Welcome back to Harris Hagan’s White Paper Series of articles.

We have previously discussed the UK Government’s proposals relating to gambling sponsorship (see our previous White Paper Series article on sponsorship). 

In this article, we outline changes proposed in the Gambling Commission’s Summer 2023 consultation regarding direct marketing and cross-selling (the “DM Consultation”), which was published on 26 July 2023 and will remain open for 12 weeks, closing 18 October 2023.  We then contrast these proposals with the UK Government’s recommendations in the White Paper: High stakes: gambling reform for the digital age regarding direct marketing and cross-selling.  Finally, we explain how, if implemented, the Gambling Commission’s proposals would change current privacy and direct marketing laws, and how they apply to the gambling industry as a whole. 

1. Background

In Chapter 2 of the White Paper, which deals with marketing and advertising, tougher restrictions on bonuses and direct marketing are one of the key reforms proposed by the Government. In the introduction to the chapter, the Government confirms that it recognises that online bonus offers can present risk, particularly for those experiencing gambling harm. In order to mitigate this risk, one of the key recommendations in Chapter 2 is that the Gambling Commission consult on strengthening consent for direct marketing, with the aim to give customers more choice in terms of the marketing they receive and how.

According to the White Paper, the proposal to strengthen consent for direct marketing is in addition to what the White Paper refers to as (emphasis added):

“the forthcoming introduction of requirements to not target any direct marketing at those showing strong indicators of risk, as outlined in the Gambling Commission’s requirement 10.”

For those in the know, this rather cryptic/confusing reference is to Requirement 10 of social responsibility code provision (“SRCP”) 3.4.3 of the Licence Conditions and Codes of Practice (“LCCP”), which reads as follows (emphasis added again):

“Licensees must prevent marketing and the take up of new bonus offers where strong indicators of harm, as defined within the licensee’s processes, have been identified.”

Requirement 10, which is now in force, was originally due to come into effect on 12 September 2022 alongside the Gambling Commission’s revised Remote Customer Interaction Guidance (“RCI Guidance”). However, to widespread surprise, the Gambling Commission delayed the implementation of Requirement 10 to 12 February 2023 and decided at the last minute to consult on the RCI Guidance before it came into effect.

The subsequent Consultation on Remote Customer Interaction (the “RCI Consultation”) was launched on 22 November 2022 and open for only six weeks (subsequently extended to nine) instead of the traditional 12. Eight months later, the RCI Guidance is still not in effect and the Gambling Commission has yet to publish a response to the RCI Consultation.

It is therefore confusing that the White Paper (published on 27 April 2023):

1. links to the not-yet introduced RCI Guidance when it refers to Requirement 10;
2. refers to the Requirement 10 as “forthcoming”; and
3. suggests that Requirement 10 applies where there are “strong indicators of risk” (not “strong indicators of harm”, the latter being the language of both SRCP 3.4.3 and the RCI Guidance).

It is also perplexing that the Gambling Commission has chosen to publish the DM Consultation before the RCI Consultation, despite promising the contrary at IAGA’s 40^th Annual Gaming Summit in Belfast. 

For further analysis on the RCI Consultation (which we now have no idea when the response to which will be received), please see our five-part series of articles with Regulus Partners. available here: Part 1; Part 2; Part 3; Part 4 and Part 5.

Back to the topic at hand: Direct marketing. In the White Paper, the Government sets out a number of proposed principles for the Gambling Commission to explore through the DM Consultation, set out below:

At first blush, these appear on balance to be sensible suggestions that broadly build upon principles in existing privacy and direct marketing laws; we discuss this in further detail below.

More recently, in a pre-briefing to selected industry stakeholders on 5 July 2023, the Gambling Commission used its own terminology/short hand to describe the areas upon which the DM Consultation would focus:

Finally, on 26 July 2023, the Gambling Commission published its first summer consultation, a copy of which is available here:

Below, we:

1. explain the current legal position in relation to each of the principles identified by the Government in the White Paper as requiring reform;
2. (attempt to) link the White Paper principles to the Gambling Commission’s proposal, as set out in the DM Consultation, to add a new SRCP to the LCCP regarding direct marketing preferences (“SRCP 5.1.12”); and
3. finally, share our views on possible implementation issues, timelines, practicalities and direct costs that may impact the industry should SRCP 5.1.12 come into force in its current form – with the aim to help respondents shape their own responses to the DM Consultation.

