The headline figure of 86 percent non-compliance conceals a range of distinct violations, each of which carries its own legal weight under European and British data protection law. Two-thirds of the audited sites, 67 percent, began collecting personally identifiable information before users had given any consent at all, transmitting unique user identifiers to third-party analytics and marketing platforms. Under the GDPR and the UK GDPR, consent must be obtained before non-essential cookies are placed on a user’s device, so this practice constitutes a direct infringement rather than a technicality. In effect, the most commercially valuable data flows were already underway while the consent banner was still sitting on the screen, unread and unclicked.

Denial of choice was another widespread problem. Almost a quarter of the sites, 24 percent, offered users no way to refuse tracking whatsoever, and 2 percent displayed no consent banner at all, despite the legal requirement to do so. Even where a reject option technically existed, exercising it could be an ordeal. Only 29 percent of banners allowed users to reject tracking as easily as they could accept it, and on some sites it took as many as fifteen clicks to refuse consent, compared with the single click required to accept. The asymmetry is not subtle. A user who wants to protect their privacy must navigate layered menus and buried settings, while a user willing to be tracked resolves the interaction instantly.

The study catalogued these manipulative layouts under the umbrella term dark patterns, a phrase coined in user-experience research to describe interface designs that steer people toward choices they would not otherwise make. The audit found most banners employed at least one such technique. Visual emphasis of the accept button appeared on 60 percent of sites, making the compliant option the most eye-catching element on screen. Hiding the reject option behind a second layer of navigation occurred on 47 percent of sites, and 29 percent pre-selected privacy-unfriendly settings, requiring users to actively untick boxes to protect themselves. Each of these designs exploits well-documented quirks of human cognition, including the tendency to click prominent, brightly coloured buttons and to accept default options rather than modify them.

To test whether these designs actually change behaviour, rather than merely correlating with poor privacy outcomes, the researchers conducted a controlled online experiment. A sample of 615 UK online gamblers were presented with a simulated betting website carrying one of six different consent banners. The design most commonly used across the gambling industry made participants three to four times more likely to accept tracking than a neutral, one-click alternative. This is a striking effect size for a single interface element, and it demonstrates that the industry’s dominant banner style is not a passive or accidental feature. It functions, in the researchers’ framing, as an active nudge toward the least private option available.

Perhaps the most revealing result concerned how participants felt about their own decisions. Those who accepted tracking rated their choice as a far poorer reflection of their real privacy preferences than those who rejected it, scoring the alignment at 4.4 out of 10 compared with 7.9. In other words, people who accepted tracking under the industry-standard design knew, at some level, that the decision did not represent what they actually wanted. The design, rather than the user, was driving the outcome. Notably, the effect was the same regardless of participants’ level of gambling risk, meaning that both recreational gamblers and those at elevated risk of harm were equally susceptible to the manipulative layouts.

Under GDPR standards, consent is only valid when it is freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give. A consent obtained through a design that makes refusal disproportionately difficult arguably fails the freely given test, which is why the researchers characterise the overwhelming majority of audited sites as non-compliant rather than merely unfriendly. Regulators including the UK Information Commissioner’s Office have previously warned against consent banners that nudge users toward acceptance, but this study provides the first systematic, industry-wide quantification of the problem within gambling, a sector whose business model depends heavily on data-driven customer acquisition and retention.

The stakes extend well beyond data protection compliance. The researchers argue that the data harvested through these designs underpins the personalised marketing and cross-web tracking of gambling customers, and that the characteristics used to identify commercially valuable players overlap substantially with the behavioural markers of gambling harm. In practical terms, the same signals that flag someone as a profitable target, such as frequent sessions, rapid betting patterns and responsiveness to promotions, are also the signals associated with problematic play. Professor Simon Dymond, who supervised the research alongside Dr Martyn Quigley and Dr Jamie Torrance, noted that the behavioural data being harvested is not neutral, and that getting consent right is not just a data protection issue for the industry but an important part of preventing gambling harm.

Jack McGarrigle, the PhD student who led the study, described the audit’s findings as stark, observing that most sites are not giving customers a fair choice about tracking, with some making it a single click to accept and up to fifteen to refuse. He added that the follow-up experiment showed the effect is not incidental, and that the banners work exactly as one would expect, nudging people toward decisions they do not actually agree with. The transparency of the research itself is notable: the data, pre-registration materials and screenshots of all 624 audited sites have been made publicly available through the Open Science Framework, allowing other researchers, regulators and journalists to verify the findings independently.

The study arrives at a moment of intensifying scrutiny of both the gambling industry and the digital advertising ecosystem that sustains it. As regulators weigh how to enforce consent rules against operators whose interfaces are built to circumvent them, the Swansea findings supply a detailed evidentiary baseline: a complete census of a regulated national market, a taxonomy of the dark patterns in use, and experimental proof that those patterns shift real decisions. Whether the response takes the form of enforcement action, mandatory interface standards, or redesign of the consent framework itself, the research makes clear that the current system, in which nine in ten licensed operators fail to offer a fair choice, is not a marginal compliance gap but a structural feature of how the online gambling industry acquires its data.

Subject of Research: GDPR compliance and dark-pattern cookie consent design on UK online gambling websites

Article Title: Nine in 10 UK gambling websites breaching data privacy law, study finds

Article References: Nine in 10 UK gambling websites breaching data privacy law, study finds. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: GDPR, online gambling, cookie consent, dark patterns, data privacy, Swansea University, Gambling Commission, behavioural experiment, gambling harm, digital tracking, consent banners, UK regulation