Swansea University Audit Exposes GDPR Shortfalls Across UK Gambling Platforms

Researchers at Swansea University’s GREAT Centre completed a systematic audit of 624 licensed UK gambling websites and documented that 86 percent appeared to breach GDPR requirements through their cookie consent mechanisms. The project examined how these sites presented data collection choices to visitors and tracked whether consent was obtained before any information moved to third parties. Data collection often began immediately upon page load, with two-thirds of the platforms sending details to marketing partners before users had a chance to respond to the banner.

Scope and Method of the Audit

The team selected only sites holding active UK gambling licences, which created a focused sample drawn directly from the regulated sector. Each site received evaluation on banner design, default settings, and the presence of any pre-consent data transfer. Observers recorded whether options to reject tracking existed at the same prominence as acceptance buttons and noted the use of interface elements that steered users toward broader data sharing. The audit occurred ahead of September 2026, when several updated enforcement timelines for digital privacy across the UK are scheduled to begin.

Principal Findings From the Review

Results showed that 24 percent of the examined sites provided no functional way to turn off tracking cookies at all. Across the remaining platforms, many banners employed design techniques that placed the acceptance option in a more visible position while hiding or complicating the rejection path. These interface patterns appeared in a large majority of the non-compliant examples, and they produced measurable differences in user choices during follow-up testing. The overall non-compliance rate of 86 percent stood notably higher than the 54 percent figure recorded in earlier studies that covered general web domains rather than the gambling sector alone.

One section of the audit tracked data flows in real time and confirmed that user identifiers reached external marketing platforms seconds after the page rendered on two-thirds of the sites. This occurred regardless of whether the visitor had interacted with the consent banner. Such timing directly conflicts with GDPR stipulations that require affirmative consent before processing begins.

Regulatory Context and Next Steps

UK data protection rules, aligned with GDPR standards, place responsibility on site operators to demonstrate valid consent. The Information Commissioner’s Office has previously issued guidance on dark patterns and pre-ticked boxes, both of which surfaced repeatedly in the Swansea sample. Licensed operators must maintain records showing how consent was collected and must allow users to withdraw permission with the same ease it was given. The audit findings supply regulators with a sector-specific dataset that can inform targeted compliance checks in the months ahead.

Those reviewing the results have noted that many banners used layered menus requiring multiple clicks to reach rejection settings, while acceptance required only one. This structural difference appeared across hundreds of sites and contributed to the elevated violation count. The study also recorded instances where cookie categories were labelled in ways that obscured their marketing purpose, further complicating informed decisions.

Conclusion

The Swansea University audit supplies concrete numbers on consent banner performance within the UK gambling market and places those figures against earlier general-web benchmarks. With 86 percent of the 624 audited sites showing at least one apparent GDPR issue, the data point to systematic shortcomings in current implementations. Operators now hold the details needed to adjust banner architecture before the next round of regulatory reviews begins. The published paper offers additional experimental evidence on how small design changes affect user behaviour, giving both regulators and site owners measurable reference points for future compliance work.