For ease of reference, the proposed wording for SRCP 5.1.12 is set out below:

“Applies to: All licences

SR Code – 5.1.12 – Direct marketing preferences

[1] Licensees must provide customers with options to opt-in to direct marketing on a per product and per channel basis. The options must cover all products and channels provided by the licensee and be set to opt-out by default. These options must be offered as part of the registration process and be updateable should customers’ [sic] change their preference. This requirement applies to all new and existing customers.

[2] Channel options must include email, SMS, notification, social media (direct messages), post, phone call and a category for any other direct communication method, as applicable.

[3] Product options must include betting, casino, bingo, and lottery, as applicable. Operators must make clear to customers which products they offer are covered under relevant categories.

[4] Where an operator seeks an additional step for consumers to confirm their chosen marketing preferences, the structure and wording of that step must be presented in a manner which only asks for confirmation to progress those choices with one click to proceed. There must be no encouragement or option to change selection; only the option to accept or decline their selection.

[5] Customers must not receive direct marketing that contravenes their channel or product preferences.”

If you would like our assistance responding to the DM Consultation, please contact Gemma Boore or your usual contact in the Harris Hagan team.

2. Analysis

Principle A in the White Paper: Opt-in to marketing and offers should be clear and separate options at sign‑up, not bundled with other consent such as broader terms and conditions and privacy policy.

What is the current legal position?

As rightly noted in the White Paper, there are already clear requirements that operators must seek informed and specific consent to send direct marketing to consumers. These are outlined in the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) and UK General Data Protection Regulation, as implemented by the Data Protection Act 2018 (“UK GDPR”) – both enforced by the Information Commissioner’s Office (“ICO”).

The current legal position can be broken down as follows:

1. PECR requires that, subject to limited exceptions, specific prior consent must be obtained to send direct marketing to individuals by electronic communication (e.g. emails, calls and texts – NB. this does not include non-electronic methods of communication, this will be important later on).
2. According to ICO guidance, the best way to obtain valid consent is to ask customers to tick opt-in boxes confirming they are happy to receive marketing calls, texts or emails from you.
3. Consent is defined in the EU General Data Protection Regulation (“EU GDPR”) (which was transposed into national law by UK GDPR following Brexit) as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” [or they/them].
4. To put things simply, the implementation of EU GDPR significantly strengthened the concept of consent for the purposes of PECR and meant that many companies needed to refresh consents previously obtained for direct marketing as they did not meet EU GDPR’s new higher threshold of consent. This was typically because existing consents had not been freely given (e.g. they were obtained in order to gain an incentive, such as an entry into a competition); were not specific enough (e.g. they did not specify who would send the marketing, or what type of marketing would be sent); or had been obtained by means of a pre-ticked box during sign up (which does not involve an affirmative action by the customer – rather, it requires inaction).
5. There is however, one key exception in PECR to the requirement to obtain consent to direct electronic marketing and this is known as the “soft opt-in”.
6. Broadly, the soft opt-in means that you do not need to obtain consent when you’re sending marketing emails or texts to offer similar goods or services to your customers or prospective customers. The example given in the ICO guidance is that “if a customer buys a car from you and gives you their contact details, you’d only be able to market to them things that relate to the car eg offering services or MOTs”.
7. To rely on the soft opt-in, you must give the customer a simple opportunity to refuse or opt out of the marketing, both when first collecting the details and in every message after that.

As can be seen from the above, there is an argument that the second limb of Principle A (i.e. consent should not be bundled with other consent such as broader terms and conditions and privacy policies) does not alter the current legal position. The higher threshold of consent to direct electronic marketing is already required and has been since 25 May 2018 (when EU GDPR came into force).  It would be very difficult to argue that marketing consents bundled with consent to, for example, terms & conditions or privacy notices are “freely given, specific, informed or unambiguous” – and any gambling operators engaging in this practice are already at risk of enforcement action from the ICO. So, what did the Government want the Gambling Commission to change?

What is proposed in the DM Consultation?

