Sky Betting and Gaming, operated by Bonne Terre Limited, has been reprimanded by regulators for unlawfully processing personal data through advertising cookies without user consent. The company was found to be sharing personal information with advertising technology companies before users had the chance to accept or reject cookies, breaching data protection laws.
Between January 10 and March 3, 2023, Sky Betting and Gaming was automatically processing the personal data of visitors to its SkyBet website without securing prior consent. This practice led to users’ personal information being used for targeted advertising without their knowledge. Following an investigation prompted by a complaint from Clean Up Gambling, the regulator did not find evidence of deliberate misuse, but it was concluded that the company’s handling of personal data through cookies was neither lawful nor transparent.
As a result of the findings, Sky Betting and Gaming made adjustments in March 2023 to ensure users could reject advertising cookies before any personal information was shared. This enforcement is part of a wider initiative by the regulator to crack down on companies that fail to offer users informed choices about their personal data usage for targeted advertising.
Stephen Bonner, Deputy Commissioner, commented on the broader impact of this enforcement, emphasizing the importance of individuals having control over how their personal data is used online, particularly when accessing sensitive websites such as gambling or health services.
This action against Sky Betting and Gaming follows a review of the UK’s top 100 websites, which uncovered that more than half had issues related to the use of advertising cookies. Out of 53 websites that were warned, 52 have since made changes to comply with data protection laws, while gossip website Tattle Life faces further investigation after failing to engage with the regulator.
Bonner added: “Our enforcement action against Sky Betting and Gaming is a warning that there will be consequences if organisations breach the law and deny people the choice over targeted advertising.”
As part of its strategy, the regulator is set to scrutinize the next 100 most-visited websites and is preparing to release updated guidance on cookie usage and consent mechanisms, including the review of alternative consent models like ‘consent or pay’.
The regulator’s efforts aim to ensure that organisations respect users’ rights in the online advertising industry, with additional investigations underway involving several data management platforms that may also have breached data protection laws.
