Run a free scan

Sky Betting and Gaming: ad cookies fired before the banner

The ICO found that skybet.com set advertising cookies and shared device identifiers with adtech vendors before visitors could use the consent tool. It issued a reprimand, not a fine.

ICO · UK GDPR · Reprimand 2 September 2024

Reprimand issued; no fine

Regulator or court
ICO
Jurisdiction
United Kingdom
Framework
UK GDPR Articles 5(1)(a), 6(1)(a) and 7(1)
Reprimand

Cookies before choice or after refusal · Consent before collection · IP addresses and device identifiers · Undisclosed data exchanges

The problem

The banner was on screen, but the tags had already run. For about seven weeks in early 2023, skybet.com set third-party advertising cookies as the page loaded, before a visitor could accept or refuse anything in the consent management platform.

Case record

Regulator
Information Commissioner’s Office (ICO)
Organisation
Bonne Terre Limited, trading as Sky Betting and Gaming
Action
Reprimand dated 2 September 2024
Law
UK GDPR Articles 5(1)(a), 6(1)(a) and 7(1)
Period
10 January to 3 March 2023
Stage
Reprimand issued. No fine

What the regulator found

These are ICO findings in the reprimand, not allegations.

  • Third-party advertising cookies were set on visitors' devices before they could use the consent management platform. The ICO names MediaMath among the vendors.
  • Device identifiers and unique identifiers went to adtech vendors without consent, so the processing had no lawful basis and was not fair or transparent.
  • The case started with a complaint from the campaign group Clean Up Gambling. The ICO said it found no evidence that the company was deliberately targeting vulnerable gamblers.

Technical issue

Inth’s technical interpretation: the reprimand does not publish the code. The usual cause of this pattern is a vendor tag placed in the page head or a tag manager rule that fires on page view, while the banner script loads alongside it. The banner then asks a question the page has already answered.

<!-- Risky: ad tag runs on page load -->
<script src="https://adtech.example/pixel.js"></script>

<!-- Safer: the tag waits for marketing consent -->
<script>
  consent.onGranted('marketing', () => loadScript('https://adtech.example/pixel.js'));
</script>

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

  1. 10 January 2023Start of the period covered by the reprimand
  2. 2 March 2023ICO tells the company about the issue
  3. 3 March 2023Company fixes the cookie behaviour
  4. 17 March 2023ICO verifies the fix
  5. 13 February 2024ICO notice of intent
  6. 2 September 2024Reprimand issued and published

Outcome

The ICO issued a reprimand. A reprimand is a formal finding that the law was broken, but it carries no fine and no order. The ICO announcement notes the company fixed the issue the day after the ICO raised it.

What it cost

No fine. The cost was a public finding against a major brand and an ICO investigation that ran for about 18 months after the fix.

Why it matters

Having a banner is not the same as respecting it. This is the clearest UK record of tags firing before a choice. It also shows the ICO framing cookie-driven data sharing as a UK GDPR lawfulness problem, not only a PECR one.

How Inth catches this

  • Website audit records what loaded before a choice and after Reject, with the page, time, region and consent state.
  • Code audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.
  • Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses. Tags without a c15t helper must be gated in your own code.
  • Evidence: consent records show each visitor’s choice, country and policy. Runtime observations show what loaded in each state.

A browser observation cannot establish what a vendor did with the data after it arrived.

Checks for your own systems

In the repository

  • List every script in the page head and confirm each optional one sits behind a consent check.
  • Review tag manager triggers that fire on page view.

In the browser and network

  • Open the site in a clean UK profile and record cookies and third-party requests before touching the banner.
  • Repeat after Reject and after Accept, and compare.

With the people responsible

  • Ask who can add vendor tags and whether a release check covers consent gating.
  • Ask how quickly a reported leak can be fixed and verified, as Sky did within a day.

Sources and limits

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Sky Betting and Gaming’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.