SRCP 5.1.12 proposes new specific requirements for licensees to offer all customers (not just new) more granular consent options (per channel and per product) – with consent options set to opt-out by default (i.e. not pre-ticked). There is no exception to this rule, i.e. gambling companies will no longer be able to rely upon the soft opt-in. Arguably, this does not change the high bar of consent that is already required under UK GDPR and PECR (as intimated by the Gambling Commission’s pre-briefing); rather, it removes an exception to the high bar of consent which otherwise applies to all other commercial businesses in the UK.

Turning to the first limb of Principle A (i.e. opt-in to marketing and offers being clear and separate options at sign-up), this indicated that the Government wanted to give consumers more choice in terms of whether they receive (i) marketing and/or (ii) offers.

The Government’s commentary regarding submissions in the call for evidence from people suffering from gambling harms sheds some light on what was intended here:

“Submissions from people with personal experience of gambling harms elaborated on the negative effects which can come from… …direct marketing and inducements. These ranged from feeling ‘spammed’ by the volume of marketing, including in forms such as push notifications that they had not intentionally agreed to; to continuing to receive marketing even after an operator had removed them from offers due to the risk of harm and receiving promotions via email during periods of abstinence which triggered a relapse.”

It appears the Government is distinguishing between marketing of a service, on one hand (for example, provision on odds for sporting events or new casino games by email, text or push notification); from the provision of incentives such as free bets or bonus offers, on the other. 

Surprisingly, there is no equivalent reference to this distinction in the DM Consultation.

What could possibly go wrong?

If operators can no longer rely upon the soft opt-in exception, this would:

1. significantly alter current practices whereby operators and affiliates have to date, in line with current rules, sent (e.g.) marketing emails and texts to customers offering similar services;
2. result in operators and affiliates needing to seek fresh consent from millions of individuals that have not actively opted-out to marketing – potentially losing huge tranches of customer databases in the process; and
3. mean gambling would stand alone – in terms of being the only commercial industry in which express consent is always required in order to send electronic marketing.

These changes are likely to have a huge impact on big and small operators alike, as well as the affiliates that send direct marketing on their behalf – each of which are likely to have spent significant time and money curating their customer databases lawfully since EU GDPR, often by relying on the soft opt-in. 

And when would this momentous change take place? The Gambling Commission notes that preferences to receive offers would need to “be reconfirmed in a new format”, implying that fresh consent must be obtained in order to be able to continue marketing to customer databases after a certain date.   Will this be the case from a hard-stop date, or will an operator be permitted to send marketing until its customer is next presented with the option to reconfirm preferences (e.g. the next time they sign in) – meaning that some customers will forever lie in limbo, receiving marketing but never confirming that they no longer wish to receive it?

The Gambling Commission’s commentary in the DM Consultation regarding the process for existing customers suggests that the latter option may indeed be the case:

“We are proposing that, if introduced, licensees must direct customers to the webpage or area of the site/app where they can decide whether to opt in to offers or not at the first opportunity after implementation date, for example upon next login.”

Either way, refreshing consent for all soft opted-in customers (or, in the worst-case scenario, all customers), will undeniably result in a huge number of customers that are currently receiving marketing with no objections, suddenly being suppressed from marketing lists – and consequential loss of revenue for operators and affiliates.

How many of those customers will expressly opt back in with each operator, for each product and for each channel – surely only a proportion…. was this what is intended? A clean start for the population as a whole – so those who wish to receive gambling marketing can, once again, choose to receive the (metaphorical) filth and the remaining population (who must have either gambled or opted into marketing at some point if they are currently receiving marketing – after all, EU GDPR did happen) can be spared? Was this really what the Government intended in the White Paper or the Gambling Commission’s way of quashing gambling advertising to the greatest extent possible, despite the Government’s conclusion that it could not find a causal link between advertising and gambling harms or the development of a gambling disorder?

Finally – although those in the pro-gambling camp may not wish to highlight this in their response – no commentary on the DM Consultation would be complete without acknowledging the lack of mention of the Government’s recommendation that opt-ins to marketing and offers should be clear and separate options at sign‑up. Although this may be a relief for the industry (who might want to distinguish consent for incentives vs generic marketing), what does it say about the Gambling Commission’s ability to transpose the UK Government’s recommendations into enforceable, realistic and practical requirements?  Playing devil’s advocate, it is of course, possible that the Gambling Commission plans to save this final treat for its forthcoming consultation on free bets and bonus offers, which is due later this year.

