UK Gambling Sites Face GDPR Scrutiny After 86% Cookie Test Failure

A new study at Swansea University has revealed that 86% of UK gambling sites have used “dark patterns” relating to cookie consent. While these are not necessarily in direct breach with GDPR practises, they show some serious issues with the way the tracking software and personally identifiable information is retained, which potentially invade the privacy of the visitors.

Data collection has many beneficial uses, as it can help with personalisation, give analytic data and even serve advertising purposes. But for gambling customers, it can also expose important information about their gambling site preferences, frequency, and any important shifts in behaviour over time.

And this report comes as the Information Commissioner’s Office (ICO) continues efforts to improve compliance with cookie and tracking rules across the wider internet. The gambling industry, however, may have fallen a bit behind the ICO’s claim that 95% of the top 1,000 sites in the UK are compliant to cookie and tracking regulations.

Study Exposes Dark Patterns in Gambling Site Cookies

The study was conducted at Swansea University’s GREAT Centre and was first covered in an article in The Guardian. The goal was to find out how online gambling operators collect and track consumer data, and then whether it is used to personalise any inducements (bonuses). Audits were made across 624 UKGC licensed gambling sites, and the report found that:

• 86% of sites had at least 1 dark pattern
• 67% processed personally identifiable data
• 47% offered reject tracking only after a second layer of cookie settings
• 22% offered no option to reject tracking
• Only 14% were GDPR compliant

These are quite high figures, and UK gamers and punters would be right to feel unnerved by the seemingly overwhelming portion of registered sites that disregard their privacy. These are not dodgy black market or offshore sites either. Operators like William Hill and Ladbrokes were among those who already harvested user data before the consent forms were offered. Hollywood Bets and the popular high-street slot firm Admiral Casino were exposed as not giving options for customers to turn off tracking.

What Are Dark Patterns

A site that outright refuses to give you an option to turn off cookies is directly breaching GDPR compliance laws, but dark patterns are more nuanced. They are sneaky practises that are designed to catch customers off guard or “push” a site visitor to accept cookies, from providing already ticked boxes to burying the option to reject consent in multiple sub menus.

The study observed the following:

• Visual emphasis (60%): The accept option is visually emphasised through colour, size, contrast, or positioning)
• Pre-selected options (29%): Privacy-unfriendly options are pre-selected by default
• Hidden reject option (47%): The reject option is not available on the first layer of the banner
• No Option to Reject (22%): The banner informs users that data is being collected but provides no option to reject
• No Banner (2%): No consent banner is present on the site

Technically, sites that provide the option to turn off tracking but use visual devices to trick customers are still GDPR compliant. Morally not, but by the framework of the laws, they are. Even hidden reject options, which constituted 293 of the sites reviewed (47%) are debatably within the law. Technically, the ICO explicitly says refusing tracking must be as easy as accepting it.

How This Affects Customers

For most visitors, the immediate problem is not that a gambling website can suddenly access their bank account or see everything they do online. Instead, the concern is that information about their activity can be collected and potentially shared with third parties before they have agreed to this tracking. For example, a visitor could arrive at an online casino and browse several slot games before deciding whether to register. Tracking technologies could potentially record information about that visit, depending on which technologies the website uses.

This can include information such as the pages visited, the device being used, browsing behaviour and identifiers that allow activity to be associated with the same visitor. If this information is shared with third parties who work with other gambling sites, then these can specifically target those players with inducements and enticing sign up offers to attract these potential future customers.

It creates a serious privacy problem for online gamblers in the UK. The study describes this as surveillance capitalism – in which your data is priceless for operators as they can tailor their products to your needs and use this collected information to get your business. The UK gambling operators spend around £1.1 to £2 billion per year on gambling advertising alone, with over two thirds of this happening online. It is aimed at finding out a player’s preferences, but also to track their activity over a period of time. And that is where it can shift into dangerous territory.

Dangers of Tracking Software and Unchecked Cookies

Because the average user may just see the flurry of gambling ads as more irritating promos taking up space on their screen, and just move past them without further thought. But for the problem gamblers, it can trigger emotional responses, calling them to try their luck by snapping up a new bonus or opting into some kind of promotional offer.

A 2025 investigation by The Observer found Meta Pixel tracking on around one-third of 150 UK-licensed gambling sites, with some sending information about users’ activity to Meta before marketing consent had been given. Researchers subsequently received gambling adverts on Facebook, while the Swansea study highlighted the overlap between profitable gambling behaviour and patterns associated with gambling harm.

This raises concerns that the same data used to understand customer behaviour could potentially be used to target people who may already be vulnerable to problem gambling. For a player who is already showing signs of problematic behaviour, personalised gambling advertising could therefore reinforce the behaviour rather than help them step away from it.

The UK Laws About Cookie Consent

The rules surrounding cookies are primarily governed by the Privacy and Electronic Communications Regulations (PECR), alongside the UK GDPR where personal data is involved. The ICO says websites must tell users that cookies or similar technologies are being used, explain what they do and, where consent is required, obtain permission before storing or accessing information on a user’s device.

There are exceptions for technologies that are strictly necessary for a service to operate. But non-essential advertising and tracking technologies generally require consent. Crucially, the ICO says that refusing these technologies must be as easy as accepting them. Consent must also involve a clear positive action, meaning that simply continuing to browse a website does not constitute consent. Users can also withdraw consent later. If they do so, an organisation must stop relying on that consent for the relevant processing and should remove the associated storage and access technologies where required.

Efforts to Combat Unsolicited Gambling Ads

The UK has already introduced increasingly strict rules around gambling advertising and player protection, while the UK Gambling Commission has also expanded the amount of behavioural and financial information operators are expected to monitor. These include the introduction of financial risk assessments for higher spending customers, stricter gambling ad laws that target illegal stream sites and also social media gambling ad distribution. And the ICO has also, in recent years, stepped up efforts to combat online privacy shortcomings.

In 2024, the ICO took action against Sky Betting & Gaming after finding that the operator had used cookies to process customers’ personal information for targeted advertising without the required consent. Sky Betting & Gaming subsequently made changes to ensure customers could reject advertising cookies before their information was shared for those purposes.

Operators are increasingly expected to monitor customer behaviour so they can identify potential gambling harm, but customers also have legitimate expectations that their personal information will not be collected or used without proper consent. There is therefore a balance to be found between responsible gambling monitoring and consumer privacy. Cookies and tracking software has its uses, but using these to target players – or selling them onto third parties – undermines the benefits of the software. One thing that this report has shown is that gambling operators in the UK still have some way to go to creating transparency and giving players more control over their private data.