Study finds widespread cookie-banner GDPR issues across UK gambling sites

A new academic study has raised fresh privacy and consumer-protection questions for Britain’s online gambling sector after researchers found widespread problems with cookie consent banners across UK-licensed gambling websites.

Researchers at Swansea University’s GREAT Centre audited 624 gambling websites licensed for the British market. According to the study, published in Computers in Human Behavior Reports, 86% of the cookie banners examined contained at least one “dark pattern” — a design choice that can steer users towards accepting tracking rather than making a neutral privacy choice.

The researchers also identified practices they considered inconsistent with data-protection requirements. Around 24% of the websites did not provide an option to reject tracking, while 67% processed personally identifiable data before the user had given consent. The paper reports that only 14% of the audited sites were compliant with the GDPR criteria used in the study.

The findings were reported by The Guardian on 6 September 2026 and come as the UK Information Commissioner’s Office continues a wider programme of cookie and online-tracking enforcement.

What the researchers found

The study, titled Consent banners, dark patterns, and GDPR infringements in online gambling: Evidence from a systematic audit and online experiment, examined how gambling websites ask users for permission to collect and process data.

The audit found several recurring forms of consent design that can make rejecting tracking less prominent or more difficult than accepting it. The researchers reported that 60% of the sites visually emphasised the less privacy-friendly option, 29% used privacy-unfriendly defaults, and 47% placed the reject option behind an additional layer of the banner.

These design features are often described as dark patterns because they can influence a user’s decision without removing the appearance of choice.

The researchers also ran an online experiment with 615 participants using simulated gambling-platform consent banners. The most common banner design identified in the audit significantly increased acceptance of tracking and reduced the alignment between users’ stated privacy preferences and the choices they actually made.

That second part of the research is important because it moves beyond simply cataloguing website design. It suggests that the way a consent banner is structured can materially change user behaviour.

Why this matters for online gambling

Privacy and gambling regulation increasingly overlap because online operators can collect detailed behavioural information about how customers browse, deposit and play.

The Swansea researchers argue that consent design should therefore be treated as a consumer-protection issue as well as a privacy issue. Their concern is that behavioural data may be used to personalise engagement in a sector where some patterns of intensive play can also be associated with gambling harm.

The study does not claim that every use of customer data is unlawful, nor does it establish that every operator intentionally targets vulnerable players. It does, however, identify widespread consent practices that the authors say fail to meet expected privacy standards.

That distinction matters. The findings are an academic audit of website behaviour, not a set of enforcement decisions against 624 individual operators.

ICO has already tightened cookie enforcement

The Information Commissioner’s Office has spent several years increasing scrutiny of cookie banners and online tracking.

In December 2025, the ICO said more than 95% of the UK’s 1,000 most visited websites had passed its cookie-compliance checks after regulatory intervention. In April 2026, when publishing updated guidance on storage and access technologies, the regulator said 99% of those top 1,000 sites were meeting its cookie-banner compliance standards.

The ICO’s current guidance covers cookies, tracking pixels, device fingerprinting and related technologies under the Privacy and Electronic Communications Regulations and, where applicable, UK GDPR.

The regulator has previously taken action in the gambling sector. In September 2024, it reprimanded Sky Betting and Gaming after finding that advertising cookies had processed users’ personal information before consent. The ICO said at the time that it found no evidence the company had deliberately misused the data to target vulnerable gamblers.

Against that background, the Swansea findings suggest that gambling-specific websites may be lagging behind the broader group of high-traffic UK sites that the ICO has already pushed towards compliance.

What happens next

The study does not itself trigger fines or licence action. Any formal finding that a specific operator has breached UK privacy law would need to come from the relevant regulator or court process.

The ICO told The Guardian that it remains committed to monitoring compliance across the UK’s most visited websites and will take action where necessary to protect people’s information rights.

For gambling operators, the practical issue is likely to be whether consent interfaces give customers a genuinely fair choice, whether non-essential tracking begins before consent, and whether rejecting tracking is as straightforward as accepting it.

For players, the research is a reminder that cookie banners are not merely technical pop-ups. They can determine how much behavioural information is collected and how that information may later be used.

Sources

• Swansea University repository: Consent banners, dark patterns, and GDPR infringements in online gambling
• The Guardian, 6 September 2026: Online bookies accused of UK privacy breaches with use of cookie banners
• Information Commissioner’s Office, 29 April 2026: Final storage and access technologies guidance published
• Information Commissioner’s Office, 17 September 2024: Action taken against Sky Betting and Gaming for using cookies without consent