We can but “watch this space”.

Principle B in the White Paper: Customers should be able to change preferences at any time through their account settings.

What is the current legal position?

The right to withdraw consent is entrenched under EU GDPR. Article 7(3) provides that the “data subject shall have the right to withdraw his or her consent at any time” and “It shall be as easy to withdraw as to give consent”.

Similarly, and as noted above, those seeking to send direct electronic marketing without obtaining consent under the soft opt-in must be given a simple opportunity to refuse or opt out of the marketing, both when first collecting the details and in every message after that.

The question is therefore how the DM Consultation was intended to build on current legal requirements.  

Some light is shed on the issue by the following commentary in the White Paper:

“…a recent behavioural audit of popular online gambling operators found there was usually extra friction associated with unsubscribing from communications, including ‘scarcity messages’ to discourage consumers from doing so.”

This audit, which was conducted by the Behaviour Insights Team (“BIT”), cited various examples of ‘dark patterns’ used by gambling operators. Dark patterns are techniques used to encourage or compel users into taking certain actions, potentially against their wishes.

From a marketing perspective, the dark patterns identified in BIT’s audit included emotional messaging (e.g. making the customer feel guilty about wanting to unsubscribe) and false hierarchies (e.g. making buttons that the operator wants the customer to press brighter, more colourful, or easier to find, than for example, an unsubscribe button).

What is proposed in the DM Consultation?

SRCP 5.1.12 requires that options to opt-in for direct marketing must be offered to customers as part of the registration process and be “updateable” if customers want to change their preferences.

In addition, the Gambling Commission acknowledges the results of the BIT audit in the preamble to the DM Consultation and cites an example of one operator seeking confirmation when a customer opted-out of marketing in a way which appeared designed to introduce a fear of missing out on offers. In its commentary, the Gambling Commission notes that:

“While seeking a confirmation could be useful to ensure preferences haven’t been accidentally altered, any accompanying message shouldn’t be aimed at discouraging the player’s choice.”

This led to the following (slightly long-winded and very specific) requirement in SRCP 5.1.12:

“Where an operator seeks an additional step for consumers to confirm their chosen marketing preferences, the structure and wording of that step must be presented in a manner which only asks for confirmation to progress those choices with one click to proceed. There must be no encouragement or option to change selection; only the option to accept or decline their selection.”

What could possibly go wrong?

The first requirement for preferences to be “updateable” is of course, an extension of the White Paper’s explicit suggestion that customers should be able to change marketing preferences at any time via account settings. This practice of course, already being common within the industry (not least because the right to withdraw consent is a fundamental concept of EU and UK GDPR) – but not a specific requirement under the LCCP.  By incorporating such a requirement into the LCCP as a SRCP, compliance will be a condition of licences and in the event of breach, the Gambling Commission will have the right to take enforcement action, as well as the ICO.

The second requirement, introduced to prevent operators from encouraging customers not to unsubscribe from marketing, in our view, feels a little short-sighted. Rather than limiting such a restriction to additional steps in the unsubscription process, the Gambling Commission could have sought to prohibit the use of dark patterns in direct marketing completely, potentially by publishing new guidance.

By side stepping the issue, SRCP 5.1.12 addresses only one of the problems identified by BIT in its audit.   This means that the use of other dark patterns may continue to permeate gambling marketing following the implementation of the White Paper and beyond. For example, in terms of emotional messaging or false hierarchies in other parts of the customer consent journey or within direct marketing messages themselves (rather than just on one page that confirms a customer’s request to unsubscribe).

Principle C in the White Paper. Operators must offer the opportunity to opt-in and out of different forms of communication (e.g. text vs email vs push notifications).

What is the current legal position?

The position under PECR is best summarised in the ICO’s Direct Marketing Guidance, which states (emphasis added) that:

 “When using opt-in boxes, organisations should remember that to comply with PECR they should provide opt-in boxes to obtain specific consent for each type of electronic marketing they want to undertake (eg automated calls, faxes, texts or emails). Best practice would be to also provide similar opt-in boxes for marketing calls and mail.”

