[Enforcement library](/enforcement)

# Bounty (UK): a parenting club sold sign-ups to 39 organisations

The ICO found Bounty shared personal data from its pregnancy and parenting club with 39 organisations, including credit reference and marketing agencies, without telling members clearly.

## Key facts

- **Regulator or court:** ICO
- **Jurisdiction:** United Kingdom
- **Framework:** Data Protection Act 1998
- **Record date:** 2019-04-12
- **Procedural status:** Monetary penalty issued; final

Bounty collected details from expectant and new parents and shared them with 39 organisations, including data brokers. The ICO fined it £400,000 under the pre-GDPR law.

ICO · Data Protection Act 1998 · Announced April 2019

- The problem
- Case record
- What the regulator found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

Parents joined Bounty through its website, its app, merchandise pack claim cards and directly at hospital bedsides. Bounty also ran a data broking service and passed members' details to other organisations for direct marketing, without being fully clear with people that it might do so.

## Case record

| Field | Record |
| --- | --- |
| Regulator | Information Commissioner's Office (ICO) |
| Organisation | Bounty (UK) Limited |
| Action | Monetary penalty, announced April 2019 |
| Law | Data Protection Act 1998 |
| Period | June 2017 to April 2018 |
| Amount | £400,000; the maximum under the 1998 Act was £500,000 |
| Stage | Final |

## What the regulator found

These are ICO findings, as set out in its [press release](https://www.wired-gov.net/wg/news.nsf/articles/Bounty+UK+fined+400000+for+sharing+personal+data+unlawfully+15042019091000?open=). Inth read the press release, not the penalty notice itself.

- Bounty shared personal information belonging to more than 14 million people, about 34.4 million records, with 39 organisations between June 2017 and April 2018.
- The four largest recipients were credit reference and marketing agencies: Acxiom, Equifax, Indicia and Sky.
- The data covered new mothers and mothers-to-be and very young children, including a child's birth date and gender.
- Bounty was not fully clear with people that it might share their data in this way.
- Bounty operated as a data broking service, supplying data for electronic direct marketing, until 30 April 2018.

## Technical issue

**Inth's technical interpretation:** this is the offline version of a pixel. A sign-up form collects data for one purpose, then a back-end feed sends it to partners the member never saw named. The gap is between what the form says and where the data goes.

## Timeline

| Date | Event |
| --- | --- |
| June 2017 to April 2018 | Period of the sharing covered by the fine |
| 30 April 2018 | Bounty stops operating as a data broker |
| April 2019 | ICO announces the £400,000 fine |

## Outcome

The ICO fined Bounty £400,000. The conduct took place before the GDPR applied, so the case was decided under the 1998 Act, whose maximum fine was £500,000, as the press release notes. Inth found no record of an appeal.

## What it cost

£400,000, close to the legal maximum at the time.

## Why it matters

It is old law, so it says little about today's fine levels. The lesson still holds: if a sign-up feeds third parties, people need to be told clearly who gets their data. The ICO stressed that the records covered potentially vulnerable new mothers and very young children.

## How Inth catches this

- **Code audit** can map reviewed data ingestion and onward-sharing routes, which shows where sign-up data goes after the form.

Inth does not see paper forms or in-person sign-ups, and sign-up screens are outside the banner. It cannot establish what a partner does with data once it arrives.

## Checks for your own systems

### In the repository

- List every export or API feed that sends member data to a third party.

### In the browser and network

- Read the sign-up form as a new member would, and check whether it names who receives the data.

### With the people responsible

- Compare the recipient list in contracts with the list in the privacy notice.
- Check that paper and in-person sign-ups carry the same choices as the online form.

## Sources and limits

- [ICO press release (official press release mirror)](https://www.wired-gov.net/wg/news.nsf/articles/Bounty+UK+fined+400000+for+sharing+personal+data+unlawfully+15042019091000?open=)
- [BBC News](https://www.bbc.co.uk/news/technology-47908222)
- [The Guardian](https://www.theguardian.com/technology/2019/apr/12/parenting-club-bounty-fined-selling-users-data)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Bounty's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Easylife](/enforcement/easylife), [Experian v ICO](/enforcement/experian-ico)