Press Release - AWO win in RTM v Bonne Terre et al
High Court rules that years of tracking and targeted marketing by online gambling brand Sky Betting & Gaming broke the law
Today, the High Court ruled that online gambling provider Sky Betting & Gaming (“SBG”) – part of the Flutter Entertainment group – acted unlawfully and breached a customer’s data protection rights when it obtained his personal data through cookies and used it to profile him and deliver personalised direct marketing. AWO acted for the claimant.
Background
SBG, one of the UK’s largest online gambling operators with brands like Sky Bet, Sky Casino or Sky Vegas, collects vast amounts of personal data about its users’ gambling and other online behaviour to profile them and target them with marketing. The defendants (Bonne Terre Limited and Hestview Limited, the corporate entities through which SBG operates its brands) took gambling behaviours and turned them into code. The scale of that processing and profiling has attracted considerable press attention.
The judgment
The Court found that for the entire period of the claim, SBG had no lawful basis to collect the claimant’s data through cookies, to profile him for marketing purposes or to serve him with direct marketing.
The High Court judgment recognises that online gambling is a particularly risky environment in which users’ discernment and autonomy can be impaired, such that controllers have heightened obligations to ensure that valid consent has been provided. This is a powerful reminder to all data controllers that the key attributes of consent under the UK GDPR – “freely given”, “specific”, “informed” and “unambiguous” – set a high standard, and that the context in which consent to data processing is sought is important.
Implications
The groundbreaking ruling is a legal first and could have major implications for the multi-billion-pound online gambling sector in the UK. It raises the prospect that not only SBG, but other gambling companies have been illegally profiling thousands – if not tens of thousands – of their vulnerable customers for years.
The case also has consequences for all controllers that rely on consent and for the online advertising industry.
The claimant – who is anonymous pursuant to an order of the court – is represented by Ravi Naik, Alex Lawrence-Archer and Lucie Audibert of AWO. Counsel for the Claimant is Christopher Knight of 11KBW and Aarushi Sahore of Brick Court Chambers.
A link to the full judgment can be found here.
Ravi Naik, Legal Director at AWO and representative of the claimant, said:
“My client is pleased to be vindicated. The High Court judgment is an unalloyed victory, recognising what our client has always maintained: he did not and could not have consented to being relentlessly tracked and intimately profiled by SBG in order to encourage him to gamble sums which he could not afford. He was – and remains – shocked and dismayed at the extent of SBG’s data collection and profiling.
As part of his recovery, one of my client’s aims has been to draw attention to these unlawful practices and reduce their impact on others. It took great courage for him to stand up for that cause and seek to improve the lot of those impacted by such practices. Hopefully this judgment will reduce harm to vulnerable people by serving as a warning to online gambling companies – and others involved in the online advertising system – that they must comply with the law in their marketing practices.”
CONTACT
Please contact Ravi Naik (ravi@awo.legal / +44 7966143682) for enquiries.
NOTES TO EDITORS
Background
The claimant gambled with SBG for nearly 10 years, losing over £45,000 in the process. As part of his recovery from what he considered to be a gambling addiction, he made data subject access requests (“DSARs”) to a number of gambling operators. His DSAR to SBG led to further requests to other third parties, which revealed a staggering amount of data of a very detailed and intimate nature.
That data was however only a small portion of what was disclosed to him in the course of legal proceedings. These disclosures made it clear to him that he had been extensively tracked and profiled as a prolific gambler of potentially very high value to SBG’s business, which led to intensive marketing that fed his gambling addiction. The judgment describes this marketing as “frequent, high-impact online experiences” to which the claimant was “highly available” and responsive, having been identified as a ‘high value’ customer and marketed to as such [§166]. He filed this claim to challenge that, on 2 February 2023.
“Online advertising can be frequent, powerful and personalised and is delivered directly at the marketing/consuming interface; it can be engaged with and responded to instantly and frictionlessly. We looked at some examples: these displayed high visual production values and a high emotional register, and some included offers and rewards as well as the promised entertainment – the thrills – of the product itself.” [§99]
Aside from using the basic data necessary to operate their services, SBG aggregate all the data it can obtain into “data points” about each individual user, such as their favourite time of day for gambling or whether they are a “high value” customer. Evidence in the case showed that at any one time, each individual is assigned around 500 behavioural data points that are continuously updated by real-time data. These are in addition to data received from third parties like Signal (83 different data points) or Iovation (19,000 data points). These data points are then used by the business, in particular its marketing arm, to segment its customer base for marketing campaigns and to build “propensity models”, algorithmic models that predict users’ future behaviour.
Despite this volume of data, to this day SBG has only provided the claimant with piecemeal information – for example never disclosing what customer segments he had been assigned to.
The case
The Honourable Mrs Justice Collins Rice DBE CB heard the claim over 5 days between 11 and 17 November 2024.
SBG sought to defend its extensive data processing, claiming it was required for operation of its “safer gambling” models. But as the evidence showed, and as the Court emphasised in its judgment, SBG continued to market to users who displayed signs of problem gambling but did not reach a sufficient risk level to end up on their “suppression” list (through which they would receive no marketing at all). It was a binary threshold, short of which “the marketing team will continue to market” [§95].
SBG’s data science witness recognised that a data point showing regular play in the early morning hours can be a marker of harm, but that “short of suppression, the marketing model will interpret it as a cue that that is a particularly productive time to send marketing to that individual.” [§96] The Court found that “[t]he financial triggers for suppression were set at levels beyond the realistically possible reach of a man of the Claimant’s modest means, even when he was spending all the money he could get his hands on and more.” [§166]
As a result, the claimant received floods of marketing emails enticing him with bonuses, offers to try new products, or reminders of how much he could (but did not) win. His intense gambling, as the Court recognised, fed this marketing like a self-fulfilling prophecy:
“The more he responded – trying new things, accepting bonuses, going up a level – the more the marketing models responded with more, and more tailored or directed, marketing. That is exactly what they were designed to do. The Claimant was gambling in what might reasonably be called a fast-moving marketing-saturated environment, one in which rich information provided by his own online behaviour was being played back to him in real time with tailored enticements and inducements to play more and play bigger.” [§166]
The judgment
The Court found that what was happening behind the scenes to encourage him to gamble more was not something he properly consented to. This was because both the subjective and autonomous qualities of his decision-making were compromised by his problem gambling.
SBG ought to have known that there was a potential risk that some of its users were not properly consenting in this way (a clearly high risk in the online gambling sector), and this was a risk of doing business that they would end up liable for if challenged.
The judgment concludes that the issue “is dispositive of the substance of [the Claimant’s] claim, in his favour” [§210].
A further hearing will determine the remedies the claimant is entitled to.
Wider implications
The proceedings also confirmed and further revealed the extent of sharing of personal data by online gambling operators with third parties through the AdTech ecosystem. A report by Cracked Labs documenting the sharing of personal data by SBG with dozens of companies in the AdTech industry was provided in evidence and confirmed as accurate by SBG’s witnesses.
The judgment also reinforces the reprimand given by the ICO to SBG’s parent company in September 2024, as a result of submissions made by AWO on behalf of Clean Up Gambling. The ICO’s investigation had found that a pixel embedded within the Sky Bet website had facilitated the setting of approximately 40 third-party marketing cookies without users’ valid consent.
Overall, the findings on lawful bases for profiling and online advertising, in particular on consent, should be a warning to the wider online advertising industry. The assessment is stringent, especially in higher risk environments (such as gambling), and controllers must be able to conclusively demonstrate the legality of their processing.