ICO warns SkyBet for dropping cookies without consent

In a recent enforcement action, Sky Betting and Gaming, operated by Bonne Terre Limited, was reprimanded by the ICO for using advertising cookies without obtaining user consent.  

Whilst there has been no monetary fine, this incident highlights the risks involved in using cookies, particularly for digital advertising, without monitoring when and how they are deployed.  

Consumers are becoming more aware and concerned about their data privacy. Our recent survey found over half of US consumers have abandoned an online transaction due to concerns about a company’s data security. 

So, it’s not just about a regulatory fine; it’s the reputational risk and damage when consumers mistrust your website.  

Cookies get a reputation for being inherently ‘bad’, when really, organization’s just need to make sure they’re getting consent and giving users control over their preferences.  

As our founder, Nicky Watson, puts it…   

“Cookies are not evil. Really, I mean it – they aren’t.  Yet, they are vilified while paid alternatives that essentially serve the same purpose are somehow seen as superior. The impetus of this problem is a lack of consumer consent. By giving users control of their consent preferences, businesses are creating opportunities for customers to share the data they’re comfortable with, which ultimately leads to trust and brand loyalty.”   

The background

Cookies play a pivotal role in online advertising by tracking user behavior and preferences to deliver targeted ads.  

However, the use of cookies is governed by stringent data protection laws, such as the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) in the United States.  

The GDPR mandates that businesses must obtain explicit consent from users before processing their personal data through cookies.  

The CCPA mandates that businesses must disclose what data is collected by cookies and how it’s used. This can be done by providing a link to a privacy policy. They must also provide a way for consumers to opt out of cookie collection. This can be done with a “Do Not Sell My Personal Information” button on the home page. 

What did Sky Betting and Gaming get wrong? 

From January 10 to March 3, 2023, Sky Betting and Gaming processed personal information through advertising cookies without user consent. They were dropping advertising cookies before users had the chance to accept or reject them. 

This data was shared with advertising technology companies, enabling targeted advertising without users’ prior knowledge or approval.  

The investigation, prompted by a complaint from Clean Up Gambling, found no evidence of deliberate misuse but concluded that the data processing was unlawful, non-transparent, and unfair. 

As a result, Sky Betting and Gaming implemented changes in March 2023 to ensure users could reject advertising cookies before any data sharing occurred. This case highlights the necessity for businesses to adhere to data protection laws and prioritize user consent. 

The broader context

The Sky Betting and Gaming incident is part of a broader regulatory effort to ensure fair and informed choices for users regarding targeted advertising.  

Last year, the regulator reviewed the UK’s top 100 websites and found that more than half had issues with their use of advertising cookies.  

53 websites were warned, and 52 have since made necessary changes to comply with data protection laws. The regulator plans to scrutinize the next 100 most frequented websites, emphasizing the ongoing need for compliance. 

The importance of cookie management

For enterprise businesses, effective cookie management is crucial for several reasons: 

• Building trust: Transparent practices build trust with users, fostering long-term relationships. 
• Compliance: Adhering to data protection laws avoids legal and financial penalties. 
• User experience: Providing clear choices enhances user experience and satisfaction. 

Best practices for cookie management

Clear banners: Use transparent and straightforward cookie banners. 

Equal options: Ensure ‘accept’ and ‘reject’ options are equally prominent. 

Regular audits: Conduct regular audits and updates to consent management practices. 

Download our Cookie consent rate optimization checklist for best practices and examples of how to compliantly improve opt-in rates.  

The Sky Betting and Gaming case serves as a reminder of the importance of robust cookie and consent management. By prioritizing user consent and adhering to data protection laws, businesses can build trust, ensure compliance, and enhance user experience.  

As regulatory scrutiny intensifies and the ICO planning to move forward with further website checks, it is imperative for all organizations to review and improve their cookie and consent management practices. Check your compliance now using our free cookie audit tool.