Study Finds Data-Protection Compliance Problems on 86% of UK-Licensed Casino and Betting Sites
A Swansea University audit of 624 UK-licensed casino and sports betting sites found 86% failed a data-protection test, a research finding, not an ICO ruling.
Researchers at Swansea University found that 86% of 624 UK-licensed casino and sports betting websites failed at least one of four data-protection criteria. The audit raises questions about how gambling sites obtain consent and deploy tracking technologies.
The audit ran from April to June 2025 and was published in August 2026 in Computers in Human Behavior Reports. The classification is a research evaluation. It is not a formal legal determination by the Information Commissioner's Office (ICO) or a court, and the ICO has not confirmed the figure.
What the Swansea Study Found
The team, based at the university's Gambling Research, Education and Treatment (GREAT) Centre, began with 934 licensees listed by the UK Gambling Commission (UKGC). They excluded lottery operators, bingo sites, inactive sites, non-gambling services and duplicates. That left 624 casino and sports betting sites.
The researchers visited each site manually using Google Chrome in incognito mode from a UK IP address. They recorded the consent banner and captured network traffic as the page loaded, before any interaction with the banner. Coding was carried out mainly by the lead author, without a formal inter-rater reliability check. The paper states that the underlying data, materials, analysis code and screenshots are available through the Open Science Framework.
A second, experimental study followed. Its results are covered below.
What the 86% Figure Actually Means
The paper reports two separate findings that both come to about 86%. They measure different things.
The first concerns data-protection criteria. The researchers applied four criteria drawn from earlier academic work. By that test, 536 of 624 sites (about 86%) failed at least one, and roughly one in seven passed all four. The paper describes these failures as GDPR infringements, while stating that the assessment is a research-based evaluation and not a formal legal determination.
The second concerns design. In 538 of 624 sites (also about 86%), the consent banner showed at least one dark-pattern characteristic. Dark patterns are interface designs that steer users towards a particular choice, such as making the accept button stand out.
The two measures are not the same, and the study does not establish that 86% of sites both failed the criteria and used dark patterns. The paper itself notes that dark patterns may or may not be unlawful. Some of them, such as visual emphasis of the accept button, were classed as compliant in the authors' own summary table.
Tracking Before Consent
The most prominent finding concerns timing. About 67% of sites (418 of 624) sent persistent unique identifiers to third-party analytics or marketing services on page load, before any interaction with the banner. Many of these requests went to Google Analytics 4 endpoints. The paper does not separate analytics-only traffic from marketing or advertising traffic within this figure.
The researchers classified these practices as inconsistent with the applicable data-protection requirements. Whether an individual instance is unlawful depends on the rules that apply and on how the technology was configured, as discussed below.
On rejecting tracking, about 24% of sites (149 of 624) offered no way to refuse through the observed interface. This comprised 137 sites with banners that only informed users of data collection and 12 sites with no banner at all. The paper does not say whether those 12 sites set any non-essential trackers.
Where a reject route existed, it could be hard to reach. About 60% of sites visually emphasised acceptance, about 47% placed rejection behind a second layer, and about 29% pre-selected privacy-unfriendly settings. The most common format, an "Accept/Settings" banner used by nearly half the sample, allowed acceptance in one click, but rejection took an average of about three clicks. On some sites it took up to 15.
How Consent Interfaces Influenced Choices
In the second study, 615 UK residents who had gambled online in the previous 12 months were shown one of six consent banners on a simulated sports-betting site. Three formats were tested (binary, Accept/Settings and Category), each in a neutral and a visually emphasised "dark" version.
Using the Binary-Neutral banner as the reference point, the researchers reported significantly higher odds of acceptance for the two Accept/Settings versions. The Accept/Settings-Neutral format had an odds ratio of 3.10 (95% confidence interval 1.47-6.55), while the Accept/Settings-Dark format had an odds ratio of 3.97 (95% confidence interval 1.83-8.60).
An odds ratio compares the odds of an outcome between groups. It does not mean that the probability of acceptance was three or four times higher. The confidence intervals also indicate uncertainty around the estimated size of the effects.
No other banner type differed significantly from the reference. Within the same banner type, the dark version also did not differ significantly from the neutral version. This means the study does not establish that visual emphasis alone drove the observed difference.
Gambling severity, measured using the Problem Gambling Severity Index (PGSI), did not significantly predict acceptance. The experiment therefore did not show that people at higher risk of gambling harm were more susceptible to the consent interfaces.
Participants who accepted tracking also rated their choice as a poorer match for their ideal privacy preferences than participants who rejected it. That comparison was between people who accepted and people who rejected. It does not by itself show that a particular banner design caused the difference.
What UK Privacy Law Requires
Two UK privacy regimes are particularly relevant, and the paper refers to both under the heading of GDPR.
