A study of 624 Gambling Commission-licensed betting and casino websites found that 86% breach the General Data Protection Regulation (GDPR) in how they obtain consent to track users. Researchers at Swansea University published the findings on 14 September.
The audit examined cookie consent banners and network traffic on every site in the sample. 67% collected personally identifiable data before the user had consented to anything. 24% gave no option to refuse tracking. 2% served no consent banner at all.
The work was carried out by the Gambling Research, Education and Treatment (GREAT) Centre at Swansea University and published in the journal Computers in Human Behavior Reports. The sample covers the licensed population, not a selection of smaller or offshore brands, so the findings apply to the same operators that report their revenue to the Gambling Commission’s market reporting.
How the consent banners are built
29% of the sites let users reject tracking as easily as they could accept it. On the remaining 71%, the two choices were not equivalent.
60% gave the accept button greater visual prominence than the alternative. 47% placed the reject option behind at least one additional layer of menus. 29% loaded with privacy-unfriendly settings already selected, so a user who clicked through without reading was opted in by default.
Jack McGarrigle, a PhD student at Swansea University and the paper’s lead author, said the design patterns are consistent across the market.
“Most aren’t giving customers a fair choice about tracking. Some make it a single click to accept and up to fifteen to refuse.”
What 615 gamblers did when tested
The second phase of the study put 615 UK online gamblers in front of a simulated betting website showing six different versions of a consent banner.
Participants who accepted tracking rated how well their choice matched their own privacy preferences at 4.4 out of 10. Those who rejected it rated the same question at 7.9 out of 10. The gap indicates that a large share of the consent recorded by gambling sites does not reflect what the user wanted.
The behavioural data question
Professor Simon Dymond, one of the study’s co-authors, connected the tracking to the sector’s harm monitoring obligations.
“The data being harvested through these designs isn’t neutral, it’s the same kind of behavioural signal that can flag risk.”
Dr Martyn Quigley and Dr Jamie Torrance also co-authored the paper. UK operators are already required under their licence conditions to identify customers showing indicators of gambling harm and to act on them. The same session and behavioural data that supports that duty has commercial value in marketing and acquisition, which is where the consent question sits.
Where enforcement would come from
Data protection enforcement in the UK sits with the Information Commissioner’s Office (ICO), not the Gambling Commission. Consent for non-essential cookies falls under the Privacy and Electronic Communications Regulations (PECR), with the GDPR standard for valid consent applied on top. Under UK GDPR, the maximum penalty is the greater of £17.5 million or 4% of global annual turnover.
The ICO has run compliance sweeps of cookie banners on the UK’s most-visited websites before, writing to site operators and giving them a window to change their banners before formal action. No such action has been announced against the gambling sector, and the Swansea study is academic research rather than a regulatory finding.
What the study does provide is a repeatable method applied to a named, licensed population, published in a peer-reviewed journal. Gambling operators have spent the past two years absorbing a run of compliance costs across Europe, most of them driven by gambling regulators. This one would come from a different direction, and it applies to a website element most compliance teams treat as a marketing decision rather than a licensing risk. The audit also gives campaigners and claims firms a documented basis on which to approach operators directly, in a market already under scrutiny over how it converts online players into revenue.
Source: Swansea University
