ICO Chief Signals Tougher Focus on AI, Children’s Data and Strategic Enforcement

_{ICO Chief Signals Tougher Focus on AI, Children’s Data and Strategic Enforcement in Final IAPP London Speech. Image: John Edwards/Linkedin)}

Information Commissioner John Edwards urges industries, including gambling, to prioritise high-risk data uses as complaints surge and AI scrutiny intensifies.

The UK’s top data protection regulator has warned that businesses deploying artificial intelligence and behavioural profiling tools must focus on the risk of real-world harm, not simply regulatory compliance.

In his final appearance at the International Association of Privacy Professionals (IAPP) Data Protection Intensive in London as Information Commissioner, John Edwards set out how the Information Commissioner’s Office (ICO) will prioritise enforcement amid rising complaints and rapid technological change.

For data-heavy sectors such as online gambling, the message was direct: regulators will concentrate on high-impact risks, particularly around AI, children’s data, and systemic misuse of personal information.

Complaints Surge as ICO Signals Targeted Enforcement

The ICO has seen a sharp increase in public complaints. According to figures cited in the speech, volumes rose from 40,000 in the 2024-25 financial year to 66,000 so far this year, with projections of up to 75,000 by year-end.

Rather than scaling investigations in line with volume, Edwards defended a selective strategy aimed at broader deterrence and market correction. The ICO, established under the Data Protection Act 2018 and responsible for upholding the UK General Data Protection Regulation (UK GDPR), has powers to issue enforcement notices and levy fines of up to £17.5 million or 4% of global annual turnover, whichever is higher.

That approach matters for gambling operators because enforcement may focus on practices that set industry norms, rather than isolated breaches. A single case could be used to reshape behaviour across a sector.

Recent high-profile actions illustrate that strategy. In 2023, the ICO fined TikTok £12.7 million for misusing children’s data. The regulator has also taken action against Clearview AI over unlawful biometric data processing. Such cases signal that technology-led data practices remain firmly in scope. This week Reddit has been fined £14.47 million by the UK’s data protection watchdog after an investigation found the social media platform unlawfully processed children’s personal information and failed to properly assess the risks to young users.

Speaking at the IAPP UK Intensive 2026 event Edwards said: "When I arrived in January 2022, the streets of London were still bare, with the Covid pandemic continuing to keep people away from work, and each other.  

"I inherited an organisation that had dealt with extraordinary challenges and change. In the four years prior to my appointment, the ICO had needed to implement the GDPR, figure out and prepare for the impact of Brexit, and deal with the unprecedented data and operational challenges of Covid. It had grown fast, and some growing pains were evident."

"It took me a little while to understand the scale of the challenges. You helped. I went on my ‘listening tour’ and heard what you wanted/expected/needed from the ICO.  

"It became clear to me that you, and industry and consumers, wanted clarity and certainty. Timely guidance, advice and enforcement. There was something of an anxiety and weariness at the scale and pace of change." 

AI and Behavioural Profiling Under Scrutiny

Edwards repeatedly pointed to generative AI, automated decision-making, and recommender systems as areas demanding proactive oversight.

Online casinos and sportsbooks increasingly rely on AI-driven systems for player segmentation, fraud detection, safer gambling interventions, personalised promotions, and marketing optimisation. Under UK GDPR, automated decision-making that produces legal or similarly significant effects triggers heightened obligations, including transparency and safeguards for individuals.

The ICO has published detailed guidance on AI and data protection, including its AI and Data Protection Risk Toolkit, encouraging organisations to embed privacy considerations at the design stage. That ‘privacy by design’ principle is a core requirement under Article 25 of UK GDPR.

For gambling firms, this raises practical questions: how transparent are profiling models? Are vulnerability detection systems explainable? Is customer consent valid where behavioural tracking underpins targeted bonuses?

The regulator’s stance suggests innovation alone will not shield businesses from scrutiny if risk assessments are weak or safeguards insufficient.

Children’s Data Remains a Red Line

Children’s privacy formed one of the clearest themes of the Commissioner’s remarks.

The ICO’s Age Appropriate Design Code, commonly known as the Children’s Code, came into force in 2021. It sets 15 standards for online services likely to be accessed by children, covering default privacy settings, profiling, geolocation, and transparency.

Enforcement actions against TikTok and investigations involving platforms such as Reddit and Imgur have centred on age verification failures and unlawful processing of children’s data. The regulator has previously stated that millions of UK children have benefited from changes introduced following the Code’s implementation.

For gambling operators, direct participation by under-18s is illegal under the Gambling Act 2005 and licensing conditions enforced by the UK Gambling Commission. However, indirect exposure remains politically sensitive. Advertising, social media content, gamified mechanics, and affiliate marketing can all fall under overlapping regulatory scrutiny.

As debates continue over youth access to digital platforms, coordination between the ICO, Ofcom under the Online Safety Act 2023, and the Gambling Commission is likely to increase. Businesses operating across these regimes face converging expectations around age assurance and risk mitigation.

Structural Change at the ICO

Edwards’ speech also marked an institutional shift. The Data (Use and Access) Act will replace the ICO’s long-standing ‘corporation sole’ structure with a board-led governance model. The regulator has also confirmed plans to relocate its headquarters from Wilmslow to Manchester as part of broader reform.

For regulated industries, a board structure may bring greater formalisation of strategy and accountability. Combined with a new corporate plan, it signals continuity in enforcement priorities even as leadership changes.

What This Means for Gambling Operators

The Commissioner’s message was not one of blanket crackdowns. It was a warning that regulatory attention will focus where harm is greatest and where systemic practices shape markets.

For casinos and betting firms, that translates into several practical imperatives:
    •    prioritising high-risk data processing activities, particularly automated profiling
    •    embedding privacy impact assessments into AI deployment
    •    strengthening age verification and children’s data safeguards
    •    scrutinising third-party data sharing and affiliate arrangements
    •    documenting harm-based risk assessments clearly

At the centre of the ICO’s strategy is a principle that resonates beyond compliance: there is always an individual behind the dataset. In gambling, where behavioural data can reveal addiction risk, financial stress, or vulnerability, that framing overlaps directly with safer gambling duties.

The direction of travel is clear. The regulator intends to intervene upstream, encouraging prevention rather than punishment after harm occurs.

For an industry built on data-driven insight, that is not abstract policy. It is a signal that privacy governance is becoming a competitive and regulatory necessity.