Study finds 86% of licensed UK gambling websites appear to be breaching GDPR cookie and tracking rules

A peer-reviewed study by researchers at the University of Swansea's GREAT Centre, published this weekend, found that 86% of licensed British gambling websites appear to be flouting GDPR (the General Data Protection Regulation, the strict rules governing how organisations collect, store and process personal data) in their use of cookie consent banners. The research tested 624 gambling websites and found that nearly a quarter (24%) did not offer users the option to turn off tracking software at all. Operators in that group included Hollywood Bets and Admiral Casino. Two-thirds of operators began harvesting users' data before consent had been given, including well-known names such as Ladbrokes and William Hill. Researchers noted that some data collection before consent can be legitimate, for example to verify a customer is logging in from the UK, but the data in question was being transmitted to third-party analytics platforms used for marketing. A further 2% of sites offered no consent choice whatsoever, including Dafabet. The study also identified widespread use of so-called 'dark patterns': design choices that nudge users toward accepting data sharing. These included visual emphasis of the least privacy-friendly option (60% of sites), pre-selection of privacy-unfriendly settings by default (29%), and hiding the reject option behind a second click (47%). The same 86% of sites deploying such patterns were found to have committed at least one apparent GDPR breach, a materially higher non-compliance rate than the 54% figure found in broader cross-sector research. Ravi Naik, legal director at data protection specialist , described the findings as 'a picture of widespread and systemic non-compliance'. , is running a multi-year project to drive cookie and tracking compliance and claims to have brought 95% of the UK's top 1,000 websites into compliance, making the gambling sector's apparent lag particularly striking.