Florida races toward mobile sports betting, but where are data privacy safeguards?

While sports betting is “not going to produce a huge revenue stream” for the Seminole Tribe, it will allow the Tribe to get into the online gambling market and build a database of younger players which it can use to target for its other products.
The Florida Legislature is contemplating more than a dozen bills that would ultimately allow some forms of betting from mobile devices.
The Florida Legislature is contemplating more than a dozen bills that would ultimately allow some forms of betting from mobile devices. [ MANU FERNANDEZ | AP ]
Published May 18, 2021|Updated May 18, 2021

TALLAHASSEE — As the Florida Legislature convened this week for a special session to legalize mobile sports betting in Florida, one issue essential to the growth of the industry has been left out of drafts of the 18 bills filed in the House and Senate: How the gambling industry harvests and handles consumers’ data.

It’s not a new issue.

Legislators spent much of the regular session on a proposal that would have imposed new disclosure requirements on companies that collect information from anyone who downloads an app or uses a website. The bill was vigorously opposed by some of the state’s largest industries, and it died on the last day of session.

Now, data harvesting is an essential component to operating the central provision of a gambling compact between the Seminole Tribe and the state. Under legislation that moved quickly through House and Senate committees on Monday, the Seminole Tribe would be given a monopoly to operate mobile sports betting in Florida, with all bets placed from mobile apps across the state going through a server on its tribal land.

Legalized sports betting has exploded in the U.S. since the U.S. Supreme Court’s 2018 decision striking down the federal Professional and Amateur Sports Protection Act in Murphy v. NCAA, and sports books are now legal in nearly two dozen states.

Bettors are routinely required to provide extensive information, including date of birth, Social Security number, physical and email addresses and other personal identifying data. They are also asked to create accounts with banking information.

When a bettor downloads a mobile app, their location can be tracked and, using information from third-party vendors such as credit reporting companies, the gambling operator can learn how much the player can afford to lose and bet.

While sports betting is “not going to produce a huge revenue stream” for the Seminole Tribe, it will allow the Tribe to get into the online gambling market and build a database of younger players which it can use to target for its other products, including its casinos, hotels, restaurants and entertainment venues, said Michael Pollock, manager director of Spectrum Gaming Group, a gambling consultant.

“The key benefit of it is it allows those who have the database to know the players and be able to market to them and encourage them to spend at other cash registers — gaming and non-gaming,’' Pollock said. “The economics of it will drive them to move casino games to mobile platforms because the convenience of playing on a mobile platform is just easier.”

Where are data privacy concerns?

Although legislators have drafted several bills focused on various aspects of the state’s gambling regulations, none of them include any language relating to data privacy, and the compact leaves it up to the Tribe to set its own rules.

“We obviously have a worldwide database in 76 countries around the world. Those protections are built in to our existing database, and we would offer those same protections to any new person that is involved in our online sports betting business if the House and Senate approve,’' said Jim Allen, CEO of Seminole Gaming on Monday.

Get insights into Florida politics

Get insights into Florida politics

Subscribe to our free Buzz newsletter

We’ll send you a rundown on local, state and national politics coverage every Thursday.

You’re all signed up!

Want more of our free, weekly newsletters in your inbox? Let’s get started.

Explore all your options

For example, the Tribe currently allows frequent bettors who join their “loyalty” program for their casino games to opt-in to having their financial information available to the Tribe, said Jeff Hook, executive vice president of development and marketing for Seminole Gaming.

Critics of the industry say the invasive tracking and profiling techniques can be used to keep players hooked. They warn that the data collected by the Seminole Tribe will open the door to it returning to negotiate a compact that allows for full online casino games.

“The endgame is here is to use any sports gambling to identify your preferences, your propensity to gamble, your wager, the kinds of things you’re interested in, track you all over the Internet, and then turn around and market to you online gambling, which is where the real profits come in,” said Les Bernal, national director of Stop Predatory Gambling.

“The goal is to create a database of young men, and some women, but especially young men under the age of 40 — or anybody prone to show a propensity to gamble online,’' he said.

Players who get started betting on NFL games will be targeted for marketing pitches “to keep them betting 365 days a year” until they can get casino slots, online roulette and other types of games, Bernal said. “Essentially it’s trying to bring the slot machine model to sports gambling.”

