A study has found that nearly nine out of 10 (86%) licensed British gambling websites appear to be flouting the General Data Protection Regulation (GDPR), according to research by Swansea University’s GREAT Centre. The findings focus on the use of cookie banners, which appear when users first visit a website and ask for permission to collect data. The study highlights that many gambling sites are not meeting GDPR requirements, which govern how organizations can collect, store, and process personal data.

The Information Commissioner’s Office (ICO), Britain’s data privacy regulator, is working on a multi-year project to ensure websites comply with GDPR cookie and tracking rules. It claims to have forced 95% of the top 1,000 websites in the UK to comply. However, the Swansea study found that major gambling operators are lagging behind. Nearly a quarter (24%) of 624 tested gambling websites did not offer an option to turn off tracking software, which allows advertisers to follow users and target them with personalized marketing. Sites like Hollywood Bets and Admiral Casino were among those that failed to provide this option.

The study also found that two-thirds of operators began harvesting users’ data before they had given consent. This includes well-known operators such as Ladbrokes and William Hill. While operators are allowed to collect data for legitimate reasons, such as verifying a customer’s location, researchers noted that data was being sent to third-party analytics platforms used for marketing. Of the websites studied, 2% offered no consent choice at all, including Dafabet, the sponsor of Celtic FC.

Researchers also identified that the vast majority of bookies and online casinos use “dark patterns” to nudge users toward accepting data sharing. These include visual emphasis on the least privacy-friendly option (60%), default pre-selection of privacy-unfriendly settings (29%), and hiding the reject option behind a second layer (47%). While such patterns do not necessarily constitute breaches, 86% of websites that feature them appear to have committed at least one GDPR breach, a significantly higher proportion than the 54% found in a previous study of all websites.

Ravi Naik, legal director at data protection specialist AWO, stated the report’s findings “paint a picture of widespread and systemic non-compliance.” He criticized the ICO for not taking meaningful enforcement action against the online gambling sector. AWO has previously acted for the campaign group Clean Up Gambling, which raised concerns with the ICO about gambling firms’ compliance. In 2024, SkyBet was reprimanded by the ICO for unlawfully sharing users’ data with advertising companies, though it was not among those claimed to have breached GDPR in the Swansea study. The study’s authors noted that the goal of collecting users’ data was “maintaining engagement and consumer losses.”