Swansea University Audit Exposes GDPR Shortfalls Across Hundreds of UK Gambling Platforms
Researchers at Swansea University's GREAT Centre completed a detailed review of 624 licensed UK gambling websites, and the results point to systemic problems with how these platforms handle cookie consent banners alongside broader data practices. The examination focused exclusively on sites holding UK licences, and it uncovered that 86 percent of them showed at least one breach tied to GDPR rules on consent and data processing.
Scope and Method of the Review
The audit covered a wide cross-section of operators active in the British market, and it examined consent mechanisms, data collection timing, and the presence of design elements that steer users toward certain choices. Observers note that the project took place against ongoing guidance from the Information Commissioner's Office, which has issued repeated reminders to all digital services about proper consent flows. Those who've studied similar compliance projects across other industries often discover that gambling operators face extra scrutiny because of the sensitive nature of user data they collect.
Primary Findings on Consent Failures
One quarter of the audited sites provided no mechanism at all for users to turn off tracking, while two-thirds began gathering personal information before any consent banner had been addressed. In many of those cases the data moved immediately to third-party marketing platforms, a step that violates the requirement for clear, informed agreement upfront. Researchers documented repeated instances of dark patterns, including boxes that defaulted to the most invasive settings and rejection paths that required multiple extra clicks compared with acceptance. Such patterns appeared consistently across desktop and mobile versions of the sites.
Comparison With Other Sectors
Data from the same research team shows that gambling platforms trail behind retail, news, and financial services websites in meeting the same GDPR benchmarks. The gap persists even though the Information Commissioner's Office has run targeted awareness campaigns aimed at high-risk industries. Figures reveal that the rate of full compliance in gambling sits noticeably lower than the average recorded in parallel audits of non-gambling domains during the same period.
Regulatory Context and ICO Involvement
The Information Commissioner's Office has published several updates on cookie rules since 2023, and those documents stress that consent must be freely given, specific, informed, and unambiguous. The Swansea findings indicate that many gambling operators continue to use banner designs that fall short of those standards. Experts have observed that enforcement actions in other sectors have prompted quicker fixes, yet the gambling industry has shown slower movement toward alignment. The study authors note that continued reliance on pre-checked boxes and hidden rejection links keeps the sector exposed to potential regulatory follow-up.
Technical Details Behind the Breaches
Analysis of the consent flows revealed that scripts often activated tracking cookies the moment a page loaded, regardless of user interaction with the banner. In cases where data reached third-party domains before consent, researchers traced the transmissions to common advertising and analytics providers. The audit also recorded how certain sites stored consent records in ways that made it difficult for users to withdraw permission later. These technical patterns combined to create the overall 86 percent non-compliance rate reported in the final summary.
Implications for Licensed Operators
Operators now face the task of reworking their consent interfaces to meet the documented shortcomings. Changes would typically involve adding clear toggles for every tracking category, delaying data collection until after an affirmative choice, and simplifying the path to reject all non-essential cookies. The study supplies a benchmark that regulators and compliance teams can reference when assessing future updates to site designs. Those who've examined earlier ICO interventions know that documented gaps like these often precede more structured reviews of individual operators.
Conclusion
The Swansea University audit supplies a clear snapshot of current practices among UK-licensed gambling sites, and the numbers highlight the distance still to travel before full GDPR alignment. With 624 sites examined and consistent patterns of non-compliance identified, the report offers operators and regulators a factual basis for next steps. Continued monitoring by the Information Commissioner's Office will determine how quickly the identified issues receive attention across the sector.