Recent UK action to protect children from online gambling and gaming-related privacy issues

During the covid lockdowns, there was an explosion in growth of gaming and online gambling. The sector has long had to grapple with potential harms to children and vulnerable people associated with online gambling and gaming, and the issue has been a focus for a range of regulators. These include not only the Gambling Commission, but also the ICO, the Committee for Advertising Practice (CAP) and the Advertising Standards Authority (ASA), which have continued to take steps to ensure that children are not targeted with adverts encouraging them to gamble.

Changes to the CAP Code

Back in April 2022, CAP announced new rules applicable to gambling ads specifically targeted at enhancing safeguards for young people and vulnerable audiences. The rules came into effect from 1 October 2022, giving advertisers six months to prepare for the changes. The main change in the new rules was to require that gambling and lottery ads must not "be likely to be of strong appeal to children or young persons, especially by reflecting or being associated with youth culture." This is a step up from the previous rules which had a lower threshold in stating that ads must not be of "particular appeal" to children. In this context "children" are deemed to be those who are under 18, the legal age for gambling.

The rules set out some examples of the types of ads that would be considered to have a strong appeal with reference to under-18s, regardless of how the ad may be viewed or interpreted by adults. In particular, gambling ads cannot use:

topflight footballers and footballers with a considerable following among under-18s on social media
sportspeople popular with under-18s including those with a considerable volume of under-18 followers on social media
references to video game content and gameplay popular with under-18s
stars from reality shows popular with under-18s, such as Love Island.

There are limited exceptions to the application of the rule where the advertiser is able to demonstrate that appropriate steps have been taken to limit the potential for an advertisement to appeal strongly to under-18s, such that the rule would not prevent the advertising of gambling products associated with activities that are themselves of strong appeal to under-18s (for instance, certain sports or playing video games). This places the thorny issue of 'loot boxes' within video games outside the scope of the rules.

When the rules were introduced in October 2022 the ASA did publish further guidance on the applicability of the new rules, setting out some examples of what would be deemed:

High risk – eg anyone with direct connections to under-18s through their role like children’s TV presenters or film stars; anyone with a significant under-18 following on social media.
Moderate risk – eg retired footballers who have moved into punditry/commentary will be assessed on the basis of their social and other media profile; a small but notable following of under-18s on social media will be considered alongside the personality’s general profile and could contribute to an ASA decision to categorise the individual as being of ‘strong’ appeal.
Low risk – eg sportspeople involved in sports like cricket, tennis and rugby that don’t have a significant role in the sport or general profile; footballers at lesser Euro/world clubs.

These rules are largely aimed at reducing the promotion of gambling and lotteries via social media by those who have a large following on these platforms and particularly where the following may be comprised of a predominantly under-18 audience. This will be frustrating for a number of gambling companies that have tie-ups with Premier League clubs - at the beginning of the 2022/23 season, eight out of the 20 top-flight teams were sponsored by gambling companies. While the new rules will not affect those tie-ups, it does mean that the players and teams are unlikely to be able to promote the shirt sponsor in other ways.

Gambling Commission

In November 2022, the Gambling Commission published its own Young People and Gambling Report, which is an annual study to help improve understanding of children's and young people's exposure to, and involvement in, all types of gambling.

The headlines from the report are that while the data around regulated age-restricted products is encouraging, there is clearly a group which still struggles with gambling. The Gambling Commission has stated it is accelerating its drive to make gambling safer so we should expect to see more measures looking to reduce children gambling over the coming year.

It's worth noting that in tandem with the changes to the CAP code, the Gambling Commission also announced new rules requiring online gambling businesses to do more to identify and take action to protect consumers at risk from harm although these rules are not specifically aimed at protecting children. The new rules came into effect on 12 September 2022, requiring operators to:

monitor a minimum set of indicators to identify gambling harm – these include customer spend, patterns of spend, time spent gambling, gambling behaviour indicators, customer-led contact, use of gambling management tools, and account indicators
flag indicators of harm and take timely action
implement automated processes for strong indicators of harm
prevent marketing and the take-up of new bonuses for strong indicators of harm
evaluate whether operator interactions with consumers are appropriate relative to harm levels
not only comply at all times but ensure third-party providers comply.

ASA Remit over marketing communications

Separately, in June 2022, the ASA published a statement to clarify its remit and scope when it comes to regulating gambling operator communications in social media content marketing. The statement reiterates that the ASA and Gambling Commission have a mutual understanding that all social media content published by licensed gambling operators must comply with the CAP code, particularly to ensure the protection of under-18s and vulnerable groups from harms associated with gambling marketing.

