No more bets, please - excluding vulnerable customers from marketing.

07 June 2022

“No more bets, please,” the croupier announces, as the pill begins to roll around the roulette wheel.

For the customers, the game of chance begins.

For the operators, marketing to those customers is also a game of chance.

Casinos, lotteries and online gaming operators are betting on a mass marketing approach to find the customers who will deposit and play again.

There’s a chance they might target the right customer at the right time, but there is also a chance they will target a vulnerable customer at the wrong time.

Taking that chance can be costly – creating potentially damaging outcomes for operators and customers.

In February 2020 over 100 gambling experts attended the Gambling Commission event in Birmingham to make progress on creating a single industry-wide solution to help reduce gambling harm, in particular where customers have multiple online accounts.

The initiative was supported by the Betting and Gaming Council (BGC) and representatives from the Information Commissioners Office attended, with the aim of raising awareness of individual rights and to discuss issues around privacy.

Neil McArthur, Chief Executive of the Gambling Commission at the time said:

“We recognise that keeping a customer safe where operators currently only have a partial view of a customer’s behaviour is a challenge. That is why we are bringing together experts from outside and within the gambling industry to explore how technology could create a single customer view, as it has the potential to significantly improve customer protection.

“I’m really looking forward to seeing what is possible. We are constantly looking for opportunities to reduce gambling-related harm and there is always more to be done.

“Using technology to facilitate a single view of consumer activity is one of a range of actions we are pursuing to make gambling safer.”

A particular area of focus for The Gambling Commission is to make progress in raising standards and reducing harm through the use of advertising technology.

When sharing personal data there are always concerns about the impact that the processing could have on the individual. The purposes for processing the data should always result in a better outcome for the customer.

Processing personal data for marketing and not taking the step to identify some of those customers who are currently vulnerable never results in a better outcome.  It results in avoidable harm to individuals.

BGC were accepted into the Regulatory Sandbox, a service developed by the Information Commissioner’s Office (ICO), to support organisations who are creating products and services which utilise personal data in innovative and safe ways to create better outcomes for customers.

The aim of the SCV Sandbox was to establish an appropriate lawful basis under GDPR that allows for the sharing of data between online gambling operators via a single customer view.

It is the ICO’s view that both ‘Public Task’ and ‘Legitimate Interests’ are lawful bases which would allow such processing.

In February 2022, the Betting and Gaming Council announced that GAMSTOP would be running the ‘Single Customer View’ trial to share data on those most at risk of gambling harm.

On 9 March 2022, The Gambling Commission fined a large operator £1.17m for marketing to vulnerable consumers.

On 2 November 2021, the operator distributed a promotional offer of “Bet £5 get 100 free spins” to 41,395 self-excluded customers and 249,159 customers who had unsubscribed from the operator’s marketing emails.

These actions breached licence conditions aimed at ensuring gambling in Britain is socially responsible.

Andrew Rhodes, the current Chief Executive of the Gambling Commission, said:

“Self-excluded customers are likely to be suffering gambling harm and should absolutely not be sent direct marketing that could tempt them back into gambling.

“We would advise all operators to learn from the costly errors and ensure their systems are robust enough to always prevent the self-excluded, and those who have clearly rejected marketing, from receiving promotional material.”

More recently, on 21 March 2022, during a House of Commons debate Chris Philp, often referred to as the ‘Gambling Minister’ said:

“The nature of the online games, the fact that people can access them 24/7, the fact that frequency of play is very high, and the look and feel of some of the features make them significantly more risky than other forms of gambling, such as gambling in person at a racecourse, playing bingo or playing the National Lottery. All those things can be addictive, but the online games have a much higher risk”

“One area where we can go is using data. I mentioned that online gambling is one of the areas that carry higher risk, unlike betting at a racecourse, for example, which carries a risk, but a significantly lower one. Data should and will enable the Gambling Commission to do a much better job at identifying what the operators are really doing.”

What should gambling operators take away from this?

Available Data.

Self-Exclusion Data

Self-exclusion is a tool used by consumers who feel they are having trouble controlling their gambling and request that the operator refuse their service. The Gambling Commission insists that all operators offer this facility.

Single Customer View Data

This cross-operator view of a customer’s gambling activities could help identify and prevent potential gambling harms in those who hold accounts with more than one gambling company. Online gamblers hold an average of three accounts, with a significant proportion of younger gamblers holding more. Evidence also indicates an increased risk of harm among those customers who take part in multiple gambling activities.

Third-Party Vulnerable Consumer Data

The only information operators have about current or lapsed players is the information they currently hold. The data shows how they have interacted with the operator but does not consider any outside influences or factors that indicate the consumer could be at risk of harm. Using third-party data enables operators to identify consumers at risk of harm from other factors. Using third-party data allows operators to proactively exclude customers with characteristics of vulnerability from marketing.

Identifying vulnerable customers using third-party consumer data.

ID.VU is a third-party database of 2.7m individual high-cost, short-term loan applications which are mapped back to the FCA’s Characteristics of vulnerability to highlight individual consumers who are financially vulnerable.

Considering the comments from Andrew Rhodes relating to the £1.17m fine, the ID.VU flags should be utilised by operators to restrict direct marketing to those vulnerable customers most at risk of suffering gambling harm.

