A Swansea University study has raised privacy concerns across Great Britain’s online gambling market after auditing 624 casino and sports betting websites licensed by the Gambling Commission. Published on 14 September 2026, the study found that 86% of consent banners used at least one “dark pattern”, a design feature that can steer users towards accepting tracking.

The findings cover cookie banners, network traffic and customer consent. They are research findings, not a Gambling Commission enforcement decision against any named operator.

What the audit found

  • 67% of audited sites processed personally identifiable data before users gave consent.
  • 24% offered no way to reject tracking.
  • 2% displayed no consent banner at all, according to the university.
  • Only 29% made rejecting tracking as easy as accepting it.
  • Some websites required as many as 15 clicks to refuse tracking.

The study was published in Computers in Human Behavior Reports. Researchers said the audit covered all 624 gambling websites in the study’s Great Britain licensing sample.

Consent design influenced user behaviour

The researchers also tested six consent-banner designs with 615 UK online gamblers using a simulated betting website.

The most common design identified in the audit made participants three to four times more likely to accept tracking than a neutral alternative with a one-click choice.

Participants who accepted tracking rated their decision as a weaker reflection of their actual privacy preferences than those who rejected it. Researchers said the result suggested that the interface, rather than an informed choice, influenced the outcome.

The study raises questions about whether gambling customers receive a genuine choice before their data is shared with analytics and marketing platforms.

What the rules require

The Information Commissioner’s Office says non-essential cookies and similar tracking technologies generally require active, informed consent under the Privacy and Electronic Communications Regulations.

Users must receive clear information and a genuine way to refuse non-essential tracking. The ICO’s final storage and access technologies guidance was published on 29 April 2026.

The guidance covers cookies, tracking pixels, device fingerprinting and similar technologies. The UK General Data Protection Regulation may also apply when personal data is involved.

The ICO says valid consent must be freely given, specific and based on a clear positive action. Organisations should not make refusal harder than acceptance or set non-essential cookies before consent is obtained.

Why gambling data matters

Online gambling operators use customer information for identity checks, account security, fraud prevention, marketing and safer-gambling controls.

The Swansea researchers said behavioural data used to identify commercially valuable customers can overlap with signals associated with gambling harm.

That does not establish that any particular operator caused harm or broke the law. It does raise a compliance question for operators and suppliers using tracking, profiling or personalised marketing tools.

Separate legal frameworks

The audit relates to gambling websites licensed by the Gambling Commission in Great Britain, which covers England, Scotland and Wales. Northern Ireland operates under a separate gambling framework and is not part of the same licensing system.

The study does not announce a new rule, licence condition or penalty. Any formal investigation or enforcement action would need to come from the relevant regulator and would require separate evidence against an identified organisation.

What happens next

Operators face pressure to review whether their consent banners provide equally clear and usable choices. The findings also give privacy regulators a comparison between declared consent choices and tracking activity observed before consent.

For customers, accepting a betting site’s terms or opening an account does not automatically mean that every form of advertising or behavioural tracking has been accepted.

Non-essential tracking should be presented separately, with clear information and a refusal option that is no harder to use than acceptance.