LONDON — When Gregg finally stopped gambling in late 2018, he was in a dire financial position. He had lost nearly $15,000 during a nine-month betting binge, on top of two outstanding loans totaling more than $70,000 and a mortgage of more than $150,000 on his small home in Britain.
Now he is on a hunt to know whether his favorite gambling app, Sky Bet, knew about his problems and still tried to hook him.
Records show that Sky Bet had what amounted to a dossier of information about Gregg. The company, or one of the data providers it had hired to collect information about users, had access to banking records, mortgage details, location coordinates, and an intimate portrait of his habits wagering on slots and soccer matches.
After he stopped gambling, Sky Bet’s data-profiling software labeled him a customer to “win back.” He received emails like one promoting a chance to win more than $40,000 by playing slots, after marketing software flagged that he was likely to open them. A predictive model even estimated how much he would be worth if he started gambling again: about $1,500.
Gregg learned about the behind-the-scenes tracking after he hired a lawyer and took advantage of Britain’s data protection laws, which require companies to share with people what personal data they hold about them. He wanted to know if Sky Bet had profiled and targeted him even as he tried to quit gambling.
He shared the documents with The New York Times on the condition that his full name not be used, out of concern that the details would imperil his career and sever relationships with family and friends.
Sky Bet did not dispute that any of the records were authentic. But the company said it did not have access to certain information like banking and mortgage data, which was collected and held by outside companies.
As gambling apps explode in popularity around the world, the documents show how one of the gambling industry’s most popular apps has adopted some of the internet’s most invasive tracking and profiling techniques. Instead of using data to identify and help problem gamblers like Gregg, critics of the industry said, information is used to keep players hooked.
Gambling apps like Sky Bet make it as easy to wager as to order an Uber. Many people view them as an innocent diversion. But to a group of gambling addiction experts, data-privacy activists and industry critics in Britain, home to the world’s largest app gambling market, the documents offer a warning to players and regulators in countries like the United States, where similar services are growing rapidly. More than a dozen states, including New Jersey, Nevada and Virginia, now allow app-based gambling.
They said the companies behind the apps required more oversight and are calling for tougher laws to identify problem gamblers and prevent data from being used in underhanded and predatory ways.
“Wherever gambling companies operate, there should be a real understanding about how data is an integral part of the business,” said Ravi Naik, a London lawyer behind the effort to obtain Gregg’s data. “When we start to look inside the vault, as we are here, then we see how vulnerabilities are laid out to the platforms.”
Mr. Naik said the data obtained thus far was just one piece of the puzzle. He has filed additional legal motions in Britain trying to uncover more details about what gambling companies do with the collected data, and if it is used to customize offers and create other inducements to lure customers, particularly the most vulnerable players. A House of Lords report published last year said 60 percent of the gambling industry’s profits came from the 5 percent of customers who were “problem gamblers,” or at risk of becoming so.
“We’re trying to get transparency,” Mr. Naik said. “It shouldn’t take this much work from lawyers to figure out what’s going on.”
Let Us Help You Protect Your Digital Life
Sky Bet was the most popular gambling app in Britain last year, downloaded roughly 140,000 times per month, according to the market research firm Apptopia. Once controlled by Rupert Murdoch’s British media company, Sky, it is now owned by Flutter Entertainment, which owns a number of casino apps and generated about $7.4 billion in revenue last year.
In Sky Bet’s privacy policy, which runs over 10,000 words, the company says it collects personal information including browsing history, spending, demographic data and behavioral information, such as the sports a person likes to bet on. The data, which can be shared across at least 12 gambling services owned by Flutter, is used for marketing and personalization, while financial information is collected for money-laundering and fraud protection, the policy says.
At least eight times in the privacy policy, the company suggests that people who don’t want all that data collected “not use our services and to close your account.”
Nigel Eccles, a former chief executive officer of FanDuel, now owned by Flutter and one of the largest gambling apps in the United States, said online gambling companies conducted extensive data-analysis work to identify their best customers. The companies see how much the people are betting and try to predict what will get them to spend more. But he said gambling companies were in a delicate position because their best customers might also have gambling problems.
“It’s not that they have access to this data — it’s what they do with it,” said Mr. Eccles, who now runs a chat service for sports fans. “If you use that data in a way that you know, or should know, is harmful to your users, then that’s a serious problem.”
Mr. Naik, who previously helped uncover data misuse by the political consulting firm Cambridge Analytica, was contacted last year by Gregg, who was seeking help getting copies of data from Sky Bet and companies it used to profile users.
The data that he and Mr. Naik obtained included a 34-page breakdown of his financial history from a company called CallCredit, which conducts fraud and identify checks for Sky Bet. It contained information about his bank accounts, debts and mortgage, with details down to monthly payments. In bold was a loan default in March 2019.
Another company used by Sky Bet, Iovation, provided a spreadsheet with nearly 19,000 fields of data, including identification numbers for devices that Gregg used to make deposits to his gambling account and network information about where they were made from.
A document from Signal, a company used by Sky Bet that provides tools for tracking users online and offline, listed personal characteristics, like Gregg’s history of playing slots and making soccer his favorite sport to bet on.
Most alarming, Mr. Naik said, was how software appeared to offer suggestions to lure back Gregg after he stopped gambling in late 2018. In the data profile that listed Gregg as a customer to “win back” were codes noting he was receptive to gambling promotions that featured Las Vegas. Having made more than 2,500 deposits on Sky Bet, he was listed as a “high value” customer.
“They had taken his addiction and turned it into code,” Mr. Naik said. “He’s high value because he’s willing to spend regular and high amounts even when it’s crippling him. They’re saying: Keep him coming back — he’s worth a lot more.”
Sky Bet and Flutter Entertainment declined to comment on the record earlier this month after being sent a series of detailed questions for this article. But after the article was published on Wednesday, Sky Bet said in a statement that it did not have access to financial information like banking records and mortgage loans, which are collected and held by an outside company, nor can it access certain tracking data.
The company said it used software to identify problem gamblers based on their frequency of play and deposits, and limited a person’s ability to gamble if somebody was viewed as at risk. Players can also self-exclude, the company said.
“Sky Betting & Gaming takes its safer gambling responsibilities incredibly seriously,” the company said. “Whilst we run marketing campaigns based on our customers expressed preferences and behaviors, we would never seek to advertise to anyone who may potentially be at risk of gambling harm.”
TransUnion, a large American credit scoring agency that owns CallCredit, Signal and Iovation, said that it complied with data protection laws and that gambling platforms used its services in a number of ways, including to detect fraud and money laundering.
Britain has been at the forefront of online betting. In 2020, the gambling app market in Britain totaled $7.3 billion, nearly double the next-largest market, Japan, according to Global Betting and Gaming Consultants, an industry research group. This week, four of the top five free sports apps on Apple’s App Store in Britain are gambling related. The companies own and sponsor soccer teams and dominate advertising during televised sporting events.
The country is at the center of the global debate about regulating the new generation of betting apps. The government has opened a review of gambling laws that will include the consideration of new rules for data use and affordability checks, according to the agency conducting the review.
Lawmakers should pass new regulations that allow companies to use data to spot problem gamblers but limit how it can be used for marketing and other sales objectives, said James Noyes, a senior fellow at the Social Market Foundation, a London think tank.
“They detect your pattern of play, your likes, dislikes, spending tendencies and exposure to risk,” Mr. Noyes said. “It’s taking information about you and turning it right back on you.”