The ASA and Gambling Commission are focusing on reviewing and monitoring how gambling operators market their products and services on social media. In particular, the statement highlights how sports betting operators are using popular social media accounts on platforms such as Twitter to drive engagement with their followers. This means it can be a challenge to identify what is editorial-style content eg commentary or opinion pieces (outside the ASA's remit) and what can reasonably be classified as 'advertising'. The lines are being blurred by so-called 'content marketing' which doesn’t necessarily have a direct call-to-action or product reference but can still serve to promote the operator. The ASA is taking the approach that this content marketing is deemed to be selling something (despite the lack of clear calls to action, links or product references) and therefore falls within its remit and is regulated by the CAP Code.

The challenge comes in taking a consistent approach and some social media content will fall outside the ASA's enforcement remit where it cannot reasonably be considered to be directly connected with the supply of a gambling product. To try and draw some clear lines the ASA and Gambling Commission have agreed that:

the ASA will continue to consider complaints about social media ads brought to its attention on a case-by-case basis in line with its existing approach to remit decisions
in the limited scenarios where complaints about operators’ social media are deemed not to be within remit, the ASA will refer them to the Gambling Commission
the Gambling Commission will consider provisions under its Licence Conditions and Codes of Practice (LCCP), which set out the rules for operators licensed to transact with consumers in Great Britain, and will consider taking action in line with its Statement of Licensing, Compliance and Enforcement policy.

ICO guidance to games developers on compliance with the Children's Code

In February 2023, the ICO published top tips for games designers on how to comply with the Children's Code. The ICO's Children's Code is a set of 15 enforceable standards which online services need to follow to protect the privacy and personal data of children likely to access the service. Online games are explicitly covered by the Code. The ICO's recommendations include:

Conduct risk assessments – the ICO says a defined process is helpful to identify and minimise data protection risks to children in games. This should include consulting with external stakeholders including children, and possibly completing a Children's Rights Impact Assessment; assessing and documenting the game's appeal to children at the design stage and with legacy products to inform whether and what age verification measures are needed or whether elements need to be tailored to children; regularly reviewing assessments after a game goes live and adjusting if necessary eg if unexpected age groups are playing; and ensuring randomised rewards are assessed against the Children's Code and the government's response to its consultation on loot boxes.
Know your players' ages – assess and document how you will identify players under 18 and work out their actual ages with an appropriate level of certainty; investigate potential age assurance solutions to be implemented across all products as quickly as possible once identified; and implement measures to discourage or prevent players giving fake ages.
Be transparent – this could be done by eg running user research trials on child friendly privacy information with different age groups; or designing age-appropriate different ways to communicate privacy information according to age group.
Prevent detrimental use of children's data – ensure all optional uses of personal data are off by default and only activated after valid consent from the player (or parent/guardian where the player is under 13); introduce checkpoints or natural breaks in game play into game design, together with messaging to encourage players to take breaks; and implement measures to control or monitor product placement, advertising or sponsorship arrangements within community servers where children can access them from within the game.
Set high privacy settings and parental controls – this could be by providing parents with real time alerts about their children's activities both in-game and in terms of their privacy settings; ensure players are given age-appropriate explanations if they try and change their settings; assess whether it is possible to introduce variable settings to allow children to control what personal data is visible to others; have high privacy settings by default including by having voice chat settings off by default, providing a 'do not disturb' permanent and session setting, allow settings for friend requests to include 'no one'; and introduce a setting to allow only other children to communicate, as well as other options for age assurance to help identify adults trying to communicate with children in the chat function.
Use profiling responsibly – children must be given control over both whether and how their personal data is used, especially where profiling is not essential to game play. This should include checking any third party advertising provider is displaying age-appropriate in-game content; providing age-appropriate information in-game at the point profiling takes place, encouraging children to ask a trusted adult and only activate profiling if they understand what it is; and separate the opt-in consent for marketing from the acceptance of terms and conditions and the privacy policy when players create a new account – profiling for marketing purposes should be off by default for children.
Do not use nudge techniques to lead children to make poor privacy decisions – assess and document the risk of introducing time-limited or one time only offers on items targeted at children; implement positive nudge techniques to promote the best interests of the children; review how competitions and partnerships are communicated, including by being mindful of encouraging children to create media accounts in order to take part in competitions; monitor player behaviour and click-throughs to identify any unintentional nudge points; and use a neutral purchase button design and support workflows to allow a decision not to proceed with a purchase.

Enforcement is coming

It's positive to see the ASA and Gambling Commission continuing to take steps to reduce problem gambling, particularly among children and the vulnerable, and helpful that the ICO has published guidance on compliance with the Children's Code particularly aimed at the sector.

A key message is that both the ASA and Gambling Commission are going to be looking very closely at the approach taken by gambling operators on social media. It's likely that 2023 will see some significant enforcement decisions taken against gambling operators which are unable to keep pace with the regulatory changes and expansion of the ASA's remit. Alongside that, the ICO will also be focusing on issues including the use of nudge techniques when looking at games developers' compliance with the Children's Code. It's clear that across the wider regulatory ecosystem for games and online gambling, the focus is on protecting children and this is only likely to increase when the Online Safety Bill becomes law.