Swansea University Research Exposes GDPR Violations in Cookie Banners Across UK Gambling Sites

Researchers at Swansea University conducted an audit of 624 licensed UK gambling websites and found that 86 percent maintained cookie consent banners that violated GDPR requirements, a figure that stands well above the 54 percent rate identified in a wider examination of websites across sectors. The analysis focused specifically on how these platforms handled user data through their consent mechanisms and revealed several recurring problems that affected the majority of the sites reviewed.

Two-thirds of the audited platforms began collecting user data before any consent had been secured, and examples included major operators such as Ladbrokes and William Hill. In addition, 24 percent of the sites offered no functional option for users to disable tracking, while 2 percent provided no consent choice whatsoever. Observers note that these practices directly conflict with GDPR rules that require clear, affirmative consent prior to data processing and that grant individuals control over whether tracking occurs.

Patterns of Non-Compliance Identified in the Audit

The research team documented widespread use of dark patterns, including pre-selected settings that favored invasive data collection options by default. These design choices steered users toward accepting broader tracking without requiring an active decision, which researchers flagged as a systematic issue across the sample. The study also recorded instances where consent banners obscured or complicated the path to declining cookies, further limiting user autonomy in line with regulatory expectations.

Data collection before consent emerged as the most prevalent violation, touching roughly 66 percent of the 624 sites. This practice means personal information entered systems immediately upon page load, regardless of whether visitors had reviewed or approved the banner. The absence of an opt-out mechanism on nearly a quarter of the platforms compounded the problem, leaving users without any practical route to prevent tracking cookies from activating.

Scale and Specific Examples from the Findings

With 624 sites under review, the 86 percent violation rate translates to more than 500 platforms displaying banners that fell short of GDPR standards. The research highlighted that even when banners appeared, many failed to meet basic criteria for informed consent because they either activated tracking automatically or buried refusal options behind multiple clicks. Ladbrokes and William Hill served as concrete cases where data gathering preceded any user interaction with the consent interface.

teh 2 percent of sites lacking any consent option represented a smaller but notable subset where visitors encountered no mechanism to register preferences at all. Meanwhile the 24 percent without a disable-tracking choice meant that even users who reached the banner could not prevent ongoing data collection. Researchers connected these shortfalls to broader patterns of dark patterns that prioritize data acquisition over compliance.

Comparison to Broader Website Studies

The Swansea findings place the gambling sector at a markedly higher violation rate than the 54 percent recorded in a separate study covering websites more generally. This gap suggests that licensed gambling platforms may face distinct pressures or technical setups that increase the likelihood of non-compliant consent flows. The research team presented these numbers side by side to illustrate how sector-specific practices can diverge from wider industry benchmarks.

According to the audit results, the combination of pre-consent data collection, missing opt-out functions, and default invasive settings created a consistent picture of non-compliance. The study did not extend into enforcement actions or operator responses, yet the raw percentages supply regulators and platform operators with a clear baseline for evaluating current banner configurations.

Conclusion

The Swansea University audit supplies concrete figures on GDPR compliance gaps within the UK gambling sector, showing that 86 percent of 624 examined sites maintained cookie banners with at least one violation. Pre-consent data collection affected two-thirds of the sample, while the lack of disable options on 24 percent and complete absence of consent choices on 2 percent added further layers of concern. Dark patterns such as pre-selected tracking settings appeared throughout the results, and the overall rate exceeded the 54 percent benchmark from broader research. These documented outcomes provide a factual record of current banner practices on licensed UK gambling websites. Study auditing 624 UK gambling sites on cookie consent and GDPR compliance