Two-Thirds of UK Gambling Sites Collect Data Without Consent: A 12-Step Fix for Affiliates

Researchers at Swansea University examined all online casino and sportsbook websites licensed by the Gambling Commission (624 in total). On two-thirds of these sites, analytics and advertising pixels were capturing a visitor’s unique identifier even before the visitor clicked a single button on the cookie banner. The audit focused on operators, but the same issues persist on affiliate websites. Starting in February 2026, these violations could result in fines of up to £17.5 million. Below are 12 points that affiliates can check on their websites in a single business day.

Key Takeaways

• 67% of UKGC-licensed websites (418 out of 624) sent personal identifiers to analytics and marketing services before obtaining consent. Only 14% passed the GDPR compliance audit (Swansea University, audit conducted April–June 2025, published in 2026);
• Starting February 5, 2026, the ICO may impose fines for any violation of cookie regulations, not just serious ones. The maximum fine has increased from £500,000 to £17.5 million or 4% of global revenue;
• The new analytics exemption offers affiliates little help: the ICO explicitly lists ad affiliation and measuring ad effectiveness as purposes for which consent is required.

This material does not constitute legal advice. It describes the public requirements of the ICO and the Gambling Commission as of October 2026. For decisions regarding a specific website, please consult a data protection attorney.

What They Found in Swansea

Ph.D. student Jack McGarrigle and his advisors at Swansea University’s GREAT Centre obtained the Gambling Commission’s licensee registry (934 entries). Lotteries, bingo sites, inactive sites, and duplicates were excluded, leaving 624 casino and betting sites. From April through June 2025, each site was opened in Chrome’s incognito mode using a UK IP address. Before clicking on any banner, they checked the Network tab in DevTools to see if a request containing a persistent user identifier was sent to a third-party service, such as Google Analytics, Meta Pixel, or ad networks.

Table 1. Results of an audit of 624 UK-licensed gambling websites, April–June 2025. Source: McGarrigle et al., Computers in Human Behavior Reports, 2026 [1].

Many requests were sent to Google Analytics 4 endpoints before consent was granted. On “Accept / Settings” banners, it took an average of 3.38 clicks to opt out, and on some sites, up to 15. In the second experiment, 615 British gamblers were shown a website layout featuring one of six banners: the most common design in the industry increased the likelihood of consent by 3–4 times compared to a neutral banner with a one-click opt-out option [1, 2].

“We reviewed every licensed gambling site in the United Kingdom, and the picture that emerged was disheartening,” said Jack McGarrigle, the study’s lead author and a Ph.D. student at Swansea University [2].

There are two caveats. The first one is that the authors themselves state that this is a research-based assessment, not a legal ruling. The second one is that the audit was conducted prior to February 5, 2026, when new exemptions for analytics took effect. But this situation is not new. In February 2025, the Observer examined 150 UK-licensed gambling sites: 52 of them were transmitting data to Meta via Meta Pixel before obtaining consent [3].

Why This Matters to Affiliates

First, the industry regulator. Condition 1.1.2 of the UKGC Licensing Code (LCCP) holds the operator responsible for the actions of third parties with whom it works. The contract must require the contractor to comply with the same rules and give the operator the right to terminate it promptly if the affiliate violates them or acts contrary to the licensing objectives [4]. Following the Swansea publication, operators will pass these compliance requirements down the chain.

Second, the data regulator. In the final ICO guidance, advertising purposes are explicitly excluded from all exceptions. Consent is required for any advertising activities, including frequency capping, ad affiliation, measuring ad effectiveness, and protection against click fraud [5]. The PECR regulations apply not only to cookies but also to pixels, local storage, scripts, fingerprinting, and link decoration – the transmission of data via URL parameters [6]. The latter refers to your tracking links with click IDs.

Third, there is a precedent. In September 2024, the ICO issued a reprimand to Bonne Terre Limited (Sky Betting and Gaming): from January 10 to March 3, 2023, the website shared data with advertising technology companies before visitors had the opportunity to accept or reject cookies [7]. At that time, it was a reprimand, not a fine. Today, the ICO has other tools at its disposal.

What Changed in 2025–2026

Table 2. Sources: ICO [5–8], legislation.gov.uk [9], Mishcon de Reya [10].

