Study finds 86 of UK gambling sites breach GDPR consent rules

A recent investigation into the digital practices of UK‑based gambling operators has raised fresh concerns over the way online bookmakers and casinos handle personal data. The study, commissioned by a data‑rights watchdog and conducted by a university research team, examined the cookie banners and privacy notices of 125 licensed gambling websites that accept bets from British customers. It found that a striking 86 percent of the sites appear to breach the General Data Protection Regulation (GDPR) by employing design patterns that nudge users towards giving consent for tracking before they have been fully informed of what data will be collected and how it will be used.The research team, led by Dr Emily Carter of the University of Manchester’s School of Digital Media, used a combination of automated scanning tools and manual testing to assess compliance with the GDPR’s consent requirements..

The investigators focused on the first point of contact a user experiences when entering a gambling site – the cookie banner – which is meant to give clear, granular choices about the acceptance or rejection of different types of cookies. In practice, the study reports, many sites deploy “dark patterns” such as pre‑ticked boxes, misleading button colours and language that subtly encourages users to click “Accept all” rather than reviewing the options in detail.“Gambling operators have a particular responsibility because they deal with a vulnerable audience, some of whom may be experiencing problem gambling or financial stress,” Dr Carter said in a briefing to the press. “When the consent mechanism is designed to harvest as much data as possible without giving users a genuine opportunity to refuse, it undermines the very purpose of the GDPR, which is to empower individuals to control their own information.”The GDPR, which came into force across the European Union in May 2018 and was retained in UK law after Brexit, obliges data controllers to obtain freely given, specific, informed and unambiguous consent before processing personal data that is not strictly necessary for the provision of a service..

In the context of gambling sites, the regulation requires that any tracking used for marketing, analytics or behavioural profiling be clearly disclosed, and that users be able to opt‑out of such processing without facing barriers that could impede their ability to place a bet.According to the study’s findings, only 17 of the 125 sites examined provided a neutral, “reject all” option that was as prominent as the “accept all” button. In the majority of cases, the “reject all” choice was hidden behind a small hyperlink, required multiple clicks, or was presented in a colour that blended into the background. Moreover, several sites displayed consent language that conflated essential cookies – which are required for the website to function – with non‑essential tracking cookies, making it difficult for users to distinguish between the two.The investigation also uncovered instances where consent was effectively recorded before a user had even scrolled through the banner..

In some cases, the cookie consent was set to “accept” by default, and the site began transmitting data to third‑party advertising networks the moment the page loaded, regardless of whether the user later clicked “reject”. This practice, known as “pre‑emptive data harvesting”, runs counter to the principle of consent being an active, informed decision.The UK Gambling Commission, the statutory body responsible for licensing and regulating gambling operators, responded to the report by confirming that it has opened a formal inquiry into the allegations. In a statement released on Tuesday, the Commission said it would “review the evidence presented, engage with the operators concerned and, where necessary, take enforcement action in line with our statutory powers.” The regulator also highlighted that it has previously issued guidance on data‑protection compliance for gambling businesses, urging them to conduct regular audits of their cookie practices and to ensure that consent mechanisms are transparent and user‑friendly.Industry bodies have defended the sector, arguing that the findings do not take into account the technical complexities involved in delivering a seamless betting experience..

The British Association of Gaming Operators (BAGO) issued a press release asserting that “most of our members are fully compliant with GDPR and work closely with the Gambling Commission to uphold the highest standards of data protection.” BAGO also pointed out that many of the sites flagged in the study were operated by offshore entities that, while holding a UK licence, are headquartered in jurisdictions with different regulatory frameworks.Legal experts, however, caution that the distinction between domestic and offshore operators does not absolve a site of its obligations under UK law. “If a website is offering services to UK consumers and holds a UK licence, it is subject to the UK GDPR regardless of where its servers are located,” explained Sarah Mitchell, a partner at the law firm Taylor Wessing who specialises in data‑privacy compliance. “Failure to obtain valid consent can lead to substantial fines – up to 4 percent of global turnover – and reputational damage that could erode customer trust.”The study’s authors recommend a series of remedial steps for gambling sites..

First, they call for the adoption of “privacy by design” principles, ensuring that consent mechanisms are integrated into the user journey from the outset rather than being appended as an afterthought. Second, they advise operators to separate essential and non‑essential cookies in their banners, providing clear explanations of the purpose of each category. Third, they suggest that sites conduct regular usability testing with a diverse sample of users to verify that the consent interface is not misleading.Consumer advocacy groups have welcomed the research, noting that it shines a light on a broader trend of data exploitation across the digital economy..

“What we are seeing is not unique to gambling,” said James O’Connor, director of the privacy charity Privacy International. “Similar patterns have been identified in e‑commerce, streaming services and social media platforms. The key difference here is the potential for harm – gambling can be addictive, and the combination of behavioural profiling with aggressive marketing can exacerbate problem‑gambling behaviours.”The findings arrive at a time when the UK government is reviewing its approach to online gambling regulation..

The Department for Digital, Culture, Media and Sport (DCMS) has signalled an intention to tighten rules around advertising, bonus offers and player protection. A draft bill introduced earlier this year proposes to introduce stricter licensing conditions, including mandatory data‑protection audits and the requirement for operators to demonstrate how they safeguard personal information.Stakeholders anticipate that the outcome of the Gambling Commission’s inquiry could set a precedent for how privacy compliance is enforced across the sector. If the Commission decides to levy penalties, it could compel operators to overhaul their consent frameworks, potentially leading to a more transparent market..

Conversely, critics argue that punitive measures alone may not address the underlying incentives that drive aggressive data collection. “Operators see data as a revenue stream,” noted Mitchell. “Regulators need to balance enforcement with clear guidance on how businesses can achieve compliance without sacrificing commercial viability.”In the meantime, users are.