A Swansea University study has intensified privacy scrutiny of gambling websites serving Great Britain after researchers audited 624 sites licensed for the market.

The audit found that 86% of the sites displayed at least one “dark pattern”. These designs can make the privacy-friendly choice less visible or harder to select.

Researchers also reported that 24% offered no way to reject tracking. They found that 67% processed personally identifiable data before users gave consent.

The findings are research evidence, not an enforcement decision against every operator examined.

Only 14% of the sites appeared to meet all the requirements assessed by the researchers. The study was published in 2026 in Computers in Human Behavior Reports. It examined website practices rather than the legal liability of individual operators.

What the audit found

The research examined consent banners shown when users first entered gambling websites. These banners ask visitors whether they agree to cookies and other technologies used for analytics, advertising or personalisation.

  • 86% of sites showed at least one dark pattern.
  • 24% offered no option to reject tracking.
  • 67% processed personally identifiable data before consent.
  • 14% appeared to meet all requirements assessed by the researchers.

The study also included a controlled online experiment involving 615 participants. Researchers said the most common banner design increased acceptance of tracking and made users’ decisions less consistent with their stated preferences.

The experiment found no association between banner decisions and self-reported gambling harm severity.

Why gambling data carries added risk

Gambling websites collect data for several lawful purposes. These can include account security, age and identity checks, anti-money-laundering controls, fraud prevention and confirmation that a customer is located in an allowed market.

The study’s central concern is data collected for tracking, analytics and marketing before users make a valid choice. Researchers said third-party analytics platforms received data from some websites before consent was recorded.

The Guardian reported that the audit identified pre-consent data collection on sites associated with major operators. It also stressed that the study did not establish that every named company had broken the law.

Entain told The Guardian that data collected before consent was not used for advertising or marketing. Evoke declined to comment, according to the report.

Regulators face renewed questions

The Information Commissioner’s Office enforces data protection law and rules covering cookies and similar technologies. Its final storage and access technologies guidance, published on April 29, 2026, says organisations must provide meaningful control over non-essential tracking and obtain valid consent where required.

The ICO has already taken action in the gambling sector. In September 2024, it reprimanded Bonne Terre Limited, trading as Sky Betting and Gaming, after finding that advertising cookies processed personal information before users could accept or reject them.

The case was a regulatory reprimand, not a financial penalty.

The Gambling Commission regulates licensed gambling in Great Britain. It does not determine whether a company has complied with data protection law.

Its guidance states that the ICO handles GDPR interpretation and case-by-case data protection issues. Gambling operators remain responsible for meeting both legal and licensing requirements.

What happens next

The Swansea findings do not announce an investigation, fine, licence suspension or final enforcement decision. Any action against an operator would require separate evidence and a formal assessment by the relevant regulator.

Operators may now face pressure to review whether their consent banners offer equally visible choices and whether tracking begins before consent. They may also need to examine whether third-party analytics tools receive information for marketing purposes.

For players in Great Britain, the audit raises a direct question about whether clicking “accept” reflects a free and informed choice.

For regulators, the research provides a large-scale test of whether website compliance work is reaching a sector that handles sensitive behavioural data and operates under separate gambling rules.