Sportsbook operators in Massachusetts have some serious concerns about a state data privacy regulation they call invasive and difficult to comply with.
The part of the regulation that bothers them most requires operators to receive consent from a customer whenever the sportsbook seeks to share personal data with a third-party vendor unrelated directly with the app or casino.
Hotels or other vendors part of a sportsbook’s rewards program appear to come under third-party vendor status, operators said.
Seems that such an opt-in is not present anywhere else in the country, so operators have no infrastructure for implementation. It could take years to comply.
“Two to three years is not uncommon for implementation of these types of data privacy regimes,” FanDuel official Cory Fox said at a roundtable discussion on the issue. “These are really hard and it’s rearchitecting how a lot of our backend systems work.”
DraftKings, BetMGM, Caesars, WynnBet, Fanatics, Penn Interactive, and Betr were also involved in the September 19 roundtable.
Massachusetts Gaming Commission (MGC) legal counsel Caitlin Monahan said compliance with the reg is not until November 17, and the roundtable information may result in changes.
The Massachusetts Attorney General’s Office supports the provision as is:
“(2) If a Sports Wagering Operator seeks to use a patron’s Confidential Information or Personally Identifiable Information for purposes beyond those specified in 205 CMR 257.02(1), a Sports Wagering Operator shall obtain the patron’s consent, which may be withdrawn at any time. (a)Such consent must be clear, conspicuous, and received apart from any other agreement or approval of the patron. Acceptance of general or broad terms of use or similar documents that purport to permit the sharing of Confidential Information or Personally Identifiable Information in the same document shall not constitute adequate consent, nor shall hovering over, muting, pausing, pre-selecting, or closing a given piece of content without affirmative indication of consent.”
Jared Rinehimer, division chief of data privacy and security in the AG’s office acknowledged to the commission during the roundtable that implementation will “take some time.”
“I am certain there are going to be tech challenges in implementing parts of this regulation and I think that’s totally understandable,” Rinehimer told the commission. “The principle behind (consent) is what I would say is a common sense one. If you want to use someone’s information, you ask them first. That seems like a reasonable approach.”
Sports betting operators speaking before the commission said they intend to meet whatever regulation is placed before them. But some operators, including DraftKings, said they see the opt-in requirement as more harmful than helpful to Massachusetts sports betting.
DraftKings official David Prestwood told Gaming Today this is “in many cases more invasive in part because it’s not an extension of any existing legal framework in the U.S. We do use third-party vendors for a lot of these things that patrons would opt into. They keep that data tight (and) have to follow the same data security concerns. It’s just in the privacy realm, in order to follow up on opted-in use, we would have to share that data with third parties, and under this regulation, we can’t do that.”
BetMGM Associate General Counsel for Privacy and Product Alexis Cocco said during the roundtable that how operators’ questions are ultimately answered will determine project timelines impacting the sportsbook’s customers.
“This is not a blanket request for this data privacy reg to go away,” Cocco told the commission. “A lot of us are already meeting these requirements including opt-out requests and data deletion requests. We are already protecting all of our patrons. We need clarity from the Commission to provide guidance to technical teams to determine how to comply with the deviations from existing laws.”
Prestwood said it seems the regulatory guardrails apply only to the sports betting industry.
Monahan said additional meetings will probably be scheduled to address various other concerns.
Commissioner Eileen O’Brien said at the close of the roundtable that the regulation is “a work in progress” that can be tailored more depending on need. “It may be that this regulation is going to have to come back in front of us for more tweaks.”
