Investigation Reveals Gambling Sites Sharing User Data to Meta

Investigation Reveals Gambling Sites Sharing User Data to Meta

A recent investigation has revealed that several gambling websites have been sending user data to Meta, Facebook's parent company, without obtaining prior consent. The practice involves tracking visitors and relaying information before they can accept or reject data collection. It raises concerns about compliance with data protection laws and the broader implications for online gambling regulation.

The investigation, conducted by The Guardian and citing data from The Observer, examined 150 gambling websites, including online casinos, sports betting platforms, and bingo sites. Of these, 52 were found to be transmitting user data through Meta Pixel, a tracking tool embedded in websites that collects information on visitor activity. The data shared included details on pages visited and actions taken, such as button clicks.

Once collected, this information allowed Meta to categorize individuals based on their gambling activity. As a result, users were exposed to advertisements for betting platforms across Facebook and other Meta-owned services. After visiting gambling sites, the extent of this targeting was evident when one of the investigators received promotional offers from 49 different gambling brands, including incentives like free bets and new player bonuses.

Under existing data protection regulations, companies are required to obtain explicit user consent before gathering or sharing personal data for marketing. However, the findings indicate that data transfers occurred automatically upon visiting the websites, bypassing the consent process entirely.

The investigation has prompted renewed scrutiny of gambling operators' data practices. Iain Duncan Smith, chair of the all-party parliamentary group on gambling reform, criticized the apparent violation of data privacy laws, calling for stronger enforcement measures. He argued that regulatory oversight remains insufficient in addressing how gambling companies handle user information.

Privacy researcher Wolfie Christl also raised concerns, stating that the practice of sharing data with Meta without informed consent reflects broader issues in digital advertising. He pointed to Meta's role in facilitating these activities, arguing that the company should bear responsibility for ensuring compliance with its own data policies.

The UK's Information Commissioner's Office (ICO) has been actively reviewing gambling-related data practices. In September, the ICO issued a reprimand to Sky Betting & Gaming for failing to comply with cookie regulations, allowing data collection without user approval. The company attributed the issue to a technical error but confirmed that it had been addressed.

Separately, Sky Betting & Gaming was also found to have sent over 1,300 marketing emails to an individual with a gambling problem, despite their self-exclusion status. The High Court ruled that this violated data protection laws, though the company has indicated it may appeal.

The UK Gambling Commission has taken steps to limit some gambling marketing practices, such as prohibiting “cross-selling,” where operators promote additional services to existing customers. However, no current regulations prevent companies from using third-party profiling tools like Meta Pixel to identify and target new users.

Unauthorized data transfers could expose gambling operators, regulators, and digital advertising platforms to several consequences.

• Tighter Data Privacy Regulations: Authorities may consider stricter enforcement of consent-based data collection, potentially requiring gambling operators to revise their tracking and advertising methods. Failure to comply could lead to fines or restrictions on digital marketing.
• Changes in Advertising Strategies: If regulatory pressure increases, gambling companies may need to adjust how they attract new users. Restrictions on data-driven advertising could limit the effectiveness of targeted promotions, requiring a shift toward alternative marketing approaches.
• Increased Oversight of Meta's Role: Meta has previously faced scrutiny over its handling of user data. Further regulatory action may focus on whether the company is enforcing its own policies regarding data-sharing practices within the gambling industry.
• Reputation and Consumer Trust Issues: Operators found to be engaging in non-compliant data tracking may face reputational challenges, particularly if public trust in their handling of personal information declines.

The findings of this investigation highlight ongoing concerns regarding how user data is handled in the online gambling sector. While gambling operators rely on digital advertising to reach new audiences, the lack of transparency in data collection could prompt regulatory intervention. If stricter controls are introduced, the industry may need to reconsider how it approaches marketing while maintaining compliance with evolving privacy laws.