Study: 86% of UK Gambling Sites Breach Data Privacy Law
A new academic study has found that nearly nine in ten UK-licensed gambling websites are breaching data protection law through the design of their cookie consent banners. The research, from Swansea University’s Gambling Research, Education and Treatment (GREAT) Centre, audited every single casino and sports betting site licensed by the Gambling Commission and was published this month in the journal Computers in Human Behavior Reports.
What’s actually changed
Nothing has changed in the rules themselves, but the study has exposed how widely those rules are being ignored.
Researchers audited the cookie consent banners and network traffic of all 624 casino and sports betting websites licensed by the Gambling Commission, and concluded that 86% were operating in breach of the General Data Protection Regulation.
The specific failings were stark.
Two-thirds of sites began collecting personally identifiable data before users had given consent, sending unique user identifiers to third-party analytics and marketing platforms, while almost a quarter gave users no way to refuse tracking at all, including some sites that displayed no consent banner whatsoever.
Only 29% of banners allowed users to reject tracking as easily as they could accept it, and on some sites it took as many as 15 clicks to refuse.
The team didn’t stop at auditing banner design.
In a second, experimental part of the study, 615 UK online gamblers were shown a simulated betting website carrying one of six different consent banners, and the design most commonly used across the industry made participants three to four times more likely to accept tracking than a neutral, one-click alternative.
Named among the operators whose sites collected data before consent were
Hollywood Bets, a sponsor of Brentford FC, and Admiral Casino, which were among the sites that did not provide an option to disable tracking software.
Lead author Jack McGarrigle summed up the findings bluntly, saying
“we audited every licensed gambling site in the UK and the picture was stark,” adding that “most aren’t giving customers a fair choice about tracking,” with some sites requiring “a single click to accept and up to 15 to refuse.”
What it means for you
If you hold an account with a UK-licensed casino or betting site, there’s a strong chance your browsing and betting behaviour has been tracked and shared with third-party marketing platforms before you ever clicked “accept” on a cookie banner. That matters beyond ordinary online privacy concerns.
Professor Simon Dymond, who supervised the research, said the data being harvested through these designs “isn’t neutral, it’s the same kind of behavioural signal that can flag risk,” and that “getting consent right isn’t just a data protection issue for the industry, it’s an important part of preventing gambling harm.”
In practice, this means the same tracking data used to serve you targeted adverts or personalised bonus offers could theoretically reveal patterns linked to problem gambling – patterns that should be informing safer-gambling interventions rather than marketing spend. If you’re concerned about how a site handles your data, you can check its cookie settings directly and adjust consent choices, though the study suggests many banners are designed to make refusal deliberately awkward.
The bigger picture
The findings land at an awkward moment for an industry already under sustained regulatory pressure. Separately,
the study comes as the Information Commissioner’s Office continues efforts to improve compliance with cookie and tracking rules across the wider internet, with the gambling sector appearing to lag behind the ICO’s own figures on cookie compliance among the UK’s most visited sites.
The research adds a new front to the compliance debate that has so far centred on affordability checks, deposit limits and advertising standards. If tracking data really can double as a behavioural signal for gambling harm, as the Swansea team argues, it raises the question of why that same data hasn’t been put to safer-gambling use rather than left to fuel targeted marketing – a question the Gambling Commission and ICO may now face pressure to answer as the wider Gambling Act reform programme continues to bed in.
Sources
- Swansea University – Nine in 10 UK gambling websites breaching data privacy law, study finds
- Gambling.com – 9 in 10 UK Gambling Sites Breach GDPR, Study Finds
- Yogonet – 86% of UK gambling sites appear to breach GDPR, according to study
- Focus Gaming News – Research highlights data protection breaches in UK online gaming sector
- EurekAlert – Nine in 10 UK gambling websites breaching data privacy law, study finds
- Nation.Cymru – Nine in 10 gambling websites ‘breaching data protection law’
