Incident Overview
The UK High Court ruled in April 2025 that Sky Betting & Gaming (operating under Flutter Entertainment) unlawfully used automated profiling and targeted marketing to exploit a recovering problem gambler. The judgment in RTM v. Bonne Terre Ltd & Hestview Ltd established that the company’s algorithmic systems violated UK data protection law by continuing to aggressively market to an individual with clear indicators of gambling addiction. This marks the first UK court decision directly linking gambling operators’ profiling practices to breaches of data protection regulations, particularly concerning vulnerable populations.
The case centered on RTM, a recovering problem gambler whose interactions with Sky Bet began in early 2017. Despite exhibiting signs of addiction—including repeated losses, self-exclusion attempts, and safer-gambling triggers—the company’s systems classified him as a high-value customer. Direct marketing resumed on July 28, 2017, and persisted through late 2018, even as Sky Bet’s internal safer-gambling suppression mechanisms intermittently suspended his account. The High Court’s ruling on January 23, 2025, confirmed that Sky Bet lacked valid consent to process RTM’s data for targeted marketing, given his demonstrated vulnerability.
The judgment underscores the risks posed by AI-driven profiling in high-stakes industries like gambling, where automated systems may override ethical safeguards. Sky Bet’s appeal was heard in March 2026, though the core finding—that its profiling and marketing exploited a known vulnerability—remains legally established. The case also highlights broader concerns about how personal data is used in behavioral targeting, particularly when individuals are unable to provide meaningful consent due to cognitive or psychological impairments.
Key systems implicated in the incident include Sky Bet’s propensity modeling system, personalized direct marketing system, and customer DNA database, all of which relied on cookie-based behavioral tracking and automated profiling. These systems were designed to identify and engage high-value customers but failed to account for addiction-related risks. The High Court’s decision explicitly ties the harm to the lack of valid consent under UK data protection law, setting a precedent for how automated decision-making must consider individual autonomy and vulnerability.
The psychological and financial harm suffered by RTM extended beyond the courtroom. The relentless marketing contributed to his relapse, leading to self-harm and further financial losses. The case also exposes regulatory gaps in overseeing AI-driven marketing in sectors with known vulnerabilities, such as gambling.
Possible Root Cause
The primary root cause of the incident lies in Sky Betting & Gaming’s failure to obtain valid consent for data processing, as required by UK data protection law (primarily the UK GDPR and Data Protection Act 2018). This failure stemmed from the company’s reliance on automated systems that prioritized commercial objectives over individual autonomy, particularly for users exhibiting signs of addiction.
A second contributing factor was the design and deployment of Sky Bet’s profiling and marketing systems, which lacked adequate safeguards to identify and exclude vulnerable individuals. The company’s propensity modeling system and customer DNA database were trained to maximize engagement and revenue, not to mitigate harm. Despite internal safer-gambling suppression mechanisms—such as temporary account suspensions—these systems did not permanently de-prioritize RTM or other at-risk users. The automated profiling algorithms continued to classify him as a high-value target, overriding manual interventions.
Sky Bet’s systems were optimized for predictive accuracy in identifying profitable customers, not for recognizing or responding to addiction-related behaviors. Behavioral tracking via cookies and other data sources fed into these models without sufficient human oversight to challenge or contextualize the outputs. This automation bias—where algorithms amplify existing business priorities without ethical constraints—directly enabled the exploitation of RTM’s vulnerability.
The High Court’s ruling suggests that current frameworks may not adequately scrutinize how AI systems process and act on sensitive personal data, particularly when targeting vulnerable populations. The lack of clear guidelines on consent for high-risk individuals further compounded the issue, allowing Sky Bet to continue marketing despite clear signs of harm.
Takeaways
Bonne Terre judgment establishes a critical precedent for how UK data protection law applies to AI-driven profiling in high-risk industries. Courts may now interpret consent requirements more strictly when automated systems target individuals with demonstrated vulnerabilities, such as gambling disorders. Organizations using AI for personalized marketing must ensure that consent is not only obtained but also continuously validated in light of changing user circumstances, particularly for those exhibiting signs of addiction or other cognitive impairments.
- Automated systems must incorporate ethical safeguards to prevent exploitation of vulnerable users. Sky Bet’s case demonstrates that profit-driven AI models—without explicit harm-reduction constraints—can prioritize engagement over welfare.
- Regulatory frameworks need to address AI-specific risks in data protection. The High Court’s ruling highlights gaps in how UK GDPR and sector-specific regulations (e.g., gambling laws) interact with automated decision-making. The case also suggests a role for proactive enforcement against companies that fail to demonstrate compliance with consent and fairness principles in AI-driven marketing.
- Vulnerability assessment should be a core component of AI lifecycle governance. Organizations deploying profiling systems must conduct ongoing risk assessments to identify and mitigate harms to susceptible populations. Sky Bet’s failure to act on safer-gambling triggers until late 2018 illustrates the need for dynamic risk management in AI systems.
- The gambling sector, along with other high-risk industries (e.g., fintech, social media), should develop shared guidelines for responsible AI use in behavioral targeting. This could involve creating cross-sector task forces to address common challenges, such as defining valid consent for vulnerable users or establishing benchmarks for algorithmic fairness. The High Court’s decision may incentivize such initiatives, as companies face growing legal exposure for AI-driven harms.
- Individuals with gambling disorders require stronger protections under data law. The case reveals that current consent mechanisms are inadequate for populations with impaired decision-making capacity.
- Technical evaluations of AI systems must incorporate psychological, ethical, and legal perspectives to identify harms that may not be apparent through traditional metrics (e.g., accuracy or revenue). Sky Bet’s systems performed as intended from a commercial standpoint but failed to account for the psychological impact on users. This underscores the importance of multidisciplinary teams in designing, auditing, and deploying AI, particularly in contexts where user harm is a plausible outcome.
Sources
Incident summary from the AI Incident Database, used under CC BY-SA 4.0.