At 1.17pm on 15 August 2018, Sam* logged in to his online betting account and gambled five days’ worth of wages. Already deep in debt – having taken out 13 loans over three years, and with his marriage under strain – he had been desperate to quit.

But Sky Betting & Gaming, operator of Sky Bet, Casino, and Vegas, had other ideas. Having labelled him a “high value” customer, and not realising he was at risk, it had sent him an email promising a £100 bonus if he spent £400 on a casino game. “Well done on making it past level 2. Can you make it even further this week?” it said. Soon after receiving it, Sam deposited £400.

At first glance, the promotion looked like any old junk email. Instead, it was the product of a sophisticated targeted marketing campaign based on hundreds of thousands of pieces of data used to profile him, predict his behaviour – and serve him personalised ads.

Over two years, when his gambling problem was at its height, the Sky Bet group emailed him multiple times a day, with staggering success. Internal records suggest that of the 1,389 emails it sent him offering free spins and bonus prizes, Sam engaged with 98% of them. “I wasn’t able to ignore them. They had this grip on me,” he said.

In a landmark legal ruling that could have wide-ranging ramifications for the gambling industry, the high court has now ruled the targeting unlawful. While Sam may not have explicitly opted out, he had been gambling compulsively, and was in no state to consent to the use of his data for profiling and targeted marketing, the judge said.

Mrs Justice Collins Rice said Sam had “wanted” to be sent promotional offers, even “craved” them, desperate to clinch the “big win that would turn his life around”. But his life was falling apart: he had lied to his wife, contemplated suicide and was facing “financial armageddon”. He “was not making decisions … on a fully autonomous basis at all”.

Sky Betting & Gaming says it “fundamentally disagrees” with the judgment and is considering an appeal. “Protecting our customers is the number one priority,” it said.

Now, as the wider gambling industry faces mounting scrutiny – and amid calls for regulators to intervene – the Observer can reveal the inner workings of the Sky Bet group’s “black box”: how it and its partners gathered 2,400 spreadsheets of data about a vulnerable customer, from his disordered spending habits to the exact times he played specific games, and used it to predict his behaviour and create marketing that was “hard to resist”.

Despite all the information they had access to about Sam – from location and deprivation data to the fact he’d closed and reopened his account – the company failed to identify him as someone in need of help. Instead, he was coded as a “high value customer” – a prime target for more marketing. And when he did eventually stop gambling, the software labelled him as someone to “win back”.

Sam, who is sharing his story on the condition of anonymity, was 21 when he gambled for the first time. It was April 2009 and he’d seen a newspaper ad offering a free football bet. “More or less straight away” he was hooked. He quickly graduated from £10 and £20 football bets to spending hundreds, then thousands, on racing, slot machines and online casinos. Soon he was losing “long, unbroken hours” gambling online – splashing money he had saved for a house deposit, including £11,000 in a single day.

Several times, he tried to quit. In 2011, he agreed to hand control of his money to his mother. But when he got his bank accounts back his gambling resumed, ramping up with Sky Bet in August 2012. He hid it from his wife, logging on while she slept, and begged from friends and family. He also used daily spending caps, tried to shut his account, and self-excluded from two other gambling platforms, temporarily preventing him from using them.

It didn’t work: by early 2017, he was regularly using 40 platforms. “It was a crazy time. I couldn’t concentrate. It was a haze. All I wanted to do was gamble,” he said. In 2018, he again placed a spending limit on his Sky Bet account – the platform he liked most.

But he felt powerless to properly benefit from the controls, raising the limit from £100 per day to £250 and eventually £1,000. By the end of that year, he felt he was facing “financial armageddon”, averaging monthly losses of £1,793, and found himself contemplating suicide.

As he hurtled towards rock bottom, something clicked. He realised that the only way he could turn his life around was if he quit gambling for good. On 30 December 2018, he placed his last casino bet. Since then, he has managed to stay clean – one of the roughly one in three people to recover from a gambling problem without treatment (the other two sink deeper).

As the grip of his addiction loosened, Sam’s focus shifted to the firm that had kept him hooked. He knew he had been bombarded with marketing that had felt constant and impossible to ignore. But why had Sky Bet targeted him so intensively? Had the company known how badly he was struggling? And had that information been shared?

In late 2018, he submitted subject access requests (SARs) asking for records of the data it had on him, such as his deposits, withdrawals and chat logs.

It replied to say it was suspending his account due to safer gambling concerns following his “unusual questions”. “Can you please complete my SAR as requested?” he wrote back.

Eventually, the company provided documents revealing that it and its partners held hundreds of thousands of pieces of data on him, gathered using the web tracking tools known as cookies and from other sources.

It had been used to create a “DNA” customer profile of his browsing habits, demographic characteristics and customer ID, plus details of his gambling: his favourite games, when he played them, his wins and losses, the links he clicked, the marketing he responded to, and his location coordinates at the time.

Reading through the documents, Sam remembers feeling “physically sick”. Among unintelligible spreadsheets listing pieces of code, his years of gambling were spelled out in black and white: his history of playing slots, his favourite sport (football), the number of deposits made since opening an account (2,514) and his completed bets (44,063).

Information had also been shared with at least 18 third parties for marketing – including Facebook, Google and others that were less well known. One recipient, the intelligence firm Signal, had used it to conduct sophisticated profiling that it sent back to Sky Betting & Gaming to help it predict his behaviour and refine its ads.

This included labelling him as a customer of “high value” who they later wanted to “win back” – but no markers indicating he was at risk.

He was confused, then anxious. He had been trying to hide his gambling; now he feared it was going to get out. That quickly turned to anger. “I thought, well, if they had all this data on me, why didn’t they use it to protect me better?” he said.

