The UK Information Commissioner's Office (ICO) has issued a reprimand to Bonne Terre Limited (trading as Sky Betting and Gaming) for illegally processing user data through advertising cookies without user consent.
From January 10, 2023, to March 3, 2023, Sky Betting and Gaming processed personal information of users visiting the SkyBet website and shared it with advertising technology companies - before they had chosen to accept or reject advertising cookies. This means their personal information could have been used to target them with personalized ads without their prior consent or knowledge.
Following a complaint by Clean Up Gambling, we investigated whether Sky Betting and Gaming intentionally misused people's personal information to target vulnerable gamblers. Although no evidence of intentional misuse was found, the regulator concluded that Sky Betting and Gaming processed personal data in an illegal, non-transparent, or unfair manner by using certain cookies.
As a result of our investigation, Sky Betting and Gaming made changes in March 2023 to ensure that people could reject advertising cookies before their personal information was shared for these purposes.
We are taking enforcement action to crack down on websites that do not offer people a fair and informed choice about whether they wish to use their personal information for targeted advertising.
Last year, we reviewed the top 100 websites in the UK and found that more than half had issues with the use of advertising cookies. We wrote to these 53 websites, warning them that if they did not change their advertising cookies to comply with data protection laws, they would face enforcement action. This action received a positive response, with 52 of the websites changing how they used advertising cookies.
Of the 53 websites we contacted, only the gossip site Tattle Life did not engage with us and will be investigated for using cookies and not registering with the regulator.
Deputy Commissioner Stephen Bonner said: "We've all seen online ads that seem specifically designed for us, like the trainer ads you get after signing up for a gym online. Some people might be happy to agree to receive these ads, but others might not want similar ads, especially when it involves sensitive aspects of our digital activities. For example, if you are visiting a gambling site or looking up information about health conditions, you might want to prevent this personal information from being shared with advertisers."
"I am pleased to see that our interventions have brought about some changes, with 99 of the top 100 websites now either offering meaningful advertising cookie choices or having made improvements to obtain people's consent. For instance, some sites now have an 'all reject' button, and others have placed the 'all accept' and 'all reject' options in equally prominent positions, making it as easy to reject cookies as to accept them. These changes mean that people can more autonomously decide how their personal information is used online. Other sites have begun introducing other methods to obtain consent, such as 'consent or pay'—a business model we are currently reviewing."
"Our enforcement action against Sky Betting and Gaming serves as a warning that there will be consequences if organizations violate the law and people are not given a choice about targeted advertising. We are preparing to review the next 100 most visited websites, so I urge all organizations to now assess their cookie banners to ensure that people can freely give their consent before the regulator sends out letters."
