This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The UK High Court ruled that Sky Betting & Gaming unlawfully used automated profiling and targeted marketing to pursue a recovering problem gambler. The court determined that the company failed to obtain valid consent, noting that the individual's vulnerability due to addiction impaired their ability to provide genuine consent. This case highlights the legal risks of using automated profiling to target vulnerable data subjects.
In the UK, the High Court found that Sky Betting & Gaming unlawfully used automated profiling and targeted direct marketing to pursue a recovering problem gambler from July 28, 2017 onward without valid consent. Sky reportedly treated him as a high-value customer despite addiction indicators.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The automated profiling system was used to target a vulnerable problem gambler with direct marketing, manipulating their behavior to fuel their gambling addiction for commercial gain.
The incident involved the unlawful collection and processing of a user's data through cookies and automated profiling for targeted marketing without obtaining valid consent, violating data privacy laws.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by the human decision of Sky Betting & Gaming to deploy an automated profiling and targeted marketing system without obtaining valid consent from a vulnerable user. This occurred post-deployment while the system was actively profiling and marketing to the claimant.
Added categories peak at 2: Minor (Psychological Harm, Direct)
The UK High Court ruled against Sky Betting & Gaming for using automated profiling to target a recovering gambler. While establishing a significant legal precedent for data privacy and algorithmic exploitation of vulnerable populations, the incident remains a civil regulatory matter with minor national security implications.
The system operated independently to perform automated profiling and direct marketing targeting based on user tracking data, making real-time decisions on which marketing materials to send without direct human intervention for each action.
Unacceptable Risk: The system represents an exploitative application that targets the vulnerabilities of individuals (specifically, gambling addiction) to influence their behavior to their detriment, which aligns with the prohibition of systems targeting vulnerabilities.
The system's primary function was to deliver targeted direct marketing and advertisements to users, which it achieved by profiling and modeling their online behavior.
The reports provide clear and consistent details about the High Court judgment, the parties involved, the specific legal issues regarding consent and automated profiling, and the nature of the harm (distress and financial loss). The role of the automated profiling system is explicitly discussed in relation to GDPR Article 22 and cookie consent.
None. The case is clearly a data protection and privacy dispute centered on automated profiling.
Technology
Automated Profiling Algorithms
Profiling targeted vulnerable individuals with betting advertisements.
Inadequate Tracking Cookie Controls
Cookies collected data for marketing without obtaining valid consent.
Data Inputs
Lack of Vulnerability Indicators
Systems lacked data inputs to identify and flag problem gamblers.
Unlawful Personal Data Collection
Data was collected and processed without meeting legal consent standards.
Human Factors
Impaired Consent Capacity
Claimant's gambling addiction impaired the ability to provide free consent.
Uncontrolled Craving to Gamble
Addiction overrode autonomous decision-making during the consent process.
Process and Methods
Flawed Consent Acquisition Process
Mechanisms and information provided were insufficient to establish consent.
Lack of Exclusion Mechanisms
No processes existed to exclude vulnerable users from direct marketing.
Management
Failure to Assess Vulnerability Risks
Management did not implement systems to identify and protect vulnerable users.
Prioritizing Marketing Over Safety
Targeted marketing was sent to problem gamblers without safety safeguards.
Regulatory Environment
GDPR Article 22 Compliance Failure
Automated profiling targeted known problem gamblers without explicit consent.
Evolving Consent Standards
Legal standards require considering the data subject's vulnerabilities.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