This question was at the heart of the legal battle at the high court late last year. Over five days in November, the court heard not only how Sam was tracked and targeted, but about Sky Bet’s failure to realise he was at risk. Even as his gambling spiralled out of control, the company’s suppression measures – supposed to cut off marketing to people considered high risk – did not kick in.

Transaction data seen by the Observer shows that from 2017 to 2019 Sam was sometimes logging in several times per day, in the morning, afternoon, and middle of the night.

And he had previously been identified as someone at potential risk. In 2014, he had been flagged by Sky Bet for a “responsible gambling proactive” phone call – after depositing £1,000 that had been funded by a loan – but he didn’t answer. The following year, he shut his account to try to stop gambling but reopened it the next day. In June 2016, he tried to close it again. In the process, he was asked via a chat tool whether he wanted to opt in to marketing via email or SMS. “No thank you,” he wrote back.

Sky Bet also had access to external data that could have helped them assess risk, including data correlating postcodes with deprivation, but didn’t use it. The court heard this was for “ethical reasons” – it didn’t want people to use risk factors such as social deprivation “to enhance the attractiveness of its marketing”.

Had it cross-referenced this information with details of his transactions, it might have twigged that he was in trouble and cut off its ads. Instead, its system relied on a financial trigger – how much money a customer was spending – to decide whether they were at risk.

As it stood, the court heard that even if Sam had spent every penny he had, his modest salary meant he could never reach that threshold. The triggers were set at levels “beyond the realistically possible reach” of his modest means, “even when he was spending all the money he could get his hands on and more,” the judge said.

She described Sky Bet’s system as “a cliff edge”: people hitting the threshold would stop receiving marketing altogether, while those falling just short could be labelled a potential “high value asset” and subject to “enhanced targeting”. It was “all or nothing”. “There were no intermediate stages in which marketing continued but was moderated or safeguarded, she said.

The judge was also damning about Sky Bet’s process for obtaining consent. While Sam may have clicked a tick-box agreeing to marketing, he had not properly understood how he was being tracked and profiled, nor how his data would be used.

She ruled that while he was in the depths of his compulsive gambling habit, his ability to give consent was impaired, concluding that Sky Bet’s use of his data to serve marketing was unlawful. “He was not making decisions relating to his gambling in general – and these box-ticking decisions in particular – on a fully autonomous basis at all,” she said.

Sky Betting & Gaming rejects the finding and is considering an appeal. A spokesperson for the company, bought by £38bn gambling giant Flutter in 2020, said: “We fundamentally disagree with this judgment, which relates to a specific case from 2017-19. Protecting our customers is the number one priority for Sky Betting & Gaming and we have made significant changes to our controls and processes over the past six years.”

But if it holds, the ruling could have significant repercussions for the gambling industry.

In recent years, the sector has faced stricter controls after warnings over gambling harms. In 2022 and 2023, the Gambling Commission introduced tougher requirements for operators to identify and protect customers at risk of harm – including that they must “draw on all available sources of data to give a comprehensive picture”.

It has previously restricted marketing and promotional offers to customers showing strong indicators of harm. And from 1 May this year, operators will be barred from cross-selling new products to customers without explicit permission.

But seven years on from when Sam was being targeted, the industry still relies heavily on tracking and profiling to attract its customers, often through tick-box consent.

Ravi Naik of law firm AWO, representing the claimant, said he hoped the ruling would be a “death knell for this kind of pernicious activity: tick-boxes, mass surveillance and data sharing, all unbeknownst to the user”.

He said everyone was subject, all the time, to automated behavioural segmentation – tracking and profiling for ad purposes. But in his client’s case, “the mechanism was getting him to continue to gamble to the point of self-destruction”. “They had taken his addiction and turned it into code,” he said.

Will Prochaska, leader of the Coalition to End Gambling Ads, described the case as “frightening” and said it raised the question of whether other companies that market to problem gamblers, who could be considered unable to freely consent due to the compulsive nature of their gambling, are also breaking the law.

“The judge has picked up on the fact that addiction takes away agency: when you’re addicted, your agency has been impaired,” he said.

He said profiling and targeting were “continuing and widespread” in the gambling industry and had been known “for years”. “This court case opens the lid on one operator’s practice but the real question is why the regulator allowed this to carry on for so long,” he said.

Charles Ritchie from the charity Gambling with Lives, which supports families bereaved by gambling, said: “Operators are using data and algorithms to target people with more incentives to gamble when they should be using that data to meaningfully intervene.

“Gambling companies have been preying on people for many years in this way. We know data tracking is widespread across the industry. The regulator needs to step in to ensure it is used legally and focused on preventing harm.”

The Gambling Commission said: “We expect that all operators will be carefully considering this judgment … Protection of consumer data is paramount.” The Betting and Gaming Council, which represents gambling firms, declined to comment.

For Sam, the ruling is “total vindication”. As he recovered from his addiction, he submitted a complaint to Sky Bet, highlighting his concern about being targeted, but says the company denied responsibility. “They answered with something like ‘We couldn’t have known you had a gambling problem’,” he said.

A few years ago, he might have believed them. Looking back at each glossy marketing email he received, and each bet he placed, he says he was “reminded of the bad person” that he was, and overwhelmed with a feeling of “deep shame”. Now, he can see the power that the constant bombardment had. “The marketing made me gamble more, gamble when I didn’t want to, and prevented me when I wanted to stop gambling,” he said. “It played a significant role in increasing the harm I suffered.”

He hopes the ruling will be a wake-up call for regulators – and the industry. “I lost 10 years of my life to gambling. I believe I – and a lot of others – should have been protected better,” he said.

*Name has been changed