British gambling websites are facing fresh scrutiny over how they collect and use customer data, with a new study suggesting that 86% of licensed gambling sites examined may be failing to meet GDPR requirements.
Researchers from Swansea University’s GREAT Centre analysed the cookie and tracking practices of 624 gambling websites, finding widespread use of techniques that could push users towards accepting data collection.
The findings raise particular concerns around the way online bookmakers and casinos handle tracking technologies, advertising data and consent.
Two-Thirds Collected Data Before Consent
One of the study’s most significant findings was that around two-thirds of the websites began collecting user data before visitors had given consent.
While some data collection can be justified for legitimate purposes, such as confirming that a customer is accessing a gambling service from the UK, researchers found that information was also being transmitted to third-party analytics platforms used for marketing.
Major operators including Ladbrokes and William Hill were among those identified as collecting data before consent, although Entain, which owns Ladbrokes, said information collected before consent was not used for advertising or marketing.
24% Offered No Way to Stop Tracking
The research also found that 24% of the 624 websites tested did not provide users with an option to switch off tracking software.
Tracking tools can allow advertisers to follow users across websites and build profiles used to deliver targeted marketing.
Among the operators identified as lacking an option to disable tracking were Hollywood Bets, which sponsors Brentford FC, and Admiral Casino.
A further 2% of gambling websites offered no consent choice at all, with Dafabet among the sites identified in the study.
Gambling Sites Rely Heavily on “Dark Patterns”
The study also examined the design of cookie consent banners and found widespread use of so-called dark patterns — interface choices that can steer users towards less privacy-friendly options.
In 60% of cases, the least privacy-friendly option received stronger visual emphasis. Another 29% of websites pre-selected privacy-unfriendly settings, while 47% placed the option to reject tracking behind an additional layer.
The researchers noted that these design techniques do not automatically amount to GDPR violations. However, 86% of the sites featuring such practices were also found to have committed at least one potential GDPR breach.
That figure compares with 54% in an earlier study examining websites across the wider internet, suggesting that gambling sites may be performing particularly poorly on privacy compliance.
ICO Faces Pressure to Act
The findings come as Britain’s Information Commissioner’s Office (ICO) continues a multi-year programme aimed at improving compliance with cookie and tracking rules.
The regulator says it has already pushed 95% of the UK’s top 1,000 websites towards compliance with the relevant requirements.
Ravi Naik, legal director at data protection specialist AWO, described the gambling study as evidence of widespread and systemic non-compliance and questioned whether the ICO has taken sufficient enforcement action against the sector.
The ICO said it remains committed to monitoring compliance across the UK’s most visited websites and will take action where necessary to protect people’s information rights.
Data Tracking Becomes a Gambling Consumer Protection Issue
The study’s authors argue that privacy concerns are particularly important in online gambling because the data used to maximise customer engagement can overlap with behavioural patterns associated with harmful gambling.
The issue has already attracted regulatory attention. In 2024, Sky Betting and Gaming was reprimanded by the ICO over the unlawful sharing of customer data with advertising companies after concerns were raised about the use of gambling behaviour to trigger personalised marketing.
The latest research therefore puts the spotlight on a broader question: whether gambling operators can use customer data to optimise engagement while still meeting the strict consent standards required under UK privacy law.
With 86% of the gambling sites examined flagged for at least one potential GDPR breach, the study is likely to increase pressure on operators to rethink how consent, tracking and personalised advertising are handled across their platforms.
Source: The Guardian