A large-scale audit of licensed UK gambling websites has put cookie consent, behavioural tracking and consumer privacy firmly back in focus. Researchers connected with Swansea University examined 624 gambling websites and found that many consent journeys appeared to make it easier to accept tracking than to refuse it.
The findings matter because online gambling data can reveal detailed patterns of behaviour. Visits, time spent on a service, movement between games or betting products, and responses to promotions can collectively create a rich picture of a person’s online activity. For an industry built around digital accounts, personalised services and measurable engagement, privacy choices need to be clear, meaningful and respected from the outset.
Importantly, the research also points to a practical opportunity. Better consent design can help gambling operators build trust, reduce compliance risk and give customers greater confidence that their choices genuinely control how non-essential data is used. Fairer privacy practices are not simply a legal box-ticking exercise; they can become a visible marker of a more responsible digital experience.
What the Swansea University audit found
The research, associated with Swansea University’s Gambling Research, Education and Treatment Centre, combined a website audit with an experiment involving 615 participants. The peer-reviewed study was published in Computers in Human Behavior Reports.
Across the 624 licensed British gambling websites reviewed, the researchers identified several significant concerns:
- 86% of cookie banners used at least one dark pattern, meaning a design feature that could steer users toward accepting tracking.
- 24% of websites provided no option to reject tracking through their consent interface.
- 67% of websites processed personally identifiable data before consent had been obtained.
- Only 14% of websites met all of the GDPR-related requirements assessed by the researchers.
These figures do not suggest that every cookie or every form of data processing is inherently inappropriate. Some technologies are necessary to make a website work, protect accounts, remember essential settings or support security. The central issue is whether optional analytics and advertising activity begins only after a person has been given a genuine, understandable choice.
Why cookie-banner design can influence privacy decisions
A cookie banner may look like a small part of a website, but its design can shape an important decision. A person arriving at a gambling platform may be focused on checking account information, viewing sports markets, playing a slot machine online or reviewing promotions. In that moment, an intrusive or confusing banner can encourage the fastest available route rather than a considered privacy preference.
The study focuses on dark patterns: interface choices that nudge people toward a particular outcome. In a consent setting, these may include a bright, prominent Accept all button paired with a less visible rejection option, a refusal route that requires several extra steps, or wording that makes the consequences of declining unclear.
The associated experiment found that participants exposed to the most common banner type identified in the audit were more likely to accept tracking, even when that decision did not match their previously stated privacy preferences. This is a meaningful finding because it shows that consent is affected not only by the presence of a button, but also by the fairness and usability of the entire choice architecture.
Consent works best when accepting and rejecting optional tracking are equally clear, equally accessible and equally easy to complete.
Why gambling data deserves particular care
All consumers deserve transparent privacy choices, but gambling websites present a particularly important context. Behavioural information gathered through a platform can go beyond a simple record of product interest. Depending on the systems involved, data may reflect how frequently a person visits, when they engage, how they navigate between products and how they respond to personalised advertising or promotions.
That does not mean every data point is sensitive in a legal sense. However, in combination, browsing and usage patterns may produce detailed inferences about an individual’s behaviour. This is why clear boundaries around analytics, advertising technology and third-party data sharing are especially valuable in the gambling sector.
When users can readily understand what is essential for the service, what is optional, and what happens if they agree, they are better positioned to make choices that reflect their own preferences. That transparency supports a more respectful relationship between an operator and its customers.
The visible website and the tracking layer behind it
Online gambling services often have two interconnected layers. The visible layer includes the pages and tools customers intentionally use: account settings, sports betting markets, game catalogues, payment journeys, safer-gambling information and promotional offers. The less visible layer can include consent-management tools, analytics scripts, advertising technologies and third-party services that help measure activity or tailor marketing.
The Swansea University research directs attention to this second layer. A person may see a straightforward website interface while, behind the scenes, technologies are attempting to collect information about how that person interacts with the service. Where processing is non-essential, the timing and quality of consent become central questions.
For responsible operators, this creates a clear opportunity to map every technology operating on their sites, identify its purpose and ensure that optional tools do not activate before the relevant permission is obtained. A well-governed tracking environment can make privacy management more accurate, auditable and easier to explain to customers.
What meaningful consent should look like
Meaningful consent is more than displaying a banner. It should give people a real opportunity to choose without being pressured by colour, placement, wording or unnecessary friction. While the exact compliance assessment depends on the circumstances and applicable rules, a user-centred approach has several practical characteristics.
Clear choices at the first layer
Users should be able to see a simple route to accept optional tracking and a similarly simple route to reject it. If accepting takes one click but refusing requires several screens, the journey risks communicating that one choice is preferred.
