Bounty (UK): a parenting club sold sign-ups to 39 organisations

Parents joined Bounty through its website, its app, merchandise pack claim cards and directly at hospital bedsides. Bounty also ran a data broking service and passed members' details to other organisations for direct marketing, without being fully clear with people that it might do so.

These are ICO findings, as set out in its press release. Inth read the press release, not the penalty notice itself.

• Bounty shared personal information belonging to more than 14 million people, about 34.4 million records, with 39 organisations between June 2017 and April 2018.
• The four largest recipients were credit reference and marketing agencies: Acxiom, Equifax, Indicia and Sky.
• The data covered new mothers and mothers-to-be and very young children, including a child’s birth date and gender.
• Bounty was not fully clear with people that it might share their data in this way.
• Bounty operated as a data broking service, supplying data for electronic direct marketing, until 30 April 2018.

Inth’s technical interpretation: this is the offline version of a pixel. A sign-up form collects data for one purpose, then a back-end feed sends it to partners the member never saw named. The gap is between what the form says and where the data goes.

1. June 2017 to April 2018Period of the sharing covered by the fine
2. 30 April 2018Bounty stops operating as a data broker
3. April 2019ICO announces the £400,000 fine

The ICO fined Bounty £400,000. The conduct took place before the GDPR applied, so the case was decided under the 1998 Act, whose maximum fine was £500,000, as the press release notes. Inth found no record of an appeal.

£400,000, close to the legal maximum at the time.

It is old law, so it says little about today’s fine levels. The lesson still holds: if a sign-up feeds third parties, people need to be told clearly who gets their data. The ICO stressed that the records covered potentially vulnerable new mothers and very young children.

• Code audit can map reviewed data ingestion and onward-sharing routes, which shows where sign-up data goes after the form.

Inth does not see paper forms or in-person sign-ups, and sign-up screens are outside the banner. It cannot establish what a partner does with data once it arrives.

In the repository

• List every export or API feed that sends member data to a third party.

In the browser and network

• Read the sign-up form as a new member would, and check whether it names who receives the data.

With the people responsible

• Compare the recipient list in contracts with the list in the privacy notice.
• Check that paper and in-person sign-ups carry the same choices as the online form.

• ICO press release (official press release mirror)
• BBC News
• The Guardian

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Bounty’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Easylife, Experian v ICO