A recovering gambling addict has won a significant case against Sky Betting & Gaming in the UK High Court. The court found that the online gambling platform unlawfully used his personal data for profiling and targeted advertising without proper consent.
On January 23, 2023, the court ruled that Sky Betting, operated by Bonne Terre Limited and Hestview Limited, lacked a legal basis to gather the anonymous claimant’s information through cookies and to profile him for marketing purposes. The judgment described these profiling practices as “parasitic,” highlighting that online gambling poses unique risks that can impair users’ judgment and autonomy. The court stressed that data controllers must obtain valid consent, which in this case was not achieved.
The UK’s General Data Protection Regulation (GDPR) states that consent for data processing must be “freely given,” “specific,” “informed,” and “unambiguous.” The court determined that Sky Betting did not meet these criteria, considering the claimant’s gambling addiction significantly impaired his decision-making. The ruling pointed out that there’s an increased chance of flawed consent among vulnerable individuals and that online gambling providers do not need to market to customers to facilitate gambling—they do it for profit.
AWO, the legal firm representing the claimant, noted that this ruling is unprecedented in the UK’s multibillion-pound online gambling industry and could have broad ramifications for companies that may have profiled vulnerable customers without consent.
Ravi Naik, legal director at AWO, expressed that his client feels vindicated by the ruling. He highlighted the victory for recognizing the claimant’s inability to consent to SBG’s invasive data collection and profiling aimed at pushing him to gamble beyond his means. The client remains astonished by the extent of data SBG collected about him.
As part of his recovery journey, the claimant aimed to shed light on these unlawful practices to help others affected by them. The goal is to signal to online gambling companies that they must adhere to legal standards in their marketing efforts, which could protect vulnerable individuals in the future.
The case began when the claimant filed Data Subject Access Requests (DSARs) to Sky Betting, unveiling the detailed personal data the company collected. AWO noted that this was only a fraction of what was ultimately revealed, showing the claimant had been systematically tracked and profiled as a high-value gambler.
Evidence presented during the case indicated that Sky Betting assigned around 500 behavioral data points to each user, updated in real-time, plus an additional 19,000 data points from third-party sources. Their marketing team utilized customer behavior and analytics to monitor the effectiveness of their campaigns, creating a feedback loop based on customer interactions with ads.
The court found that while Sky Betting identified the claimant as a profitable customer, they failed to recognize his high risk for marketing suppression. The thresholds for triggering protective measures were set unrealistically high for someone with his financial struggles.
Although Sky Betting argued that the claimant should have noticed the tailored marketing directed at him, the judge disagreed. The judge noted the claimant was genuinely shocked by the extent of the data collection and targeted marketing aimed at him, which only encouraged his harmful behaviors.
Previously, Sky Betting faced reprimands from the Information Commissioner’s Office for improperly sharing customer data with advertising companies. The regulator discovered that, from January to March 2023, Sky Betting processed customer data using advertising cookies without consent. Attempts to get a comment from Sky Betting went unanswered.