The Information Commissioner’s Office (ICO) has reprimanded Bonne Terre Limited, trading as Sky Betting and Gaming, for unlawfully processing personal data via advertising cookies without prior user consent.
From January 10 to March 3, 2023, the Company collected and shared personal information with advertising technology companies when users visited SkyBet’s website, before they had the option to accept or decline cookies. This led to personalized advertisements that targeted users without their prior consent or knowledge.
The ICO launched an investigation following a complaint from Clean Up Gambling, which raised concerns that Sky Betting and Gaming may be misusing personal data to target vulnerable gamblers. Although the investigation found no evidence of intentional misuse, the regulator concluded that Sky Betting and Gaming’s use of cookies was not lawful, transparent or fair. In response to the findings, Sky Betting and Gaming made changes in March 2023 to allow users to opt out of advertising cookies before data sharing.
This enforcement action is part of the ICO’s wider efforts to ensure that websites offer users a fair and informed choice regarding the use of their personal data for targeted advertising. Last year the ICO reviewed Britain’s top 100 websites and found that more than half were not compliant with data protection laws regarding advertising cookies. Following warnings from the ICO, 52 of the 53 websites contacted made the necessary changes, with gossip website Tattle Life remaining the only site to fail to take action and which is now under investigation.
Stephen Bonner, deputy commissioner at the ICO, emphasized the importance of user consent when advertising online. “We’ve all seen online ads that seem designed specifically for us, such as an ad for trainers after they sign up for a gym online,” he said. “Some people may be happy to consent to receiving these, but others may not feel comfortable receiving similar advertisements, especially when it comes to sensitive aspects of our digital activities.” Bonner noted the importance of offering users clear and balanced choices, with “accept all” and “decline all” buttons equally prominent, so people can easily control how their personal data is used.
The ICO’s action against Sky Betting and Gaming serves as a warning to other organizations that there will be consequences for breaching data protection laws. Bonner stressed that the ICO will continue to investigate other high-traffic websites to ensure compliance, and urged companies to review their cookie consent processes. “Our enforcement action against Sky Betting and Gaming is a warning that there will be consequences when organizations break the law and people are denied the choice to target advertising,” Bonner said.
As part of its strategy to enforce online privacy rights, the ICO has also audited several data management platforms to assess their handling of personal information, some of which are now under investigation for possible non-compliance with data protection laws. The ICO plans to publish updated guidance on the use of cookies and tracking technologies later this year, as well as its position on the ‘consent or pay’ business model following a consultation.