The ICO goes on to give the following example of good practice:

Push notifications and direct messages on social media are not mentioned in the ICO’s Direct Marketing Guidance, but it follows that specific consent should also be obtained to these channels as they are examples of electronic marketing.

According to the White Paper, the Government is not convinced that the granular level of channel consent required by PECR is being obtained across the industry as a whole:

“When signing up, many major operators offer only an ‘all or nothing’ approach where a user is either unsubscribed from all marketing or provides consent to all communications.”

It follows that the DM Consultation would explore the need to reiterate current PECR requirements, by mandating that specific consent is obtained to each channel that will be used for direct electronic marketing.

What is proposed in the DM Consultation?

As drafted, SRCP 5.1.12 requires that licensees must provide customers with options to opt-in to direct marketing on a per-channel basis. Specifically:

“Channel options must include email, SMS, notification, social media (direct messages), post, phone call and a category for any other direct communication method, as applicable.”

What could possibly go wrong?

While we knew it was very likely (if not a certainty) that the DM Consultation would consult on requiring the industry to obtain specific, granular consent for electronic marketing channels such as email, SMS and by extension, push notifications and direct messages on social media; we are surprised that the Gambling Commission is also considering requiring prior consent to marketing by telephone or post. It is surprising because neither of these channels are currently subject to consent requirements in PECR – rather, the ICO refers to options to opt out of these channels as being “best practice”.

As is the case with the removal of the soft opt-in, this change will mean the gambling industry stands alone in the UK as the only commercial industry in which consent is required to send marketing by post or live phone call.  Is this not perhaps, a step beyond what was intended by the Government in the White Paper? If we turn back to Principle C in the White Paper, it is notable that this mentions text, email and push notifications only. Did the Government really think new restrictions should also apply to live phone calls and post – or is this another example of the Gambling Commission exceeding its remit and seeking to further suppress gambling advertising even when the Government has concluded there is a lack of conclusive evidence of a relationship between gambling advertising and harm?

Finally, respondents will note that there is a question in the DM Consultation regarding whether the category “any other direct communication method” future proofs SRCP 5.1.12.  In our view, this does indeed have the effect of future proofing the provision but, in the same way as the references to “post” and “phone call” in SRCP 5.1.12 extend consent requirements beyond PECR, the catch-all category will also extend it to all other present and future non-electronic methods of communication. For example, a face-to-face conversation with a gambler in a casino, bingo hall, betting shop, racecourse – or even on the street. 

Once again, is this really what is intended and if it is, how does one obtain consent to having a conversation with someone without any communication in the first place? In our view, in order to be practical, prevent inadvertent breach by licensees and reduce the current (perhaps unintended?) regulatory creep, SRCP 5.1.12 should be restricted to the types of electronic communication for which prior consent to direct marketing is already required under PECR (e.g. texts, fax, emails, automated phone calls etc).

Principle D in the White Paper. Customers should be given the option to opt-in to bonuses and promotional offers separately from other marketing, and to set controls regarding which products they receive offers on. Specifically, there should be no ‘cross-selling’ without user opt-in.

What is the current legal position?

Please see our analysis of Principle A above, for a discussion regarding the distinction between incentives and generic marketing – and conclusion that Government’s recommendation to these two forms of marketing be distinguished for consumers has not come to fruition in the DM Consultation.

With regard to cross-selling (which is the practice of marketing a product (e.g. casino) to a customer that is actively participating in another product (e.g. bingo)), it is important to remember that consent under UK GDPR must be freely given, specific, informed, and unambiguous.

The “specific” and “informed” aspects of this definition suggest that the practice of cross-selling different products and services could prove difficult when express consent is relied upon. If an individual has agreed to receive marketing regarding online bingo, they would not expect to receive marketing regarding sports betting opportunities, for example.

The soft opt-in exception to PECR however, is more permissive. In this case, marketing emails or texts regarding similar goods or services can be sent to customers without express consent being obtained in advance. According to the ICO’s Direct Marketing Guidance, the key question when determining whether products are similar is whether the customer would reasonably expect messages about the product or service in question.

