UK Data Regulator Cracks Down on Sky Betting and Gaming’s Cookie Practices

The Information Commissioner’s Office (ICO) has reprimanded Sky Betting and Gaming for unlawful cookie practices, specifically for processing users' personal data via advertising cookies without proper consent from January 10 to March 3, 2023.

This violation of data protection laws occurred as soon as users visited the SkyBet website, before they had the chance to accept or reject cookies. 

Cookies enhance online experiences, such as online casinos, by enabling session management, content personalisation, and user behaviour tracking. However, the ICO revealed that Sky Betting and Gaming shared user data with advertising technology companies without transparency, leaving users vulnerable. 

While there was no evidence of targeted exploitation of vulnerable individuals, the company’s actions were deemed opaque and unfair. 

Complaint and Investigation 

The investigation followed a complaint filed by Clean Up Gambling on June 22, 2024, alleging widespread illegal data practices among online gambling operators. 

Key concerns included: 

• Insufficient information provided for informed consent. 
• Cookies implemented without proper user consent, merely offering an accept option, violating PECR regulations. 
• Privacy notices lacked vital details on data processing and user rights. 
• Lack of clarity impaired users' abilities to exercise their data rights. 
• User data retained indefinitely, with little justification. 

Clients Did Not Know They Were Being Profiled

Ravi Naik, Legal Director of AWO and representative of Clean Up Gambling, highlighted the lack of awareness among clients regarding profiling and third-party involvement.  

In relation to SkyBet's failure to obtain consent to collect sensitive medical data related to addiction, Legal Director of AWO, Ravi Naik, who represents Clean Up Gambling, said, “None of our clients knew they were being profiled, let alone there were third parties involved." 

Regulatory Action 

Sky Betting and Gaming implemented corrective measures by March 2023, allowing users to reject advertising cookies prior to data sharing for targeted ads. This change came after the regulator determined the company's earlier practices did not meet lawful and transparent data processing standards. 

The ICO’s actions are part of a broader initiative to improve cookie practices across UK websites. 

Stephen Bonner, Deputy Commissioner at the UK Information Commissioner's Office, warned organisations that breaking the law around targeted advertising choices would have consequences and called for a review of cookie banners. 

The Deputy Commissioner said: “Our enforcement action against Sky Betting and Gaming is a warning that there will be consequences if organisations breach the law, and people are denied the choice over targeted advertising."  

“We are preparing to scrutinise the next 100 most frequented websites, so I urge all organisations to assess their cookie banners now.”  

The regulator has also warned against using manipulative tactics, like making the “reject all” option harder to find or hiding it behind multiple clicks.

Compliance Guidelines 

To maintain compliance, companies should ensure that: 

• Consent is informed, explicit, and freely given. 
• Cookies are not placed before user agreement. 
• Rejecting cookies is as straightforward as accepting them.  

The ICO will publish updated guidance on cookies and related technologies, addressing issues like the controversial “consent or pay” model. 

What Are Cookies?   

Cookies are small text files used by websites to identify browsers and enhance user experiences, remembering preferences and login details.