“The work is not done: our investigations and interventions will continue in the interest of a fairer and more transparent online tracking ecosystem,” said William Malcolm, the ICO’s Executive Director for Regulatory Risk and Innovation, on April 29, 2026 [8].

Checklist: 12 Items for One Day

1. Repeat the Swansea test on your website. Open the homepage and 2-3 key review pages in incognito mode using a UK IP address, go to DevTools → Network, and don’t click anything. Look for requests to google-analytics.com, facebook.com/tr, DoubleClick, TikTok, Hotjar, and affiliate network domains. If such a request is made before a click, it may be a violation.

2. Perform a cookie audit. DevTools → Application: Cookies, Local Storage, Session Storage. Make a note of the owner, purpose, and expiration of each entry. Compare your list with your cookie policy and remove or document anything that’s not on your policy.

3. “Reject All” – on the first screen. The ICO requires that opting out be as easy as opting in [11]. In the Swansea audit, only 29% of banners complied with this requirement. Use buttons of equal size and contrast; never put “Settings” in place of “Reject”.

4. No pre-ticked boxes and no “By continuing to use the site…”. Silence and inaction do not constitute consent; advertising categories are disabled by default; consent is not hidden in the terms of service [11].

5. Reconfigure GTM. Set the default settings from CMP to the “Consent Initialization” trigger – it fires before all other tags. For non-Google tags, enable “Require additional consent” and check the Consent Overview in the container settings [12].

6. Explicitly configure Consent Mode v2. This applies to all four parameters: ad_storage, analytics_storage, ad_user_data, ad_personalization [13]. Do not use the default parameters: Google Ads allows for a consent-until-otherwise-selected mode [14]. Pick a mode: Basic keeps tags from being loaded until a user makes a decision, and Advanced allows cookieless pings upon opt-out. Whether those pings are permissible under the PECR is a question for your lawyer. Google’s user consent policy is effective in the UK [15].

7. Check whether the analytics service qualifies for an exception. Processing without consent is permitted only if the sole purpose is to collect statistics to improve your website, the data is aggregated, the analytics provider acts as a processor rather than a joint controller, and does not link the data to its own data. Users must be provided with clear information and a simple, free way to opt out [5]. GA4 linked to Google Ads or used for remarketing does not meet these conditions.

8. Pixels and affiliate links should only fire after consent has been given. Advertising pixels and scripts from Meta, TikTok, and Google Ads, for example, write click IDs to cookies or local storage. Links with tracking parameters count as link decoration too [6]. Stipulate in your agreement with the operator who is responsible for obtaining consent during the redirect process. 

9. Server-side and postbacks do not solve this problem. ICO states that regulation 6 applies to both the client-side and the server-side; when using server-side tags, you are required to disclose to which third parties you transfer the data [6]. S2S postbacks are convenient, but a tracker read from a device without consent is still a tracker. 

10. Consent and Withdrawal Log. You are required to keep records of consent and withdrawal of consent. Withdrawing consent must be as easy as giving it, for example with a floating link in the footer. After a refusal, the ICO advises waiting about 6 months before asking again [11].

11. Documents and Agreements. Cookie policy and privacy notice, including a list of third parties; DPA with the analytics provider; request to operators and networks: what consent requirements do they impose under LCCP 1.1.2 [4].

12. Retest according to schedule. Repeat step 1 after every GTM container publication and plugin update, and at least once a month. Save screenshots of the network tab, just as the Swansea researchers published theirs [1].

Is Consent Required? Six Typical Scenarios

Table 3. Prepared by 15M based on the ICO’s 2026 guidance [5, 6, 11]. Simplified framework; not a substitute for legal assessment.

What does this mean for you?

To Operators. The Swansea Audit is an open study with screenshots on each website. Regulators and journalists can locate your brand on these reports. Check your websites utilizing the methodology in the reports and make sure the consent requirements are included in your affiliate agreements: LCCP 1.1.2 makes you liable for their operations. Get your partners to validate that their pixels and scripts will not fire until consent is provided.

To Affiliates. Your primary risk isn’t a lone fine, but the contract itself. Should an operator be hit with a claim due to your tracking, LCCP stipulates that the operator has the right to terminate the contract quickly. Go through the 12 points, and save your results. Be prepared to show the results to the operator before they ask to see them. Losing a portion of attribution due to opt-outs is better than losing the partnership.

