UK Gambling Websites Reveal Widespread Cookie Consent Issues in Swansea University Audit

Researchers at Swansea University’s GREAT Centre completed an audit of 624 licensed UK gambling websites during 2026, and the results show that 86 percent of those sites committed at least one GDPR breach tied directly to cookie consent banners. The examination focused on how operators handle user data through tracking technologies, and it placed gambling platforms against broader UK web standards for privacy compliance.

Scope and Methods of the Examination

The audit covered a substantial portion of the licensed market, and it applied consistent criteria to each site to measure consent collection practices, data processing timing, and interface design elements. Observers note that the sample size allows patterns to emerge clearly across major operators and smaller platforms alike, while the methodology centered on real-world user interactions rather than self-reported policies.

Key Compliance Shortfalls Identified

Data collection before explicit consent appeared on two-thirds of the audited sites, and this practice included prominent operators such as Ladbrokes and William Hill. Sites in this group activated tracking cookies immediately upon page load, which means user information began moving to third parties before any choice was presented. Another 24 percent of sites offered no mechanism at all for users to turn off non-essential tracking, leaving visitors without practical control over their data flows.

Dark patterns appeared in 60 percent of the sample, and these took the form of highlighted buttons that steered users toward privacy-invasive default settings while downplaying or obscuring the option to reject tracking. Researchers documented how such designs guide decisions without removing the formal appearance of choice, and the patterns repeated across both desktop and mobile experiences.

Comparison With Other UK Website Categories

The same research team has examined consent mechanisms on non-gambling UK sites in earlier work, and the current findings indicate that gambling operators trail those benchmarks by a noticeable margin. General retail, news, and financial services platforms showed lower rates of pre-consent data collection and fewer instances of restrictive interface designs, according to the comparative data referenced in the study coverage. This gap persists even though gambling sites handle sensitive financial and behavioral information on a daily basis.

Regulatory Framework and Industry Context

GDPR requires clear, affirmative consent before personal data processing begins, and the Information Commissioner’s Office enforces these rules across UK organizations. The audit findings align with ongoing regulatory interest in how online platforms, including betting services, manage tracking technologies. Licensed operators already operate under Gambling Commission oversight, yet the cookie consent issues fall under separate data protection requirements that apply uniformly to all sectors.

Those who have reviewed the results point out that the identified practices affect millions of user sessions each month, given the high traffic volumes typical of major UK betting brands. The combination of early data collection, missing opt-out tools, and interface designs that favor acceptance creates cumulative exposure under current privacy statutes.

Conclusion

The Swansea University audit documents measurable shortfalls in how 86 percent of sampled UK gambling websites manage cookie consent under GDPR, with specific issues around pre-consent data gathering, absent rejection options, and prevalent dark pattern designs. The study places these operators behind compliance levels observed in other UK website categories, and the details provide a factual baseline for understanding current data handling practices in the sector.