The Information Commissioner’s Office (ICO) has issued a reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, for unlawfully processing personal data through advertising cookies without obtaining user consent.
From 10 January to 3 March 2023, the company collected and shared personal information with advertising technology companies as soon as users accessed the SkyBet website, before they had the opportunity to accept or reject cookies. This led to personalised advertising targeting users without their prior consent or knowledge.
The ICO launched an investigation following a complaint from Clean Up Gambling, which raised concerns that Sky Betting and Gaming might be misusing personal data to target vulnerable gamblers. Although the investigation found no evidence of deliberate misuse, the regulator concluded that Sky Betting and Gaming’s use of cookies was not lawful, transparent, or fair. In response to the findings, Sky Betting and Gaming made changes in March 2023 to allow users to reject advertising cookies before any data was shared.
This enforcement action is part of the ICO’s broader effort to ensure that websites offer users a fair and informed choice regarding the use of their personal data for targeted advertising. Last year, the ICO reviewed the UK’s top 100 websites and found that over half were not compliant with data protection laws concerning advertising cookies. Following warnings from the ICO, 52 of the 53 websites contacted made necessary changes, with gossip website Tattle Life remaining the only site that failed to engage and is now under investigation.
Stephen Bonner, Deputy Commissioner at the ICO, highlighted the importance of user consent in online advertising. “We’ve all seen adverts online that seem designed specifically for us, such as an ad for trainers after signing up to a gym online,” he said. “Some people may be happy to consent to receive these, but others may not be comfortable receiving similar adverts, especially when it comes to sensitive aspects of our digital activity.” Bonner noted the importance of offering users clear and balanced choices, such as ‘accept all’ and ‘reject all’ buttons being equally prominent, allowing people to easily control how their personal data is used.
The ICO’s action against Sky Betting and Gaming serves as a warning to other organisations that there will be consequences for breaching data protection laws. Bonner emphasized that the ICO will continue to scrutinise other frequently visited websites to ensure compliance, urging businesses to review their cookie consent processes. “Our enforcement action against Sky Betting and Gaming is a warning that there will be consequences if organisations breach the law, and people are denied the choice over targeted advertising,” Bonner stated.
As part of its strategy to uphold online privacy rights, the ICO has also audited several data management platforms to assess their handling of personal information, with some now under investigation for potential non-compliance with data protection laws. The ICO plans to publish updated guidance on the use of cookies and tracking technologies later this year, as well as its stance on the ‘consent or pay’ business model following a consultation.
