What do Gambling companies know about you?
Our Mission
Clean Up Gambling has been at the forefront of exposing how online gambling companies use data to profile users. Our work culminated in a report with Cracked Labs, which ultimately led to the Information Commissioner’s Office taking regulatory action against Sky Betting and Gaming’s parent company.
We have produced this toolkit to help you to access your data held by online gambling companies. Our work shows that online gambling companies usually work with multiple other companies to track your gambling and browsing, and analyze that activity to target their marketing at you.
The process
The involvement of third-party service providers – who you are unlikely to have heard of or have a direct relationship with – means that a multistep process is required:
Step 1:
First, you will use EMAIL TEMPLATE A to ask the online gambling companies
whose services you have used:
What data they have on you;which service providers they’ve worked with to track and analyze you (the ‘recipients’ of your data). The ‘identifiers’ they’ve used to work with those recipients. That is, the pseudonym(s) or codes for you, which they have used to exchange information about you with other companies.
FORM A
Data subject access request
To:
Dear [Insert Data Protection Contact for your OGC],
I am writing to make a subject access request under Article 15 UK GDPR. Please provide:
- Copies of all my personal data undergoing processing by you;
- Confirmation of the purposes of your processing of my personal data;
- The identities of (and contact details for) any natural or legal persons with whom you have shared my personal data ("recipients");
- A list of any/all pseudonymous identifiers related to me which you have used to share my personal data with recipients or receive personal data about me from other parties.
In relation to (iii), without limiting the generality of my request, I am particularly interested in any recipients concerned in tracking online behavior, profiling customers for marketing purposes, and delivering marketing to customers. I request the identities of all specific recipients rather than categories of recipient, pursuant to the decision in Harrison v Cameron [2024] EWHC 1377 (KB).
Article 12(3) UK GDPR requires this information to be provided to me "without undue delay and in any event within one month of receipt of the request."
My personal details are as follows:
Now we wait for a response (proactively check your email ,once email is received move to step 2)
Step 2:
Now that you know where your data has been shared,
you can use
EMAIL TEMPLATE B to:
Get a full picture of how you have been tracked by the OGCs’ network of service providers. This will involve making requests to all of the recipients you found out about in Step 1.
It’s crucial to know your identifiers for Step 2, because the recipients may not have your name or email address on file. By providing and quoting the identifiers – the codes that they have used to exchange information about you – you will enable the third parties to find you in their systems and stop their marketing-related processing of your data.
In addition, you can use EMAIL TEMPLATES C and D to object to the processing of your data for direct marketing purposes. That is, to request these companies to cease profiling of you for marketing. You’ll ask both (i) the online gambling company (TEMPLATE C) and (ii) their service providers (TEMPLATE D) to stop using your data to target gambling marketing to you.
This multi-step approach requires some patience: you need to wait for the online gambling company to respond at Step 1. But this is the best way to access all your data and to ensure your data is no longer used for gambling marketing.
FORM B
Subject access and objection request
FORM C
Objection and erasure request
To:
Dear [Insert Data Protection Contact for your OGC],
Following your response to my subject access request, I understand that you are processing my personal data in part for the purposes of direct marketing. I am writing to object to that processing under Article 21(2) UK GDPR. I also request erasure of my personal data processed for direct marketing purposes under Article 17(1)(c) UK GDPR.
Please confirm by return that:
- You will no longer process my personal data for direct marketing purposes;
- You have complied with my erasure request;
- You have informed any recipients of my personal data of my erasure request pursuant to Article 17(2) UK GDPR.
My personal details are as follows:
FORM D
Objection and erasure request
To:
Dear [Insert Data Protection Contact for the third party],
I am writing to object to the processing of my personal data for direct marketing purposes under Article 21(2) UK GDPR. Please confirm by return that you will no longer process my personal data for direct marketing purposes.
My personal details are as follows:
Give Me My Data
Your Data Your Rights
Copyright © 2025 Give Me My Data