A single customer received around 1,389 marketing emails from Sky Betting & Gaming across 2017 and 2018. The company held around 500 individual data points about him at any given time, continuously updated in real time, plus tens of thousands more supplied by third-party data brokers, used to predict his behavior and select him for targeted campaigns. He lost more than £45,000 over roughly a decade with the company. He was labelled a high-value customer. When he stopped logging in, internal records marked him as someone the firm wanted to win back.
Mrs. Justice Collins Rice ruled in January 2025 that the man’s consent to marketing was not freely given. In her finding, he was not making decisions on a fully autonomous basis, and the company’s use of his data was therefore unlawful under UK data protection law.
That was the narrow legal holding. It would not survive the year.
Consider what the ruling actually did, before its reversal. It did not find that Sky Betting & Gaming failed to secure a tick in a consent box. The claimant had, on the face of it, opted in. What the court found, at first instance, was that consent given by a person in the grip of a compulsive disorder, to a company that held detailed behavioral evidence of that disorder, was not consent the law would recognize as valid. The autonomy required for lawful data processing was, in the judge’s phrasing, impaired.
That reasoning, for a while, cut through the industry’s standard defense — that customers agreed to receive marketing when they signed up — in a way that data regulators had been circling for years without quite landing on.
Take the profile the court examined. The claimant was spending his entire wages on the platform. The company’s own models were sophisticated enough to predict his next deposit and segment him for retention campaigns when he tried to stop, according to reporting on the case. The safeguarding systems that were supposed to identify a high-risk customer never triggered. The commercial systems that were supposed to identify a high-value customer worked with precision.
Both systems were reading the same behavior. Only one of them was acting on it.
That imbalance is where the story stood for over a year. Then it moved. Flutter, which acquired Sky Betting & Gaming in 2020, disagreed with the judgment from the outset and appealed on five separate grounds. On 21 April 2026, the Court of Appeal allowed that appeal on all five grounds, with Lord Justice Warby ruling that consent under UK data protection law is judged objectively — by what a customer did, not what they were thinking or how vulnerable they were. The Information Commissioner’s Office, which had intervened in the case, argued for a middle position: that a company’s awareness of a customer’s vulnerability should still count for something. The court rejected that too, warning it would create unworkable uncertainty for businesses. The case has been sent back to the High Court, where narrower questions about the fairness of the data handling are still to be resolved.
The Gambling Commission has told operators to consider the underlying case alongside a separate Information Commissioner’s Office reprimand from September 2024, which found Sky Betting & Gaming had unlawfully processed data through advertising cookies without consent. In 2023, the Commission fined Paddy Power £490,000 for sending a promotional push notification to customers who had self-excluded.
These are not isolated incidents. They form a pattern the regulator has been documenting incrementally, even as the specific legal theory in the Sky Bet case has now failed on appeal.
The underlying mechanism the case exposed hasn’t gone away, whatever the courts eventually decide about consent. A betting product with real gambling harm attached to it is being marketed using tools designed for consumer goods, and the sophistication of those tools now exceeds the sophistication of the safeguards that are supposed to sit beside them. Personalization technology can identify a customer’s payday, their preferred sport, their deposit rhythm, and the exact hour they are most likely to place a bet. The same technology can also, in theory, identify the customer who has started depositing larger sums at 2 a.m. after months of trying to quit. The Court of Appeal has now said, as a matter of law, that the second fact doesn’t have to change how the first is used. Whether that squares with how compliance teams actually operate is a separate question from whether it’s legal.
There is a version of this story playing out inside compliance departments across the sector right now: teams whose job is to reconcile a consent architecture — the standard terms-and-conditions flow, the marketing preferences page, the cookie banner — that the Court of Appeal has just confirmed doesn’t need to account for what the company already knows about a customer’s vulnerability. That confirmation cuts one way for legal risk and another way for public trust, and operators are currently living in the space between those two facts.
The level of tracking revealed by the case is indicative of how the sector operates. Whether other operators have processed data on similar terms is, if anything, now a narrower legal question than it looked eighteen months ago — the objective consent standard the Court of Appeal has confirmed sets a lower bar for operators to clear than the one Mrs Justice Collins Rice applied.
The English case is not the only front. In India, the Enforcement Directorate’s Kolkata zonal office has been examining payments from real money gaming firms to social media influencers, as part of a money laundering probe linked to YouTuber Anurag Dwivedi. The ED has alleged Dwivedi promoted illegal betting platforms including Sky Exchange — a brand distinct from Sky Betting & Gaming — and has seized luxury vehicles worth over ₹4 crore along with roughly ₹3 crore in frozen movable assets such as bank balances, fixed deposits and insurance policies. Four gaming companies, including PlayerzPot, Vision11, Gameskraft and Games 24×7-owned My11Circle, were searched or examined over payments made to the influencer.
The Indian action targets a different link in the chain: the intermediary between the operator and the customer. But the underlying concern is the same one the Sky Bet case put in front of an English court — that the mechanisms used to convert attention into gambling activity have outpaced the systems meant to check them, whatever a court eventually decides about who’s liable for that gap.
Marketing is where the money flows. It is also where the harm is engineered.
People inside the industry recognize the pressure this creates. Influencer contracts are written to reach audiences an operator’s own paid channels cannot. Attribution modeling rewards the creator who drives the most first-time deposits. The system is optimized for acquisition, and the compliance function sits, usually, downstream of the growth function.
This is the structural point the Sky Bet case put on the record, regardless of how the legal argument about consent eventually landed. The persuasion infrastructure and the safeguarding infrastructure are not equally resourced, and they never have been. The persuasion side is where the commercial upside sits. The safeguarding side is a cost center. That imbalance is not unique to gambling — it shows up wherever platform economics meet public policy — but gambling is where the human cost is most legible.
The Office for Health Improvement and Disparities has estimated that close to 1.8 million adults in England engage in some form of harmful gambling, and that between 117 and 496 excess suicide deaths a year in England are associated with problem gambling or gambling disorder. Those figures were published in a 2023 OHID report.
The Court of Appeal’s ruling closed off one legal argument for treating an addicted customer’s consent differently from a casual customer’s. It did not touch the underlying fact the case put on the record: that the same company that could see a customer’s compulsive pattern in its own data used a different, and much less forgiving, system to act on it.
What is clear is that the defense of choice — the customer signed up, the customer clicked, the customer could have opted out — is now on firmer legal ground than it was eighteen months ago. Whether it should be is a different question, and one the Sky Bet case, for now, has left open.