Swansea University Audit Exposes Widespread GDPR Issues Across UK Gambling Websites

Researchers at Swansea University's GREAT Centre conducted a detailed audit of 624 licensed UK gambling websites, and the results highlighted significant problems with GDPR compliance in cookie consent banners along with data collection practices. The study found that 86% of these sites committed at least one breach, a figure that stands well above the 54% rate observed across general websites according to the same research framework. Data collection often began before users gave consent, and this pattern appeared on two-thirds of the examined platforms including major operators such as Ladbrokes and William Hill.

Key Findings from the Comprehensive Review

One major issue involved the absence of any option to disable tracking on 24% of the sites, which left users with limited control over their personal information. Manipulative design elements known as dark patterns also surfaced frequently, and these included pre-selected options that favored privacy-invasive settings by default. Observers note that such practices can steer users toward sharing more data than they intend, while the overall violation rate points to systemic gaps in how gambling operators handle consent mechanisms. The audit process involved systematic checks of banner functionality, consent flows, and backend data handling across the full sample of licensed platforms.

Comparison with General Website Standards

Across non-gambling websites the same audit methodology revealed a 54% breach rate tied to cookie and data issues, yet the gambling sector reached 86% under identical criteria. This gap suggests targeted challenges within the licensed UK market, where high volumes of user data and frequent interactions with consent tools may amplify exposure to regulatory shortfalls. Researchers documented each instance through direct site visits and technical analysis, confirming that problems extended beyond isolated cases to affect the majority of operators. Specific examples such as Ladbrokes and William Hill illustrated the pre-consent collection trend, while the lack of disable options appeared consistently across the 24% subset. The findings emerge from a single coordinated review rather than scattered reports, which allows for direct percentage comparisons that remain grounded in the same dataset.

Technical Details of the Identified Breaches

GDPR requires clear, informed consent before processing personal data, yet many banners bypassed this by initiating collection on load or through hidden scripts. No-option tracking affected 24% of sites, meaning users encountered banners that presented choices only for acceptance while omitting rejection pathways entirely. Dark patterns took forms such as highlighted "accept all" buttons paired with subdued reject links, or default settings that enabled third-party sharing without separate confirmation. These configurations appeared in enough cases to drive the overall 86% figure, and the audit captured variations across different device types and browsers to ensure robustness. The study also tracked how often data flowed to third parties before consent, adding precision to the two-thirds statistic for early collection. Such patterns align with broader observations of consent fatigue, although the gambling-specific sample showed elevated rates compared with general web traffic.

Context Within UK Regulatory Landscape

Licensed UK gambling websites operate under both gambling regulations and data protection rules, so GDPR breaches can intersect with existing compliance obligations. The audit focused solely on cookie and data collection elements, leaving other aspects of site operation outside its scope. Results indicate that a large proportion of platforms require adjustments to banner design, consent timing, and default settings to align with legal requirements. Data from the 624-site review provides a snapshot that regulators and operators can reference when assessing current practices. Because the violation rate exceeds the general web average by a substantial margin, the report draws attention to sector-specific implementation gaps without speculating on causes or remedies.

Conclusion

The Swansea University audit delivers clear metrics on GDPR compliance shortfalls among UK gambling websites, with 86% showing at least one issue in cookie consent and data handling. Pre-consent collection on two-thirds of sites, missing disable options on 24%, and dark pattern usage stand out as recurring problems that surpass the 54% benchmark for websites overall. These details, drawn directly from the review of 624 licensed platforms, offer a factual baseline for understanding current data privacy practices in this area.