9 in 10 UK Gambling Sites Breach GDPR, Study Finds
Nearly nine in 10 UK-licensed online gambling websites are breaching data privacy law through the design of their cookie consent banners, according to new research published by Swansea University's Gambling Research, Education and Treatment (GREAT) Centre. The study audited all 624 casino and sports betting sites licensed by the UK Gambling Commission and ran a follow-up experiment with 615 UK gamblers.
The research, published in Computers in Human Behavior Reports and detailed in a Swansea University press release, found 86% of UK-licensed online casinos and sports betting sites were operating in breach of the General Data Protection Regulation.
Two-thirds of sites began collecting personally identifiable data before users had given consent, sending unique identifiers to third-party analytics and marketing platforms. Almost a quarter gave users no way to refuse tracking at all, including 2% with no consent banner whatsoever, and only 29% let users reject tracking as easily as they could accept it.
Dark Patterns Are Widespread
Researchers said most consent banners used "dark patterns" designed to steer users toward the least private option, including visually emphasizing the accept button (60% of sites), hiding the reject option behind a second layer (47%), and pre-selecting privacy-unfriendly settings (29%).
In a follow-up experiment, 615 UK gamblers were shown a simulated sports betting sites with one of six consent banner designs; the design most commonly used across the industry made participants three to four times more likely to accept tracking than a neutral, one-click alternative.
Casino Games Hub
What The Researchers Said
"We audited every licensed gambling site in the UK and the picture was stark," said lead author Jack McGarrigle, a PhD student at Swansea University. "Most aren't giving customers a fair choice about tracking. Some make it a single click to accept and up to 15 to refuse.
Our follow-up experiment showed this isn't incidental; it works exactly as you'd expect, nudging people toward decisions they don't actually agree with." Professor Simon Dymond, who supervised the research alongside Dr Martyn Quigley and Dr Jamie Torrance, added that the data harvested through these designs "isn't neutral, it's the same kind of behavioural signal that can flag risk," and that "getting consent right isn't just a data protection issue for the industry, it's an important part of preventing gambling harm."
The study is among the first to link cookie-consent design directly to problem gambling risk markers, arguing that the same behavioural data used for personalized marketing overlaps substantially with indicators of gambling harm. It lands as UK regulators continue to scrutinize how licensed operators handle player data and target marketing, adding pressure on operators to review consent flows well beyond baseline GDPR compliance checks.
