Stranice za kockanje u Velikoj Britaniji podvrgnute GDPR nadzoru nakon neuspjeha 86% testa kolačića

Nedavno istraživanje na Sveučilištu Swansea otkrilo je da 86 % britanskih stranica za kockanje koristi „tamne obrasce“ vezane uz pristanak na kolačiće. Iako to ne predstavlja nužno izravan prekršaj GDPR‑praksi, otkriva ozbiljne probleme u načinu na koji se softver za praćenje i osobni podaci pohranjuju, što potencijalno narušava privatnost posjetitelja.

Prikupljanje podataka ima brojne korisne primjene – može pomoći u personalizaciji, pružiti analitičke podatke i čak služiti za oglašavanje. No za korisnike kockanja, to također može otkriti važne informacije o njihovim preferencijama stranica za kockanje, učestalosti i značajnim promjenama u ponašanju tijekom vremena.

And this report comes as the Information Commissioner’s Office (ICO) continues efforts to improve compliance with cookie and tracking rules across the wider internet. The gambling industry, however, may have fallen a bit behind the ICO’s claim that 95% of the top 1,000 sites in the UK are compliant to cookie and tracking regulations.

Studija otkriva tamne obrasce u kolačićima stranica za kockanje

The study was conducted at Swansea University’s GREAT Centre and was first covered in an article in The Guardian. The goal was to find out how online gambling operators collect and track consumer data, and then whether it is used to personalise any inducements (bonuses). Audits were made across 624 UKGC licensed gambling sites, and the report found that:

• 86 % web stranica imalo je najmanje 1 tamni obrazac
• 67 % obrađivalo je osobno identificirajuće podatke
• 47 % ponudilo je odbijanje praćenja tek nakon druge razine postavki kolačića
• 22 % nije ponudilo opciju odbijanja praćenja
• Samo 14 % bilo je u skladu s GDPR‑om

These are quite high figures, and UK gamers and punters would be right to feel unnerved by the seemingly overwhelming portion of registered sites that disregard their privacy. These are not dodgy black market or offshore sites either. Operators like William Hill and Ladbrokes were among those who already harvested user data before the consent forms were offered. Hollywood Bets and the popular high-street slot firm Admiral Casino were exposed as not giving options for customers to turn off tracking.

Što su tamni obrasci

A site that outright refuses to give you an option to turn off cookies is directly breaching GDPR compliance laws, but dark patterns are more nuanced. They are sneaky practises that are designed to catch customers off guard or “push” a site visitor to accept cookies, from providing already ticked boxes to burying the option to reject consent in multiple sub menus.

The study observed the following:

• Vizualni naglasak (60%): Opcija prihvaćanja vizualno je istaknuta bojom, veličinom, kontrastom ili položajem
• Predefinirane opcije (29%): Opcije koje nisu prijateljske prema privatnosti unaprijed su odabrane
• Skrivena opcija odbijanja (47%): Opcija odbijanja nije dostupna na prvom sloju bannera
• Nema opcije odbijanja (22%): Banner informira korisnike da se podaci prikupljaju, ali ne nudi mogućnost odbijanja
• Nema bannera (2%): Na stranici nije prisutan banner za pristanak

Technically, sites that provide the option to turn off tracking but use visual devices to trick customers are still GDPR compliant. Morally not, but by the framework of the laws, they are. Even hidden reject options, which constituted 293 of the sites reviewed (47%) are debatably within the law. Technically, the ICO explicitly says refusing tracking must be as easy as accepting it.

Kako to utječe na korisnike

For most visitors, the immediate problem is not that a gambling website can suddenly access their bank account or see everything they do online. Instead, the concern is that information about their activity can be collected and potentially shared with third parties before they have agreed to this tracking. For example, a visitor could arrive at an online casino and browse several slot games before deciding whether to register. Tracking technologies could potentially record information about that visit, depending on which technologies the website uses.

This can include information such as the pages visited, the device being used, browsing behaviour and identifiers that allow activity to be associated with the same visitor. If this information is shared with third parties who work with other gambling sites, then these can specifically target those players with inducements and enticing sign up offers to attract these potential future customers.

It creates a serious privacy problem for online gamblers in the UK. The study describes this as surveillance capitalism – in which your data is priceless for operators as they can tailor their products to your needs and use this collected information to get your business. The UK gambling operators spend around £1.1 to £2 billion per year on gambling advertising alone, with over two thirds of this happening online. It is aimed at finding out a player’s preferences, but also to track their activity over a period of time. And that is where it can shift into dangerous territory.

Opasnosti softvera za praćenje i neprovjerenih kolačića

Because the average user may just see the flurry of gambling ads as more irritating promos taking up space on their screen, and just move past them without further thought. But for the problem gamblers, it can trigger emotional responses, calling them to try their luck by snapping up a new bonus or opting into some kind of promotional offer.

A 2025 investigation by The Observer found Meta Pixel tracking on around one-third of 150 UK-licensed gambling sites, with some sending information about users’ activity to Meta before marketing consent had been given. Researchers subsequently received gambling adverts on Facebook, while the Swansea study highlighted the overlap between profitable gambling behaviour and patterns associated with gambling harm.

This raises concerns that the same data used to understand customer behaviour could potentially be used to target people who may already be vulnerable to problem gambling. For a player who is already showing signs of problematic behaviour, personalised gambling advertising could therefore reinforce the behaviour rather than help them step away from it.

Zakonodavstvo Velike Britanije o pristanku na kolačiće

The rules surrounding cookies are primarily governed by the Privacy and Electronic Communications Regulations (PECR), alongside the UK GDPR where personal data is involved. The ICO says websites must tell users that cookies or similar technologies are being used, explain what they do and, where consent is required, obtain permission before storing or accessing information on a user’s device.

There are exceptions for technologies that are strictly necessary for a service to operate. But non-essential advertising and tracking technologies generally require consent. Crucially, the ICO says that refusing these technologies must be as easy as accepting them. Consent must also involve a clear positive action, meaning that simply continuing to browse a website does not constitute consent. Users can also withdraw consent later. If they do so, an organisation must stop relying on that consent for the relevant processing and should remove the associated storage and access technologies where required.

Napori u borbi protiv neželjenih oglasa za kockanje

The UK has already introduced increasingly strict rules around gambling advertising and player protection, while the UK Gambling Commission has also expanded the amount of behavioural and financial information operators are expected to monitor. These include the introduction of financial risk assessments for higher spending customers, stricter gambling ad laws that target illegal stream sites and also social media gambling ad distribution. And the ICO has also, in recent years, stepped up efforts to combat online privacy shortcomings.

In 2024, the ICO took action against Sky Betting & Gaming after finding that the operator had used cookies to process customers’ personal information for targeted advertising without the required consent. Sky Betting & Gaming subsequently made changes to ensure customers could reject advertising cookies before their information was shared for those purposes.

Operators are increasingly expected to monitor customer behaviour so they can identify potential gambling harm, but customers also have legitimate expectations that their personal information will not be collected or used without proper consent. There is therefore a balance to be found between responsible gambling monitoring and consumer privacy. Cookies and tracking software has its uses, but using these to target players – or selling them onto third parties – undermines the benefits of the software. One thing that this report has shown is that gambling operators in the UK still have some way to go to creating transparency and giving players more control over their private data.