Data harvesting

While there are federal protections in place to protect consumer financial data, there are few safeguards preventing the harvesting of data, according to a summary by Kathryn R.L. Rand and Steven Andrew Light, law and political science professors, respectively, at the University of North Dakota.

In New Jersey, which authorizes online sports books, the DraftKings app requires a user to confirm their age and location within the state, and for a player to receive their winnings, they can only withdraw funds via a physical check or by getting cash at the cashiers’ cage at Resorts Atlantic City.

“In addition to data that a bettor may provide directly, online and mobile applications may collect additional data about bettors automatically through various tracking technologies,’' wrote Rand and Light in the American Bar Association journal. “As online and mobile applications develop, operators may want to collect data regarding the behavior, habits, and preferences of their customers.”

In England, where sports betting has been legal for two decades, the explosive growth of online gambling has forced the country to reckon with its data privacy laws as well as how the gambling platforms market to users.

‘The U.S. is about 10 years behind the U.K.,” said Matt Zarb-Cousin, founder and director of Clean up Gambling, a campaign that successfully advocated for gambling reforms in Britain.

“They email people offering them inducements and bonuses and push notifications and once they’ve identified the people that they consider to be profitable to them, i.e. the people that are likely to be losing more than they can afford and experiencing gaming related harm, they will target those people,’' Zarb-Cousin said.

Proposals before the British Parliament would put the responsibility on the gambling platforms to use the data they collect on customers to determine if they can sustain the losses they incur by doing so-called “affordability checks.”

Seminole Tribe is legally out of reach

Both the House and Senate have drafted language creating a new Gaming Control Commission that would have regulatory authority over pari-mutuel operators but not the Seminole Tribe, which is a sovereign entity not subject to state law unless it is negotiated into the compact.

“I’m not gonna sit there and micromanage any compact,’' said Sen. Travis Hutson, a St. Augustine Republican and sponsor of the Senate gambling bills.

Although other states have negotiated consumer protections in compacts with other tribes, Hutson said if problems occur with customer data, it will be up to the federal Department of Interior to intervene.

Sen. Jennifer Bradley, R-Fleming Island, who sponsored the failed legislation to allow people to opt-out of having their personal financial data retained and used to market to them said she wants to see a comprehensive approach to data privacy protections in Florida. However, she said that revising the gambling legislation that has already been negotiated isn’t the place to do it.

“Gaming is just yet another arena where you can see the real potential pitfalls and dangers with companies,’' she said. “If there aren’t guardrails you have folks being targeted and profiled for vulnerabilities, and I think it’s beyond time. We should have done this five years ago, and the longer we go, the harder it is to to unring this bell.”

Both the House and Senate propose giving the new Gaming Control Commission limited oversight over the Tribe, saying the commission would be able to “review the rules and regulations promulgated by the Seminole Tribal Gaming Commission for the operation of sports betting.”

The commission can propose “any additional consumer protection measures.” But there is nothing in the proposed legislation that makes the commission’s recommendations binding.

The compact says that advertising and marketing of the games at the tribal facilities contain “responsible gambling message and a toll-free help-line number for problem gamblers.” The advertising and marketing also are prohibited from making “false or misleading claims.”

By contrast, the New Jersey Division of Gaming Enforcement requires sensitive personal information harvested from legalized sports betting platforms to be encrypted. The proposals before Florida legislators include none of those protections.

When it comes to identifying problem gamblers, the protections in the compact are voluntary.

“Patrons who believe they may be gambling on a compulsive basis may request that their names be placed on the list of patrons voluntarily excluded from the Seminole Tribe’s facilities and from participating in the Seminole Tribe’s online sports betting,’' the Senate summary states.

(EDITOR’S NOTE: This story has been updated to remove the name of the British gaming platform, which says it is not responsible for data harvesting of consumer information but instead said the information came from third parties.)

• • •

Tampa Bay Times Florida Legislature coverage

Get updates via text message: ConText, our free text messaging service about politics news, brings you the latest from this year's Florida legislative session.

Sign up for our newsletter: Get Capitol Buzz, a special bonus edition of The Buzz with Steve Contorno, each Saturday while the Legislature is meeting.

We’re working hard to bring you the latest news from the state’s legislative session. This effort takes a lot of resources to gather and update. If you haven’t already subscribed, please consider buying a print or digital subscription.