of phishing campaigns impersonating casino brands.
Push Notifications: A Shrinking Permission Window
Browser push adoption peaked several years ago and has been declining as Chrome, Firefox and Safari have all moved toward more friction in the permission prompt experience. Safari on iOS 16.4 and later added web push support, which sounds like good news, but it comes with strict conditions: the site must be installed as a home screen web app, and the permission request can only fire after a user gesture. Android 13 introduced a similar explicit permission model for app push notifications, ending the legacy behaviour where apps received push permission automatically at install.
The result is a smaller but significantly more intentional push subscriber base. Open and click rates on push have risen in verticals that managed the transition well, because the remaining subscribers genuinely want to hear from the brand. Operators who treat this as a volume problem and try to compensate by sending more frequently to a smaller list will see unsubscribe and block rates climb rapidly.
Segmentation and Timing Matter More Than Volume
Effective push strategy in this environment requires tighter segmentation than most gaming CRM teams currently apply. Key operational adjustments include:
- Separating transactional push messages, such as deposit confirmations and withdrawal status updates, from promotional messages and giving each category its own send cadence.
- Using behavioural triggers rather than calendar-based batch sends; a push sent within minutes of a player completing a session converts at a meaningfully higher rate than a generic weekly promotion.
- Capping promotional push frequency at a level informed by unsubscribe data, not by how many promotions the marketing team wants to run.
- Testing permission prompt timing carefully; on mobile web, the moment a prompt appears relative to a player's session depth has a direct impact on opt-in rate.
Compliance Intersections Operators Cannot Ignore
Both channels carry regulatory obligations that sit alongside deliverability concerns. Under GDPR and equivalent frameworks in markets like Ontario or Malta, operators must be able to demonstrate a lawful basis for each message sent. For promotional email and push, that basis is typically explicit consent. Self-exclusion and cooling-off flags must suppress recipients across all direct channels simultaneously; a player who has requested a break must not receive a bonus push notification, full stop. This is an area where CRM tooling and responsible gambling systems must be integrated, not run in parallel silos.
Deliverability and compliance are two sides of the same operational coin. A message that reaches the inbox but was sent without valid consent is a regulatory exposure; a compliant message that lands in spam is a commercial failure. Operators need both to work together.
What Operators Should Prioritise This Quarter
An honest audit of current email authentication records, complaint-rate history in Google Postmaster Tools, push opt-in rates by acquisition channel, and suppression list integrity will surface the highest-priority gaps. Most operators running their own CRM will find at least one domain that lacks a DMARC policy and at least one player segment receiving push messages at a frequency that is not justified by engagement data. Fixing those two issues alone will improve both deliverability metrics and the regulatory risk profile of the messaging programme.
