Sky’s cookie consent warning: A gamble on privacy

On September 2, 2024, the UK Information Commissioner’s Office (ICO) issued a formal reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming (SkyBet), for processing personal data via advertising cookies without obtaining proper consent. The ICO determined that SkyBet had been sharing users’ personal data with adtech companies immediately upon their access to the SkyBet website, prior to giving them the option to accept or decline advertising cookies. This resulted in the use of personal data to deliver targeted ads without the users’ awareness or consent.

The investigation by the ICO was triggered by a complaint from the campaign group Clean Up Gambling, which alleged that SkyBet was exploiting personal information to target vulnerable individuals. Although the ICO did not find evidence of intentional misuse, they took action as part of a broader effort to ensure websites provide clear, informed choices regarding personal data usage in targeted advertising, while ensuring the processing of personal data via cookies is legal, fair, and transparent.

Background

The ICO launched its investigation after Clean Up Gambling published a report in January 2022, accusing SkyBet of transmitting large volumes of personal data to third-party advertisers without obtaining users’ consent. The ICO discovered that SkyBet deployed “non-essential” cookies, including tracking and advertising cookies, before users had selected their preferences in the consent management platform (CMP). For instance, SkyBet had contracted MediaMath, a demand-side platform, which placed 40 third-party marketing cookies on visitors’ devices before they set their cookie preferences, resulting in the unlawful processing of personal data by adtech firms.

The Reprimand

In February 2024, the ICO issued a Notice of Intent to reprimand SkyBet, finding the company in violation of multiple provisions of the UK GDPR, including:

• Article 5(1)(a): Personal data must be processed lawfully, fairly, and transparently.
• Article 6(1)(a): Processing must have a legal basis.
• Article 7(1): Consent must be demonstrable when relied upon as a legal basis.

The ICO recommended SkyBet continuously review and monitor its cookie deployment practices to ensure that non-essential cookies are only activated after valid consent is obtained. The ICO warned that continued non-compliance could lead to further regulatory enforcement.

In response to the investigation, SkyBet implemented changes in March 2023 to allow users to reject advertising cookies before sharing their personal data.

Implications for the AdTech Industry

This action from the ICO serves as a critical reminder to companies, especially those operating in the adtech sector, about the importance of complying with data protection regulations when using cookies. The ICO has expressed ongoing concerns over public unease regarding the unlawful sharing of personal data and highlighted the need for individuals, particularly vulnerable populations such as those with gambling addictions, to have control over targeted advertising. As such, adtech practices are expected to remain a key area of scrutiny for the ICO.