[Enforcement library](/enforcement)

# Sky Betting and Gaming: ad cookies fired before the banner

The ICO found that skybet.com set third-party advertising cookies before visitors could make a choice in the consent tool. It issued a reprimand, not a fine.

## Key facts

- **Regulator or court:** ICO
- **Jurisdiction:** United Kingdom
- **Framework:** UK GDPR Articles 5(1)(a), 6(1)(a) and 7(1)
- **Record date:** 2024-09-02
- **Procedural status:** Reprimand issued; no fine

The ICO found that skybet.com set advertising cookies and shared device identifiers with adtech vendors before visitors could use the consent tool. It issued a reprimand, not a fine.

ICO · UK GDPR · Reprimand 2 September 2024

- The problem
- Case record
- What the regulator found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

The banner was on screen, but the tags had already run. For about seven weeks in early 2023, skybet.com set third-party advertising cookies as the page loaded, before a visitor could accept or refuse anything in the consent management platform.

## Case record

| Field | Record |
| --- | --- |
| Regulator | Information Commissioner's Office (ICO) |
| Organisation | Bonne Terre Limited, trading as Sky Betting and Gaming |
| Action | Reprimand dated 2 September 2024 |
| Law | UK GDPR Articles 5(1)(a), 6(1)(a) and 7(1) |
| Period | 10 January to 3 March 2023 |
| Stage | Reprimand issued. No fine |

## What the regulator found

These are ICO findings in the [reprimand](https://ico.org.uk/media2/i15p1czl/bonne-terre-limited-reprimand.pdf), not allegations.

- Third-party advertising cookies were set on visitors' devices before they could use the consent management platform. The ICO names MediaMath among the vendors.
- Device identifiers and unique identifiers went to adtech vendors without consent, so the processing had no lawful basis and was not fair or transparent.
- The case started with a complaint from the campaign group Clean Up Gambling. The ICO said it found no evidence that the company was deliberately targeting vulnerable gamblers.

## Technical issue

**Inth's technical interpretation:** the reprimand does not publish the code. The usual cause of this pattern is a vendor tag placed in the page head or a tag manager rule that fires on page view, while the banner script loads alongside it. The banner then asks a question the page has already answered.

```html
<!-- Risky: ad tag runs on page load -->
<script src="https://adtech.example/pixel.js"></script>

<!-- Safer: the tag waits for marketing consent -->
<script>
  consent.onGranted('marketing', () => loadScript('https://adtech.example/pixel.js'));
</script>
```

Illustrative pattern, not the defendant's code. Generic consent API, not a specific c15t call.

## Timeline

| Date | Event |
| --- | --- |
| 10 January 2023 | Start of the period covered by the reprimand |
| 2 March 2023 | ICO tells the company about the issue |
| 3 March 2023 | Company fixes the cookie behaviour |
| 17 March 2023 | ICO verifies the fix |
| 13 February 2024 | ICO notice of intent |
| 2 September 2024 | Reprimand issued and published |

## Outcome

The ICO issued a reprimand. A reprimand is a formal finding that the law was broken, but it carries no fine and no order. The [ICO announcement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/09/action-taken-against-sky-betting-and-gaming-for-using-cookies-without-consent/) notes the company fixed the issue the day after the ICO raised it.

## What it cost

No fine. The cost was a public finding against a major brand and an ICO investigation that ran for about 18 months after the fix.

## Why it matters

Having a banner is not the same as respecting it. This is the clearest UK record of tags firing before a choice. It also shows the ICO framing cookie-driven data sharing as a UK GDPR lawfulness problem, not only a PECR one.

## How Inth catches this

- **Website audit** records what loaded before a choice and after Reject, with the page, time, region and consent state.
- **Code audit** flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.
- **Consent banner:** under the EU opt-in policy, optional tags wait until the visitor chooses. Tags without a c15t helper must be gated in your own code.
- **Evidence:** consent records show each visitor's choice, country and policy. Runtime observations show what loaded in each state.

A browser observation cannot establish what a vendor did with the data after it arrived.

## Checks for your own systems

### In the repository

- List every script in the page head and confirm each optional one sits behind a consent check.
- Review tag manager triggers that fire on page view.

### In the browser and network

- Open the site in a clean UK profile and record cookies and third-party requests before touching the banner.
- Repeat after Reject and after Accept, and compare.

### With the people responsible

- Ask who can add vendor tags and whether a release check covers consent gating.
- Ask how quickly a reported leak can be fixed and verified, as Sky did within a day.

## Sources and limits

- [ICO enforcement record: Bonne Terre Limited](https://ico.org.uk/action-weve-taken/enforcement/2024/09/bonne-terre-limited/)
- [ICO reprimand (PDF)](https://ico.org.uk/media2/i15p1czl/bonne-terre-limited-reprimand.pdf)
- [ICO announcement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/09/action-taken-against-sky-betting-and-gaming-for-using-cookies-without-consent/)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Sky Betting and Gaming's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [ICO top 1,000 cookie review](/enforcement/ico-top-1000-cookie-review), [SHEIN](/enforcement/shein), [GDPR and ePrivacy cookie rules](/enforcement/laws/gdpr-and-eprivacy-cookies)