Plain-language explanations
Cookie categories and data purposes should be described in language that ordinary users can understand. Terms such as analytics, personalisation and advertising should be explained with enough detail to help people make an informed decision.
Separation between essential and optional technologies
Necessary cookies may support core functions such as security, fraud prevention, account sessions and user-requested services. Optional analytics and advertising tools should be distinguishable from those essential functions, so customers do not feel that they must approve all tracking to use the site.
Respect for the decision before processing begins
Where consent is required for non-essential tracking, the systems involved should be configured so that data collection does not start before the person has made a choice. This requires close coordination between web teams, privacy specialists, marketing teams and technology vendors.
Easy ways to revisit preferences
A strong consent experience does not end after the initial banner disappears. Users should be able to find and change their privacy preferences without having to search through complex account pages or repeat a difficult journey.
Practical benefits of improving consent practices
Improving cookie consent can deliver benefits well beyond responding to regulatory attention. It can strengthen the quality of a gambling brand’s overall digital experience.
| Improvement area | Potential benefit |
|---|---|
| Equal prominence for acceptance and rejection | Helps customers make a choice that better reflects their genuine preference. |
| Pre-consent controls for optional scripts | Supports more disciplined data governance and reduces the risk of unintended processing. |
| Clear cookie explanations | Builds customer understanding and can reduce confusion around data use. |
| Regular vendor and tag reviews | Helps operators identify unnecessary trackers and improve oversight of third parties. |
| Accessible preference-management tools | Allows users to remain in control as their comfort level or circumstances change. |
Trust is particularly valuable in online gambling. Customers are being asked to create accounts, provide personal details and use payment methods within a highly regulated environment. A transparent approach to data choices can reinforce the message that the operator takes responsible service seriously across every part of the customer journey.
Third-party analytics and advertising need stronger oversight
The audit also renews attention on third-party technologies. Gambling operators may use external providers for audience measurement, marketing attribution, advertising delivery, fraud prevention, consent management and other operational functions. These tools can be useful, but they also make governance more complex.
A consent banner alone cannot solve a tracking problem if tags are misconfigured, vendors are not properly assessed or scripts load before a user has made a decision. Effective privacy practice requires a complete view of the website’s technology stack.
Useful operational steps can include:
- Creating and maintaining a detailed inventory of cookies, pixels, scripts and software development kits.
- Documenting the purpose of each technology and whether it is essential or optional.
- Testing the site before and after consent to verify that optional tags do not activate prematurely.
- Reviewing third-party arrangements and ensuring vendors receive only the data needed for the agreed purpose.
- Checking mobile, desktop and account-login journeys, since consent behaviour can vary across platforms.
- Repeating reviews whenever marketing, analytics or website-development changes are introduced.
These measures can turn privacy from a one-time implementation project into an ongoing standard of digital quality.
Regulatory attention is already part of the picture
UK privacy regulators have previously taken action involving gambling operators and advertising cookies where personal information was processed before users had the opportunity to accept or reject that processing. The Swansea University findings suggest that the issue may extend across a wider group of licensed websites.
The research arrives amid broader scrutiny of manipulative interface design across digital services. Regulators and consumer advocates increasingly recognise that a technically available choice is not necessarily a meaningful one if the design heavily favours one outcome.
For gambling operators, this means that a privacy strategy should consider both legal requirements and the practical experience of the person using the website. The strongest approach is not to ask, “Is there a consent banner?” but rather, “Can a customer make a free, informed and equally easy choice?”
A positive path forward for the gambling industry
The audit presents a clear challenge, but it also offers a constructive route forward. Gambling businesses that simplify rejection routes, stop optional tracking before consent, improve explanations and audit third-party technologies can create a stronger standard for the sector.
There is a meaningful commercial and reputational advantage in being easy to trust. Customers increasingly expect digital services to be transparent about how data is collected and used. An operator that makes privacy controls visible, understandable and fair can differentiate itself through responsible design rather than relying on complexity or default acceptance.
Better consent practices can also support internal teams. When marketing, technology, compliance and customer-service functions work from a shared inventory of tracking tools and data purposes, organisations can make faster decisions, answer customer questions more confidently and adapt more effectively to changing expectations.
Key takeaway
The Swansea University study found widespread weaknesses in cookie consent and privacy practices among licensed UK gambling websites. With 86% of audited banners containing at least one dark pattern, 24% lacking a rejection option, and 67% processing personally identifiable data before consent, the research highlights a substantial gap between the idea of consent and the reality of many online journeys.
Closing that gap is achievable. Fairer banner design, equal-choice interfaces, careful management of analytics and advertising technologies, and stronger oversight of third parties can give users more control while helping operators build lasting trust. In a data-driven industry, privacy-respecting design is an opportunity to improve both customer confidence and responsible digital standards.