The advice from the Chief Executive of the Gambling Commission is that all operators should consider how they can prevent vulnerable customers from receiving promotional material.

Although the individuals in ID.VU have not self-excluded from gambling, operators can still legitimately use the Data On Demand solution to proactively exclude vulnerable customers from direct marketing that could tempt them back into gambling when they cannot afford to.

Many people do not consider themselves vulnerable – no matter what characteristics they have or how difficult their circumstances, and they will not want the label ‘vulnerable’ applied to them.

People also may become more or less vulnerable, and so have an increased or reduced risk of harm throughout their lives.

Using ID.VU to identify vulnerable customers when they are most in need of help is about making an ethical decision and considering social responsibility when it comes to including this type of customer in marketing campaigns.

These customers are more at risk of harm, even if they would not like to admit they are struggling financially and excluding them from marketing can only achieve better outcomes for customers and operators.

ID.VU categorises individuals as

The Vulnerability Registration Service (VRS) gives vulnerable people a single place to register their status, helping them avoid repeating the same difficult conversations every time they engage with organisations like lenders and creditors. It is a “Not for Profit Company Limited by Guarantee” whose aim is to help vulnerable consumers protect themselves against the financial, social and very personal hardship suffered as a result of debt and financial problems.

Data On Demand and The Vulnerability Registration Service.

Data On Demand and the Vulnerability Registration Service are in partnership and have aggregated the ID.VU database and the VRS database – making the combined data available to any organisation to be consumed via Batch or real-time API interfaces.

This collaboration has created the most powerful tool for any operator to implement vulnerability indicators to exclude customers from marketing.

The ID.VU database including the VRS data has identified over 3.1m UK consumers at risk of harm since June 2020.

Continuing to assess customer affordability.

In addition to identifying vulnerability, ID.VU allows operators to run affordability checks throughout the customer lifetime to ensure they remain compliant and to exclude any customers from promotional activity who would not pass an affordability check today.

Customers can clearly not afford to gamble when they are applying for high-cost credit to cover bills or loss of earnings, for example, and promoting gambling to them would be unethical.

ID.VU identifies individuals who are struggling financially and need high-cost credit to cover everyday expenses.

The numbers below show how many people were affected in the last 31 days.

Vulnerability is rarely static, and a customer may have passed an affordability check when they first opened an account but changing circumstances could now mean they are unable to afford to gamble.

ID.VU uses data to improve customer protection and reduce further harm by identifying financially vulnerable customers to enable operators to exclude them from marketing,

Benefits to gambling operators of using ID.VU to exclude vulnerable customers from marketing.

Regulation & Compliance Demonstrate to regulator you are being proactive in excluding vulnerable customers from the temptation to gamble when they cannot afford to.
Regulation & Compliance Avoid fines if you are found to be actively promoting gambling to vulnerable customers.
Regulation & Compliance Monitor affordability throughout the lifetime of the customer and exclude customers from promotional activity who can no longer afford to gamble.
Social Responsibility Adhere to the Gambling Commission’s social responsibility codes.
Technology & Innovation Integrate new data sources to use as exclusions to create better outcomes for your customers.
Marketing Performance Increase conversions rates and reduce costs – customers with no disposable income are unlikely to bet. You will improve the performance of your marketing campaigns by removing vulnerable customers from your target lists.
Affiliates or Third Parties Provide access to the Data On Demand API to allow affiliates to remove vulnerable customers by matching known email addresses and mobile phone numbers.


Get in touch with us today to find out more about how we can help you identify and protect your most vulnerable customers.


Contact Stuart Murgatroyd (


Simon Gregory (


SCV Sandbox

The aim of the SCV Sandbox was to a) establish whether there is an appropriate lawful basis under Article 6 of the UK General Data Protection Regulation (‘UK GDPR’) that allows for the sharing of behavioural data between online gambling operators via a SCV, including the examination of existing legal gateways, and b) consider the processing of special category personal data and the appropriateness of Article 9 conditions for processing under the UK GDPR.

After completion of the first phase, it was the ICO’s view that:

The sharing of behavioural data between gambling operators in order to identify individuals who may be ‘at-risk’ of gambling related harms via a SCV may be lawful under Article 6 (1)(e) ‘Public Task’ or Article 6 (1)(f) ‘Legitimate Interests’ of the UK GDPR:

  • ‘Public task’ requires there to be a basis in law, for the gambling operators to share the data for the SCV, and for that sharing to be carried out in the public interest. This does not require there to be a legal obligation, but there must be a domestic law from which this processing originates. While it is satisfied that this condition may apply, a further analysis of the specific circumstances will be needed (once the SCV has been further developed) to ensure the sharing is necessary and proportionate to meet those aims.
  • ‘Legitimate Interests’ encompasses the interests of a number of parties including those individuals at risk of problem gambling, the interests of gambling operators in meeting their legal requirements and those of society at large. These must be balanced against the interests and fundamental rights and freedoms of all the data subjects whose data may be shared. Again, it is satisfied that this condition may apply, but as the SCV is developed, a further analysis will be needed to consider how this condition applies in the specific circumstances.


Discover what Data On Demand can do for your business

Learn about how our products could benefit you.
Get in touch and find out about our solutions for Marketing, Verification and Trace.