Nearly nine in 10 (86%) UK-licensed online gambling websites are operating in breach of the General Data Protection Regulation, according to new research from the Gambling Research, Education and Treatment (GREAT) Centre at Swansea University.
The study audited the cookie consent banners and network traffic of all 624 casino and sports betting websites licensed by the Gambling Commission. The team found that:
- Two-thirds (67%) of sites began collecting personally identifiable data before users had given consent, sending unique user identifiers to third-party analytics and marketing platforms.
- Almost a quarter (24%) gave users no way to refuse tracking at all, including 2% of sites that displayed no consent banner whatsoever.
- Only 29% of banners allowed users to reject tracking as easily as they could accept it. On some sites it took 15 clicks to refuse.
- Most banners used "dark patterns", interface designs that steer users towards the least private option. These included visual emphasis of the accept button (60%), hiding the reject option behind a second layer (47%), and pre-selecting privacy-unfriendly settings (29%).
In a second experimental part of the study, the team tested how these designs affect behaviour. A sample of 615 UK online gamblers were presented with a simulated betting website carrying one of six consent banners. The design most used across the industry made participants three to four times more likely to accept tracking than a neutral, one-click alternative.
Participants who accepted also rated their choice as a far poorer reflection of their real privacy preferences than those who rejected (4.4 out of 10, compared with 7.9), suggesting the design, rather than the user, was driving the outcome. The effect was the same regardless of participants’ level of gambling risk.
The researchers argue that data collected in this way underpins the personalised marketing and cross-web tracking of gambling customers, and that the characteristics used to identify commercially valuable players overlap substantially with the behavioural markers of gambling harm.
The research, published in Computers in Human Behavior Reports, was led by PhD student Jack McGarrigle, supervised by Professor Simon Dymond, Dr Martyn Quigley and Dr Jamie Torrance.
“We audited every licensed gambling site in the UK and the picture was stark. Most aren't giving customers a fair choice about tracking. Some make it a single click to accept and up to fifteen to refuse. Our follow-up experiment showed this isn't incidental; it works exactly as you'd expect, nudging people toward decisions they don't actually agree with," said lead author Jack McGarrigle.
Professor Dymond said: “Our research shows that the data being harvested through these designs isn't neutral, it's the same kind of behavioural signal that can flag risk. Getting consent right isn't just a data protection issue for the industry, it's an important part of preventing gambling harm.”
Learn more about the Gambling Research, Education and Treatment (GREAT) Centre.