Regulator investigation legality of “iesnare” sportsbetting software

In the United Kingdom, the Information Commissioner’s Office electronic data protection regulator has reportedly launched an investigation into whether local online sports betting sites are breaking the law by surreptitiously installing software on users’ accounts that can track their betting histories.

According to a report from the British Broadcasting Corporation (BBC), the software known as “iesnare,” which was developed by Oregon firm Iovation Incorporated, automatically uploads itself onto punters’ accounts when they login or visit an operator’s homepage and allows firms to track previous wagers and even close an account.

Brian Chappell from the campaign group Justice For Punters has reportedly had accounts with online bookmakers closed after placing winning bets and recently told the broadcaster’s You And Yours radio program that he had found the “iesnare” software on his computer after visiting SkyBet.com, which is an enterprise of Leeds-based Sky Betting And Gaming.

“I actually cleaned my hard drive on my laptop and I intentionally went on the SkyBet.com website before I went on any other Internet site and within two seconds, “iesnare”, [which is] now called “iovation”, they keep changing the name, and there it was,” said Chappell.

Online sports betting firms have reportedly protested their innocence by explaining that they only use programs such as “iesnare” to collect basic information such as IP addresses so as to identify the devices being used to place a wager.

“Like many other operators, we use “iesnare” to tackle fraudulent activity,” read a statement to the BBC from SkyBet.com. “We notify customers we use “iesnare” in a banner at the top of our website and in our privacy policy.”

However, Chappell reportedly told the BBC that an IP address can be used to distinguish the individual placing a wager and subsequently lodged a complaint with the Information Commissioner’s Office.

“If you open an account with a company and they restrict your account, another thing you might like to try is that you open another account with them using another name,” Chappell told the BBC. “Because it’s the same IP address you’re using, it will identify you as a person who’s had an account closed down.”

A complaint was moreover lodged by bettor Peter Phillipson after he reportedly found “iesnare” running in the background of his computer but became unable to login to his account with Totesport.com, which is owned by Warrington-based firm BetFred, after disabling the program.

“[Information Commissioner’s Office] told me they don’t believe that the argument that Totesport.com use, that it’s identifying a computer only and nothing personal, is valid,” Phillipson, who writes a horseracing blog, told the BBC. “[The Information Commissioner’s Office] say the IP data being processed here constitutes personal data under the Data Protection Act.

The BBC reported that the use of such software could be hurting the industry after a 2016 member study from the Horseracing Bettors Forum, which was established with the assistance of the British Horseracing Authority, found that 878 respondents had detailed some 1,000 account closure incidents during the previous six months. The investigation allegedly moreover described around 4,000 restricted account events while 59% of those affected stated that their interest in horseracing had fallen as a result.

“Totesport.com uses this product for fraud prevention, authentication and customer protection purposes by checking whether devices have been identified with fraudulent transactions in the past such as reported instances of identity theft, account takeovers or malware attacks,” read a statement to the BBC from Totesport.com. “It does not collect any client information. However, we are constantly reviewing our procedures and working with the Information Commissioner’s Office.”

For its part, Portland-based Iovation Incorporated told the BBC that it has “no access to information such as the winning and losing history of players” or “specific betting details” and that it was up to individual gambling operators to comply with local data regulations.

“Every service contract signed by an Iovation [Incorporated] customer requires that the customer comply with respective data privacy laws, which includes the appropriate consent and notice provisions,” read a statement to the BBC from Iovation Incorporated.