UK Gambling Platforms Draw Attention in Data Privacy Audit

Researchers at Swansea University's GREAT Centre examined 624 licensed UK gambling websites and identified that 86% appear to breach GDPR rules on cookie consent banners, and the audit highlights several consistent patterns across the sector. Data collection often begins before users grant approval, while many platforms present limited choices for opting out of tracking. The findings stand out because they surpass the 54% violation rate observed in wider website analyses, and they come at a time when the Information Commissioner's Office continues to push for stronger adherence in online industries.

Audit Details and Methodology

The study focused exclusively on licensed operators and reviewed how each site handled cookie banners, data transmission, and user controls, and observers note that the sample size provides a broad view of the market. Two-thirds of the audited sites began gathering user information and sending it to third-party marketing platforms before securing consent, and this practice raises questions about alignment with GDPR requirements for clear, affirmative agreement. Twenty-four percent of the websites offered no mechanism to disable tracking at all, and specific examples include Hollywood Bets along with Admiral Casino where users encountered no toggle options for non-essential cookies.

Patterns of Non-Compliance

Widespread use of dark patterns emerged as another central issue, and these design choices guide users toward selecting privacy-invasive settings through subtle prompts or pre-selected options. The audit shows that many banners default to accepting all cookies or bury rejection buttons behind multiple clicks, and such approaches appear across a significant portion of the 624 sites reviewed. Because the gambling sector shows an 86% rate compared with 54% in general website studies, the gap points to slower progress in this particular industry despite ongoing regulatory attention from the ICO.

Those who have examined the results point out that the absence of easy opt-out controls on nearly a quarter of sites creates a barrier for users seeking to limit data sharing. The study also records that many banners fail to provide granular choices, and instead present broad accept-or-reject options that favor data collection. Because the research draws from a large pool of licensed operators, the patterns identified offer a clear snapshot of current practices rather than isolated incidents.

Implications for Data Handling Practices

The audit connects several technical and design elements, and researchers found that pre-consent data transmission happens frequently enough to affect the majority of examined platforms. Third-party sharing occurs before banners receive interaction in many cases, and this sequence contradicts the principle that processing should follow valid consent. Observers note that the 86% figure reflects a combination of missing controls, early data flows, and dark pattern interfaces rather than any single issue, and the combined effect exceeds rates seen in broader digital audits.

Further examination within the study reveals that even sites displaying banners still route information to marketing partners ahead of user decisions, and this timing issue appears in roughly two-thirds of the sample. The 24% without any disable option represent a distinct subset where users face no alternative to full tracking once they proceed, and examples such as Hollywood Bets and Admiral Casino illustrate the point directly. When placed against the 54% benchmark from wider studies, the gambling sector results stand out for their scale and consistency across hundreds of domains.

Conclusion

The Swansea University audit supplies concrete numbers on cookie consent practices within the licensed UK gambling space, and the 86% violation rate along with the breakdown of specific issues provides regulators and operators with measurable data points. Two-thirds of sites initiating data collection before consent, 24% lacking disable options, and frequent dark pattern usage form the core observations, and these elements exceed general sector averages. The research remains available through coverage that references the GREAT Centre findings, and it continues to inform discussions around GDPR application in this regulated industry.