The Privacy and Electronic Communications Regulations (PECR) are particularly relevant to cookies, tracking pixels and similar technologies because they govern the storing of, or access to, information on a person's device. PECR generally requires consent unless an applicable exception applies. Where personal data is also processed, the UK GDPR may apply to that processing, including its requirements for valid consent.
The ICO's guidance on storage and access technologies, finalised on 29 April 2026, sets out its expectations. Consent mechanisms should make refusing as easy as accepting. Pre-enabled tracking is treated as bad practice. Withdrawing consent should be as easy as giving it. Third parties that will receive data must be identified. Advertising purposes always require consent.
The legal position changed after the audit. Provisions of the Data (Use and Access) Act 2025 took effect on 5 February 2026. They added new PECR exceptions, including one for statistical purposes, and raised maximum PECR fines to UK GDPR levels of £17.5 million or 4% of worldwide turnover.
The ICO's account of the statistical exception is narrow. It applies where the sole purpose is aggregate statistics about how a service is used. The provider must give clear information and a simple, free way to object. It does not cover advertising, profiling individuals or linking a visitor ID to their activity.
The audit therefore predates the exception. Whether any of the pre-consent traffic observed in 2025 would be treated differently under the September 2026 rules cannot be determined from the paper, because it does not separate analytics from marketing recipients. Individual practices would require separate assessment.
What Regulators Have Actually Done
The ICO told the Guardian that it is monitoring compliance across the UK's most visited websites and will act where necessary. As of 20 September 2026, no ICO investigation, warning, enforcement action or formal determination arising from the Swansea study had been identified. The ICO has not confirmed the study's figures.
The ICO separately reports that 99% of the UK's top 1,000 websites meet its cookie banner compliance checks. That measure uses a different sample, method and test date, and is not directly comparable with the Swansea audit.
Cookie consent in gambling has drawn regulatory attention before. In 2024 the ICO reprimanded Bonne Terre Limited, trading as Sky Betting and Gaming, after cookies were placed before consent between January and March 2023. The regulator found the processing was not lawful, transparent or fair, but found no evidence of deliberate misuse. The Swansea study did not flag Sky Bet, and the case is context, not corroboration of the audit's findings.
Ravi Naik, legal director at data-protection firm AWO, told the Guardian the findings indicate widespread and systemic non-compliance, and he criticised ICO enforcement against the sector. AWO has acted for the campaign group Clean Up Gambling in earlier matters, including the Sky Bet complaint.
No specific UKGC response to the study was identified. The regulator's direct marketing rule, licence condition 5.1.12, requires opt-in choices by channel and product for phone, email and text marketing. It does not regulate cookie banners. The study's authors argue that similar design discipline should be extended to consent banners, which is a recommendation and not current UKGC policy.
What Operators Said
Responses documented in the Guardian's reporting are limited. Entain, owner of Ladbrokes, said any data collected before consent was given was not used for advertising or marketing. Evoke, owner of William Hill, declined to comment. Hollywood Bets and Admiral Casino did not respond to requests for comment, and no response from Dafabet was reported.
Ladbrokes and William Hill were named as sites that began collecting data before consent. Hollywood Bets and Admiral Casino were named as offering no way to turn off tracking, and Dafabet as displaying no consent choice. A lack of response does not indicate wrongdoing, and no statements from other operators were identified.
Why This Matters for Gambling Consumers
The authors argue that data gathered through consent interfaces feeds personalised marketing and cross-web tracking, and that the behavioural signals used to identify valuable customers overlap with markers of harm. That is the researchers' interpretation. The study did not measure gambling harm, did not test how operators used the data, and did not show that tracking or banner design caused anyone to gamble more.
The consumer-protection concern nonetheless has a practical side. Under ICO guidance, players can reasonably check:
- whether a reject option appears on the first layer of the banner;
- whether optional settings are switched off by default;
- which third parties are named;
- how to change or withdraw consent later;
- marketing preferences in the account settings.
What the Study Cannot Prove
- The audit reflects April-June 2025, before the February 2026 legal changes, and site practices may have changed.
- The sample covers UKGC-licensed casino and sports betting sites, with bingo and lottery sites excluded.
- Observations came from desktop Chrome in a single configuration, with no mobile apps.
- The audit captured front-end banner design and page-load traffic. It cannot show backend data handling or what happened to data afterwards.
- The 86% figure is a research classification, not a legal ruling.
- The experiment used a simulated betting site with paid participants, and its realism was not formally assessed.
- No causal link between tracking and gambling harm was demonstrated.
Conclusion
The Swansea audit provides evidence of widespread consent and privacy-design issues in a large sample of UK-licensed casino and betting sites, along with experimental evidence that a common banner format raises the odds of accepting tracking. Whether individual practices breach the rules depends on the framework that applies, including the changes that took effect after the audit. That question would be for the ICO or the courts to decide.