Swansea University Audit Uncovers GDPR Breaches on UK Gambling Sites

Researchers at Swansea University’s GREAT Centre completed an audit of 624 licensed UK gambling websites and identified that 86 percent committed at least one GDPR breach tied to cookie consent banners and data collection practices, with the results released in a report that compared these operators against broader UK website standards. The study examined consent mechanisms, data flows to third parties, and interface designs that influence user decisions, while it documented patterns that appeared more frequently on gambling platforms than on other commercial sites operating under the same regulations.

Scope and Methodology of the Audit

The audit team reviewed licensed operators across desktop and mobile formats, focusing on how each site presented cookie options and whether data transfers occurred before users made selections, and the sample included both large operators and smaller platforms to capture a representative cross-section of the market. Observers note that the methodology relied on automated scanning combined with manual verification of consent flows, which allowed researchers to record exact instances where tracking scripts activated without affirmative user input.

Key Violations Identified

Twenty-four percent of the audited sites provided no option for users to disable tracking entirely, which left visitors with no practical way to prevent ongoing data collection once they arrived on the page. Two-thirds of the sites initiated data collection and transmission to third parties before any consent banner received a response, and this practice appeared on platforms operated by major companies including Ladbrokes and William Hill. Additional problems involved pre-selected checkboxes that favored acceptance of all tracking categories, along with banners that used layered menus requiring multiple clicks to reach full opt-out controls.

These interface elements, often described as dark patterns, directed users toward the path that enabled maximum data sharing while making refusal steps less visible or more time-consuming. The audit recorded cases where rejecting non-essential cookies required navigating through several screens, whereas acceptance occurred with a single click on a prominent button.

Comparison With Other UK Websites

Data from the same research group showed that gambling operators trailed behind other sectors such as retail, news, and financial services in meeting GDPR cookie requirements, and the gap appeared consistent across both the presence of basic consent tools and the timing of data transfers. Researchers attributed part of the difference to the technical complexity of affiliate marketing networks and real-time bidding systems commonly used in online gambling promotions, yet they also recorded that many breaches stemmed from straightforward configuration choices rather than unavoidable technical constraints.

Regulatory Context and Next Steps

UK data protection rules require clear, affirmative consent before non-essential cookies activate, and the Information Commissioner’s Office has issued guidance that emphasizes user control over tracking activities. The Swansea findings indicate that a substantial portion of licensed gambling sites have not aligned their banner implementations with these standards, which leaves operators exposed to potential enforcement actions or complaints from users. Industry representatives have not issued a collective response in the immediate period following the report, though individual companies may review their consent systems in light of the published statistics.

Conclusion

The audit provides a detailed snapshot of current practices on UK gambling websites, and the documented rates of non-compliance highlight an area where operators continue to fall short of GDPR expectations. Further monitoring by regulators and independent researchers will determine whether sites adjust their consent mechanisms following the release of these results, while users retain the option to review privacy settings on each platform they visit.