Nine in 10 UK Gambling Websites Breach Data Privacy Law, Study Finds

^{Swansea University researchers audited cookie consent banners across every UK-licensed gambling website. (Photo: Eirian Evans / Wikimedia Commons)}

Nearly nine in 10 UK-licensed online gambling websites are operating in breach of the General Data Protection Regulation, according to new research from the Gambling Research, Education and Treatment (GREAT) Centre at Swansea University.

The study audited the cookie consent banners and network traffic of all 624 casino and sports betting websites licensed by the Gambling Commission, and found that 86% were non-compliant with GDPR rules governing user consent.

Two-Thirds of Sites Collected Data Before Consent

The researchers found that two-thirds (67%) of sites began collecting personally identifiable data before users had given consent, sending unique user identifiers to third-party analytics and marketing platforms. Almost a quarter (24%) gave users no way to refuse tracking at all, including 2% of sites that displayed no consent banner whatsoever.

In a second, experimental part of the study, the team tested how consent-banner design affects gambler behaviour. A sample of 615 UK online gamblers were shown a simulated betting website carrying one of six different consent banners. The design most commonly used across the industry made participants three to four times more likely to accept tracking than a neutral, one-click alternative.

Design, Not User Choice, Drove Tracking Consent

Participants who accepted tracking rated their choice as a far poorer reflection of their real privacy preferences than those who rejected it — 4.4 out of 10, compared with 7.9 among those who declined. The researchers said the effect held regardless of a participant's level of gambling risk, suggesting the banner design, rather than genuine user preference, was driving the outcome.

The study, published in Computers in Human Behavior Reports, was led by PhD student Jack McGarrigle and supervised by Professor Simon Dymond, Dr Martyn Quigley and Dr Jamie Torrance.

"We audited every licensed gambling site in the UK and the picture was stark. Most aren't giving customers a fair choice about tracking. Some make it a single click to accept and up to fifteen to refuse. Our follow-up experiment showed this isn't incidental; it works exactly as you'd expect, nudging people toward decisions they don't actually agree with," said McGarrigle, in the university's published statement.

The researchers argue that data collected through these designs underpins the personalised marketing and cross-web tracking of gambling customers, and that the characteristics used to identify commercially valuable players overlap substantially with the behavioural markers of gambling harm.

Professor Dymond said the findings extended beyond data protection compliance. "Our research shows that the data being harvested through these designs isn't neutral, it's the same kind of behavioural signal that can flag risk. Getting consent right isn't just a data protection issue for the industry, it's an important part of preventing gambling harm," he said, in the statement.

The Gambling Commission has separately signalled scrutiny of operator data practices, after Andrew Rhodes warned BGC members of an impending marketing data review that examined how licensees use customer information for marketing purposes. Data-handling questions have also surfaced in other recent UK gambling controversies, including the privacy dispute between former Entain executives and the Gambling Commission over the 888 investigation.

The GREAT Centre said it hoped the findings would inform both regulatory guidance and industry practice on cookie consent design across the licensed gambling sector. Full details of the study are available in Swansea University's published research summary.