67% of UK Gambling Sites Tracked Users Before Consent, Study Says

A Swansea University audit found widespread problems with cookie consent across licensed British gambling websites. Researchers said only 14% of the sites reviewed met all of the GDPR requirements they tested.

The paper, published on August 25 in Computers in Human Behavior Reports, combined a sector-wide website audit with a separate experiment on how consent-banner design affects user choices. The study covered 624 UK-licensed gambling websites.

Researchers found that 67% processed personally identifiable information before the visitor had agreed to tracking. Another 24% gave users no option to reject tracking.

The researchers also found that 86% of consent banners contained at least one “dark pattern” – a design choice that can steer people toward sharing more data than they intended. The most common examples included giving greater visual weight to the less private option, pre-selecting settings, or placing the rejection control behind an extra step.

These findings do not mean every cookie placed before consent was unlawful. Gambling operators can process some information for essential purposes. The study focused on whether identifiable data was handled before valid consent and whether the consent interface gave users a genuine choice.

A Separate Test Showed the Design Effect

The research went beyond the website audit. A second study involved 615 participants using a simulated gambling platform.

Participants were randomly shown different consent banners. The banner design most commonly found in the audit produced a higher tracking acceptance rate and a weaker match between what users selected and what they said they actually preferred.

The researchers found no link between consent choices and participants’ self-reported level of gambling harm. Their concern was broader: the interface itself could influence whether a visitor agreed to data sharing.

ICO Has Already Acted on Gambling Cookies

The findings follow earlier regulatory action in the same area. In September 2024, the Information Commissioner’s Office reprimanded Sky Betting and Gaming for processing personal data through advertising cookies before users had accepted them.

The ICO said the data had been shared with advertising technology companies between January and March 2023. Sky Bet later changed its website so visitors could reject advertising cookies before their information was shared.

The Swansea study does not amount to an ICO enforcement decision against the 624 sites. It does, however, point to a sizeable compliance gap in a licensed sector where customer behaviour data can be commercially valuable.

The Problem May Start Before the Click

The cookie banner is only the visible part of the process. A site can show both Accept and Reject buttons, while some tracking has already started in the background.

This is where the Swansea findings become more serious for operators. The issue is not always the design of the banner itself. It can be the moment when analytics or advertising tools begin to work.

For UK gambling companies, this means consent checks will probably need to go deeper into the site setup. If data is sent before the user makes a choice, changing the wording on the banner will not solve much.