Sky Betting and Gaming found guilty of GDPR violation
•
2 Feb 2025 •
Reading time: 3 minutes The High Court of England and Wales has delivered a landmark verdict against Sky Betting and Gaming, a subsidiary of Flutter Entertainment. The online betting operator was found guilty of violating UK data protection laws by collecting customer information through cookies without proper consent.
The dispute stems from a complaint filed by a customer who claimed to have been targeted with personalized marketing messages between 2017 and 2019, despite his gambling addiction. This player, who lost over £45,000 in nearly a decade, argued that Sky Betting and Gaming should have identified his problematic behavior and refrained from using his data for promotional purposes.
Illegal data collection
Sky Betting and Gaming used cookies to collect personal data without users’ explicit consent. These cookies, small text files stored on visitors’ devices, allowed the company to track online players’ behavior, including their browsing habits, gaming preferences, and spending. This information was then used to send targeted advertisements, often in the form of personalized promotional messages, encouraging users to return to the platform or place more bets.
The issue lies in the fact that this data collection occurred without users being fully informed or giving clear consent, as required by the General Data Protection Regulation (GDPR) in force in the UK and Europe. Vulnerable players, like the claimant in this case, were exposed to aggressive marketing practices that exacerbated their addiction.
Sky Betting and Gaming does not appear to have limited itself to targeted marketing, as the court also examined other allegations. The company allegedly unlawfully shared customer data with third parties.
Ravi Naik, the lawyer representing the claimant and a member of the digital rights agency AWO, welcomed the decision:
“We hope this judgment will reduce harm to vulnerable people by serving as a warning to online gambling companies.”
Sky Betting and Gaming: A troubled history
Founded in 2001, Sky Betting and Gaming quickly became one of the UK’s leading online betting platforms. Acquired by Flutter Entertainment (formerly Paddy Power Betfair) in 2018 for £3.6 billion, the company experienced rapid growth but also its share of controversies.
In September 2023, the UK Information Commissioner’s Office (ICO) had already reprimanded the company for sharing customer information with digital advertising firms without explicit consent. In 2022, the UK Gambling Commission fined it £1.17 million for sending promotional messages to self-excluded customers.
A decision with major implications
The High Court ruled that Sky Betting and Gaming was guilty of violating UK data protection laws. Although the judgment is based on the specifics of this case, it could have broader implications for the online gambling industry. Operators will now need to be more vigilant in collecting and using customer data, particularly to avoid targeting vulnerable players.
Sky Betting and Gaming announced that it is considering an appeal, while emphasizing that it has strengthened its internal controls and processes to comply with data protection standards. The company also reiterated its commitment to safer gambling practices, including addiction prevention initiatives.
“We fundamentally disagree with this judgment. We have made significant changes to our controls and processes over the past six years as part of our ongoing investment in safer gambling, and we will continue to do so.”
A warning for the industry?
This case raises crucial questions about the ethics of marketing in the online gambling sector. Should companies be held accountable for exploiting the data of addicted players? How can a balance be struck between marketing innovation and consumer protection?
For Ravi Naik, the answer is clear:
“Companies must understand that data protection is not just a legal obligation but also a moral responsibility.”