영국 도박 사이트, 쿠키 테스트 86% 실패 후 GDPR 감시 직면

스완지 대학교에서 진행한 새로운 연구에 따르면 영국 도박 사이트의 86%가 쿠키 동의와 관련된 “다크 패턴”을 사용한 것으로 드러났습니다. 이러한 행위가 GDPR 규정을 직접 위반한다고 단정할 수는 없지만, 추적 소프트웨어와 개인 식별 정보가 보관되는 방식에 심각한 문제가 있음을 보여주며, 이는 방문자의 프라이버시를 침해할 가능성이 있습니다.

데이터 수집은 개인화 지원, 분석 데이터 제공, 광고 목적 활용 등 많은 유익한 용도가 있습니다. 그러나 도박 고객에게는 그들의 도박 사이트 선호도, 이용 빈도 및 시간에 따른 행동 변화와 같은 중요한 정보를 노출시킬 수도 있습니다.

And this report comes as the Information Commissioner’s Office (ICO) continues efforts to improve compliance with cookie and tracking rules across the wider internet. The gambling industry, however, may have fallen a bit behind the ICO’s claim that 95% of the top 1,000 sites in the UK are compliant to cookie and tracking regulations.

연구, 도박 사이트 쿠키에서 다크 패턴을 폭로

The study was conducted at Swansea University’s GREAT Centre and was first covered in an article in The Guardian. The goal was to find out how online gambling operators collect and track consumer data, and then whether it is used to personalise any inducements (bonuses). Audits were made across 624 UKGC licensed gambling sites, and the report found that:

• 86%의 사이트에 최소 1개의 다크 패턴이 존재함
• 67%가 개인 식별 가능 데이터를 처리함
• 47%는 쿠키 설정의 두 번째 단계 이후에만 추적 거부 옵션을 제공함
• 22%는 추적을 거부할 옵션을 전혀 제공하지 않음
• 오직 14%만이 GDPR을 준수함

These are quite high figures, and UK gamers and punters would be right to feel unnerved by the seemingly overwhelming portion of registered sites that disregard their privacy. These are not dodgy black market or offshore sites either. Operators like William Hill and Ladbrokes were among those who already harvested user data before the consent forms were offered. Hollywood Bets and the popular high-street slot firm Admiral Casino were exposed as not giving options for customers to turn off tracking.

다크 패턴이란 무엇인가

A site that outright refuses to give you an option to turn off cookies is directly breaching GDPR compliance laws, but dark patterns are more nuanced. They are sneaky practises that are designed to catch customers off guard or “push” a site visitor to accept cookies, from providing already ticked boxes to burying the option to reject consent in multiple sub menus.

The study observed the following:

• Visual emphasis (60%): The accept option is visually emphasised through colour, size, contrast, or positioning)
• Pre-selected options (29%): Privacy-unfriendly options are pre-selected by default
• Hidden reject option (47%): The reject option is not available on the first layer of the banner
• No Option to Reject (22%): The banner informs users that data is being collected but provides no option to reject
• No Banner (2%): No consent banner is present on the site

Technically, sites that provide the option to turn off tracking but use visual devices to trick customers are still GDPR compliant. Morally not, but by the framework of the laws, they are. Even hidden reject options, which constituted 293 of the sites reviewed (47%) are debatably within the law. Technically, the ICO explicitly says refusing tracking must be as easy as accepting it.

이것이 고객에게 미치는 영향

For most visitors, the immediate problem is not that a gambling website can suddenly access their bank account or see everything they do online. Instead, the concern is that information about their activity can be collected and potentially shared with third parties before they have agreed to this tracking. For example, a visitor could arrive at an online casino and browse several slot games before deciding whether to register. Tracking technologies could potentially record information about that visit, depending on which technologies the website uses.

This can include information such as the pages visited, the device being used, browsing behaviour and identifiers that allow activity to be associated with the same visitor. If this information is shared with third parties who work with other gambling sites, then these can specifically target those players with inducements and enticing sign up offers to attract these potential future customers.

It creates a serious privacy problem for online gamblers in the UK. The study describes this as surveillance capitalism – in which your data is priceless for operators as they can tailor their products to your needs and use this collected information to get your business. The UK gambling operators spend around £1.1 to £2 billion per year on gambling advertising alone, with over two thirds of this happening online. It is aimed at finding out a player’s preferences, but also to track their activity over a period of time. And that is where it can shift into dangerous territory.

추적 소프트웨어와 미검증 쿠키의 위험성

Because the average user may just see the flurry of gambling ads as more irritating promos taking up space on their screen, and just move past them without further thought. But for the problem gamblers, it can trigger emotional responses, calling them to try their luck by snapping up a new bonus or opting into some kind of promotional offer.

A 2025 investigation by The Observer found Meta Pixel tracking on around one-third of 150 UK-licensed gambling sites, with some sending information about users’ activity to Meta before marketing consent had been given. Researchers subsequently received gambling adverts on Facebook, while the Swansea study highlighted the overlap between profitable gambling behaviour and patterns associated with gambling harm.

This raises concerns that the same data used to understand customer behaviour could potentially be used to target people who may already be vulnerable to problem gambling. For a player who is already showing signs of problematic behaviour, personalised gambling advertising could therefore reinforce the behaviour rather than help them step away from it.

영국의 쿠키 동의 관련 법률

The rules surrounding cookies are primarily governed by the Privacy and Electronic Communications Regulations (PECR), alongside the UK GDPR where personal data is involved. The ICO says websites must tell users that cookies or similar technologies are being used, explain what they do and, where consent is required, obtain permission before storing or accessing information on a user’s device.

There are exceptions for technologies that are strictly necessary for a service to operate. But non-essential advertising and tracking technologies generally require consent. Crucially, the ICO says that refusing these technologies must be as easy as accepting them. Consent must also involve a clear positive action, meaning that simply continuing to browse a website does not constitute consent. Users can also withdraw consent later. If they do so, an organisation must stop relying on that consent for the relevant processing and should remove the associated storage and access technologies where required.

원치 않는 도박 광고 대응 노력

The UK has already introduced increasingly strict rules around gambling advertising and player protection, while the UK Gambling Commission has also expanded the amount of behavioural and financial information operators are expected to monitor. These include the introduction of financial risk assessments for higher spending customers, stricter gambling ad laws that target illegal stream sites and also social media gambling ad distribution. And the ICO has also, in recent years, stepped up efforts to combat online privacy shortcomings.

In 2024, the ICO took action against Sky Betting & Gaming after finding that the operator had used cookies to process customers’ personal information for targeted advertising without the required consent. Sky Betting & Gaming subsequently made changes to ensure customers could reject advertising cookies before their information was shared for those purposes.

Operators are increasingly expected to monitor customer behaviour so they can identify potential gambling harm, but customers also have legitimate expectations that their personal information will not be collected or used without proper consent. There is therefore a balance to be found between responsible gambling monitoring and consumer privacy. Cookies and tracking software has its uses, but using these to target players – or selling them onto third parties – undermines the benefits of the software. One thing that this report has shown is that gambling operators in the UK still have some way to go to creating transparency and giving players more control over their private data.