Sky Bet reprimanded by ICO over "accidental technical error" relating to third-party data
Flutter-owned operator deemed not to have used personal information to target at-risk customers, but regulator insists policy at start of 2023 was “unlawful”
The Information Commissioner’s Office (ICO) has ruled Sky Betting and Gaming (SBG) did not deliberately misuse personal information to target vulnerable gamblers, although a reprimand has still been issued against the operator.
Between 10 January and 3 March 2023, SBG was found to have begun processing people’s personal information, and subsequently sharing it with advertising companies.
However, this data sharing began when customers accessed the Sky Bet website and before they had the option to accept or reject advertising cookies.
According to the ICO, this meant customer data “could be used to target them with personalised adverts without their prior consent or knowledge”.
In a 13-page ruling published today, the ICO laid out the investigation into SBG and its infringements of UK GDPR, although the regulator noted the operator had not used data to target at-risk bettors.
Following claims from campaign group Clean Up Gambling in January 2022 that SBG was sharing customer data with third parties, the ICO informed the Leeds-based operator in October 2022 it would begin an investigation into the allegations.
During the investigation, the ICO found certain cookies were being deployed before Sky Bet users had interacted with a pop-up outlining what accepting cookies would mean for their data.
The ICO said: “The result [was] that visitors’ personal data was being processed and made available to AdTech vendors through the use of cookies and without visitors’ knowledge or consent.”
In one such example, MediaMath, a demand side platform (DSP) contracted by SBG, used a pixel embedded within Sky Bet to “facilitate the setting of approximately 40 third-party marketing cookies” before customers set their preferences.
SBG made changes to its cookies process on 3 March 2023 after being informed by the ICO the day prior.
While the reprimand from the ICO contains no financial penalty, it has warned the Flutter-owned operator to maintain its processes and that further infringements could result in formal regulatory action.
The ICO said: “While no evidence of deliberate misuse was found, the regulator concluded that Sky Betting and Gaming was processing personal data through the use of certain cookies in a way that was not lawful, transparent or fair.”
Deputy commissioner of the ICO Stephen Bonner said the enforcement action against Sky Betting and Gaming would serve as a “warning” to companies that deny consumers’ choice over their targeted advertising.
He noted: “Our enforcement action against Sky Betting and Gaming is a warning that there will be consequences if organisations breach the law, and people are denied the choice over targeted advertising.
“We are preparing to scrutinise the next 100 most-frequented websites, so I urge all organisations to assess their cookie banners now to make sure consent can be freely given before a letter arrives from the regulator.”
Alongside the publication of the SBG ruling, the ICO also announced that following its review of the most-visited 100 websites in the UK, more than half were using advertising cookies.
The ICO has since written to 53 companies to warn of potential enforcement actions if changes to respective cookies policies were not made to comply with data protection laws.
Of those companies, 52 have made changes, while gossip website Tattle Life has not yet engaged with the ICO on the matter.
The regulator said the site will now be “investigated for its use of cookies and apparent failure to register with the regulator”.
A spokesperson for SBG said: “Sky Betting and Gaming welcomes the ICO’s determination that, after an exhaustive 18-month investigation, it found no evidence to support the claims levelled at us by campaign group Clean Up Gambling.
“We separately note that the ICO reviewed the use of advertising cookies by 100 UK websites, including those of Sky Betting and Gaming, and found issues with more than half of them.
“We regret the accidental technical error which resulted in some customers’ information being incorrectly shared with our digital advertising partners without consent being obtained for a seven-week period at the beginning of 2023. We rectified this error within a day of becoming aware of it.
“Protecting our customers and their data remains the number one priority for Sky Betting and Gaming and we continue to work with the ICO to raise standards in this area.”