In the White Paper, the Government revealed that it was particularly concerned regarding cross-selling practices in the industry. It noted that although causality between problem gambling and gambling on multiple products was not clear, various pieces of evidence presented to it revealed troubling findings:

“the number of different gambling activities individuals participate in is a risk factor for harmful gambling in young people, and that participating in seven or more gambling activities was associated with harmful gambling in adults.”

“engagement with multiple activities is associated with harm, raising important questions about the appropriateness of operators actively encouraging customers to expand their repertoire, particularly to those products associated with a higher problem gambling rate such as online slots.”

The White Paper goes on to recommend that there should be an increased level of customer choice around whether customers receive promotional offers and if so, what kind of offers and for which products.

The key question for the Gambling Commission to consider was therefore, how granular should any such requirement be?  Marketing of (i) online slots to horse racing bettors; or (ii) online bingo to sports bettors (being the two examples given in the White Paper) are obvious examples that are likely to require separate consent going forward. But what about marketing online slots to land-based slots customers or marketing online poker to customers that play other card games online?

What is proposed in the DM Consultation?

The Gambling Commission appears to have gone for the easy option here. It has proposed, in new SRCP 5.1.12, that licensees provide customers with options to opt-in to direct marketing on a per product basis. Specifically:

“Product options must include betting, casino, bingo, and lottery, as applicable. Operators must make clear to customers which products they offer are covered under relevant categories.”

For clarity, examples of products that fall into these broad categories are set out in the preamble to the proposal:

“…the betting option includes virtual betting, gambling on betting exchanges, betting on lottery products as well as all real event betting. Casino includes slots, live casino, poker and all casino games. Bingo includes only games offered in reliance on a bingo licence e.g., not casino products. Lottery covers any lottery product offered in reliance on a lottery licence.”

What could possibly go wrong?

The Gambling Commission’s decision to broadly categorise all gambling products into four pots: (i) betting, (ii) casino, (iii) bingo and (iv) lottery, will be welcome news for marketing teams. By grouping the wide array of potential gambling products so broadly, there will still be many opportunities for cross-selling within each stand-alone category.

To provide some colour – although it will no longer be possible to market slot games to sports bettors – operators with diverse product offerings will still be able to cross-sell a wide range of products.  For example:

1. someone receiving marketing about sports betting could be sent opportunities to bet fixed odds on the weather, politics, lotteries or virtual events – or even match bet other users on a betting exchange;
2. someone receiving marketing about slot games could be shown games such as keno, poker, roulette, baccarat or any of the other wide array of games in the casino family;
3. someone receiving marketing about lotteries could be offered scratch cards to raise money for the same, or a similar, good cause.

In each case, these communications could be sent without prior specific consent – provided the customer consented to receive direct marketing regarding the wider category of products. Arguably, such consent may have been given in the first place, with the expectation that direct marketing would be sent regarding products that the customer was already actively using only (e.g. sports betting offers for sports bettors; free stakes for slot game players etc.) – this will no longer be the case.  

We query whether in fact, this change chips away at – rather than extends – the high bar of consent currently required by PECR.  

3. Conclusion

In this article, we have delved into the proposals in the DM Consultation regarding direct marketing and given you, the reader, our high-level observations on some of the issues that may arise if SRCP 5.1.12 is introduced in its current form, without amendment. This is, however, just the consultation phase and the Gambling Commission has released the proposed wording for SRCP 5.1.12 with the stated intention (whether or not honourable) of collating feedback from interested stakeholders before making a final decision on how to proceed.

In the short time before the consultation closes on 18 October 2023, we urge you to consider (and if possible, investigate) the impact that SRCP 5.1.12 would, as drafted, have on your business. If the industry is to positively influence the consultation process, it is imperative that it engages by submitting evidence-based and fully considered responses. The more voices that are heard, the more likely the Gambling Commission is to take into account feedback on its proposals and, if appropriate, adjust them to better reflect the recommendations made by the Government in the White Paper and hopefully, reduce the likelihood of unintended consequences.

The time has officially come to speak now – or forever hold your peace. Please get in touch with us if you would like assistance responding to any of the Gambling Commission or DCMS consultations.