Methodology

The audit figures are from the full text of the article by McGarrigle et al. (2026), and a press release by Swansea University. The standards are from the legislation (SI 2026/82) and the ICO’s published guidance at the time of preparing the assessment. The checklist was prepared by 15M based on the above-referenced sources and Google’s documentation. How applicable specific exemptions are and the acceptability of individual technical solutions, e.g. ‘advanced’ mode of Consent Mode, should be assessed on a case-by-case basis depending on the configuration of the webpage.

Sources

1. McGarrigle J., Torrance J., Quigley M., Dymond S. “Consent banners, dark patterns, and GDPR infringements in online gambling: Evidence from a systematic audit and online experiment.” Computers in Human Behavior Reports, 23 (2026), 101270; published online August 20, 2026. Sample of 624 out of 934 websites, audit conducted April–June 2025, 67% (418), 86% (536 and 538), 24%, 29%, 47%, 14%, an average of 3.38 clicks, and up to 15 clicks. https://doi.org/10.1016/j.chbr.2026.101270
2. Swansea University, “Nine in 10 UK gambling websites breaching data privacy law, study finds” (September 14, 2026) – quote from Jack McGarrigle, experiment involving 615 gamblers, and a three- to fourfold effect. https://www.swansea.ac.uk/press-office/news-events/news/2026/09/nine-in-10-uk-gambling-websites-breaching-data-privacy-law-study-finds.php
3. Malwarebytes, “Gambling firms are secretly sharing your data with Facebook” (February 12, 2025) – summary of The Observer’s investigation: 52 out of 150 websites. https://www.malwarebytes.com/blog/uncategorized/2025/02/gambling-firms-are-secretly-sharing-your-data-with-facebook
4. Gambling Commission, LCCP Condition 1.1.2 – Responsibility for third parties. https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp/condition/1-1-2-responsibility-for-third-parties-all-licences
5. ICO, “What are the exceptions?” (Guidance on the use of storage and access technologies) – conditions for the statistical purposes exemption; advertising affiliation and advertising measurement require consent. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/
6. ICO, “What are storage and access technologies?” – tracking pixels, link decoration, fingerprinting, and server-side technologies. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-storage-and-access-technologies/
7. ICO, “Action taken against Sky Betting and Gaming for using cookies without consent” (September 17, 2024) – investigation period from January 10 to March 3, 2023; 52 out of 53 websites. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/09/action-taken-against-sky-betting-and-gaming-for-using-cookies-without-consent/
8. ICO, “Final storage and access technologies guidance published” (April 29, 2026) – 99% compliance among the top 1,000 websites and a quote from William Malcolm. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/ 
9. ICO, “ICO action secures increased cookie compliance” (December 4, 2025) – 979 out of 1,000 websites and 17 penalty enforcement notices (PENs). https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/ico-action-secures-increased-cookie-compliance
10. The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82 – Sections 112 and 115 and Schedules 12–13, effective February 5, 2026. https://www.legislation.gov.uk/uksi/2026/82/made
11. Mishcon de Reya, “Unlawful cookies: a new avenue for the ICO to issue fines” (February 12, 2026) – removal of the “seriousness” threshold and an increase in the maximum fine from £500,000 to £17.5 million or 4% of annual turnover. https://www.mishcon.com/news/unlawful-cookies-a-new-avenue-for-the-ico-to-issue-fines
12. ICO, “How do we manage consent in practice?” – rejecting consent must be as easy as accepting it; consent withdrawal, record-keeping requirements, and an approximately six-month consent renewal period. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-manage-consent-in-practice/
13. Google Tag Manager Help, “Consent configuration” – Consent Initialization trigger and additional consent checks. https://support.google.com/tagmanager/answer/10718549
14. Google for Developers, “Consent mode overview” (updated July 30, 2026) – four consent parameters and basic vs. advanced consent mode. https://developers.google.com/tag-platform/security/concepts/consent-mode
15. Google Ads Help, “About consent mode.” https://support.google.com/google-ads/answer/10000067
16. Google, “EU user consent policy” – applies to the European Economic Area (EEA), the United Kingdom, and Switzerland. https://www.google.com/about/company/user-consent-policy/