Massachusetts sports betting operators are seeking changes to a state data privacy regulation that some operators call “invasive” with no clear timeline for compliance.
Operators are most concerned with a part of the reg that requires them to receive consent — or opt-in — from a consumer any time that individual’s personal data is shared with a third-party vendor not directly involved in running a sportsbook app or facility.
Hotels or other vendors that are part of a sportsbook’s customer rewards program appear to fall under that definition of a third-party vendor, operators said. So would any other vendor not directly involved in sports betting operations.
Because no other US jurisdiction has an opt-in requirement for personal data sharing with each individual vendor, operators said they are not prepared to implement it. Implementation, operators say, could take years.
“Two to three years is not uncommon for implementation of these types of data privacy regimes,” FanDuel official Cory Fox said at the roundtable. “These are really hard and it’s rearchitecting how a lot of our backend systems work.” DraftKings, BetMGM, Caesars, WynnBet, Fanatics, Penn Interactive, and Betr were also involved in today’s roundtable.
A waiver for sportsbook compliance with the regulation (205 CMR 257) is now in place until Nov. 17, according to MGC legal counsel Caitlin Monahan. Information gathered at today’s roundtable will be used to decide if the regulation will be changed, and how.
MA Attorney General’s Office Favors Stringent Rule
The Massachusetts Attorney General’s Office supports the opt-in provision found in 205 CMR 257, which reads:
(2) If a Sports Wagering Operator seeks to use a patron’s Confidential Information or Personally Identifiable Information for purposes beyond those specified in 205 CMR 257.02(1), a Sports Wagering Operator shall obtain the patron’s consent, which may be withdrawn at any time. (a)Such consent must be clear, conspicuous, and received apart from any other agreement or approval of the patron. Acceptance of general or broad terms of use or similar documents that purport to permit the sharing of Confidential Information or Personally Identifiable Information in the same document shall not constitute adequate consent, nor shall hovering over, muting, pausing, pre-selecting, or closing a given piece of content without affirmative indication of consent.
Jared Rinehimer is the Division Chief of Data Privacy and Security in the Massachusetts Attorney General’s Office. He told the commission during today’s roundtable that implementation of the opt-in “is going to take some time.” But Rinehimer suggested that state gaming regulators stay firm on the issue.
“I am certain there are going to be tech challenges in implementing parts of this regulation and I think that’s totally understandable,” Rinehimer told the commission today. “The principle behind (consent) is what I would say is a common sense one. If you want to use someone’s information, you ask them first. That seems like a reasonable approach.”
Rinehimer added: “I would just encourage the commission to think about, rather than waiving the entire compliance with the regulation.”
Sportsbooks Call Regulation ‘Invasive’
Sports betting operators speaking before the commission today said they intend to meet whatever regulation is placed before them. But some operators, including DraftKings, said they see the opt-in requirement as more harmful than helpful to Massachusetts sports betting.
According to testimony, DraftKings official David Prestwood “is in many cases more invasive in part because it’s not an extension of any existing legal framework in the US.”
“We do use third-party vendors for a lot of these things that patrons would opt into,” Prestwood said. “They keep that data tight (and) have to follow the same data security concerns. It’s just in the privacy realm, in order to follow up on opted-in use, we would have to share that data with third parties, and under this regulation, we can’t do that.”
BetMGM Associate General Counsel for Privacy and Product Alexis Cocco said during the roundtable that how operators’ questions are ultimately answered will determine project timelines impacting the sportsbook’s customers.
Knowing what to expect — whatever that is — will, she said, move the process along.
“This is not a blanket request for this data privacy reg to go away,” Cocco told the commission today. “A lot of us are already meeting these requirements including opt-out requests and data deletion requests. We are already protecting all of our patrons. We need clarity from MGC to provide guidance to technical teams to determine how to comply with the deviations from existing laws.”
More Discussion To Come
The opt-in provision is not the only concern voiced by operators. Prestwood said DraftKings has other concerns, including the fact that the regulatory guardrails apply only to the sports betting industry. Another concern, he said, is that the commission has provided “no clear timelines for compliance.”
BetMGM and a few other operators at the roundtable said they share those concerns.
Monahan told the commission it is possible that different implementation timelines can be set, adding that “additional waivers may be needed as a result of this conversation.” Additional meetings will likely be scheduled to address various concerns.
Commissioner Eileen O’Brien said at the close of the roundtable that the regulation is “a work in progress” that can be tailored more depending on need.
“It may be that this regulation is going to have to come back in front of us for more tweaks,” said O’Brien.
About the Author
