Swansea University Audit Uncovers GDPR Breaches on Hundreds of UK Gambling Sites

Researchers at Swansea University completed an audit of 624 licensed British gambling websites and identified that 86 percent had committed at least one GDPR breach connected to cookie consent banners, while the findings highlight several consistent patterns across the sector. The examination focused on how these platforms handle user data collection through tracking technologies and consent mechanisms, and the results point to widespread practices that fall short of regulatory standards for privacy protection.

Key Findings from the Comprehensive Review

Data collection occurred before users provided consent in roughly two-thirds of the audited sites, and in many instances the information moved directly to third-party marketing platforms without any prior agreement from visitors. Observers note that this approach bypasses the core requirement under GDPR that personal data processing must rest on a valid legal basis established upfront. Another 24 percent of the websites offered no mechanism at all for users to turn off tracking, which leaves individuals without the control that data protection rules demand.

Dark patterns appeared frequently as well, including pre-selected options that favor more invasive data sharing and interfaces designed to make rejection of cookies more cumbersome than acceptance. These design choices create friction that steers users toward broader consent, and the audit documented such elements across a substantial portion of the reviewed platforms. The study also flagged that some banners failed to provide clear information about what data gets collected or how it travels to external parties.

Major Operators Named in the Audit

Several well-known betting companies appeared among those flagged during the review, including Ladbrokes, William Hill, Hollywood Bets, and Admiral Casino. Each of these operators maintains a significant presence in the UK market, and their inclusion in the results underscores that the issues extend beyond smaller or lesser-known sites. The audit treated all 624 websites equally in its methodology, applying the same criteria regardless of company size or brand recognition.

Further analysis revealed that the breaches clustered around similar technical setups, where cookie scripts activated immediately upon page load and transmitted identifiers to multiple domains before any banner interaction took place. Researchers documented cases where even the initial visit triggered data flows to advertising networks and analytics providers without recorded consent.

Context Around Cookie Consent Requirements

GDPR and the associated ePrivacy rules establish that websites must obtain affirmative consent before storing or accessing information on a user's device through cookies that are not strictly necessary for service delivery. The Swansea University team measured each site against these benchmarks by simulating user visits and recording banner behavior, data transmission timing, and available user controls. Results indicated that many platforms relied on implied consent models or buried rejection paths behind multiple clicks, both of which conflict with the emphasis on freely given and informed agreement.

What's notable is how the same patterns repeated across different operators, suggesting shared technology providers or template solutions that embed non-compliant defaults. The audit captured these details through systematic testing rather than self-reported data, which adds a layer of direct observation to the reported statistics.

Broader Implications for the Industry

Those who have examined similar compliance exercises in other sectors recognize that gambling websites face particular scrutiny because they process sensitive financial and behavioral data at scale. The Swansea findings arrive at a moment when data protection authorities continue to issue guidance on cookie practices, and the audit supplies concrete figures that regulators can reference when evaluating enforcement priorities. Figures from the study show that the majority of sites require adjustments to their consent flows to align with current expectations.

According to coverage in independent outlets that summarized the research, the audit team plans to share detailed methodology so other researchers can replicate aspects of the work. This transparency allows for ongoing monitoring as websites update their banners and tracking configurations over time.

Conclusion

The Swansea University audit provides a clear snapshot of current practices on licensed British gambling websites, documenting that 86 percent of the 624 examined sites showed at least one GDPR-related issue tied to cookie consent. Specific problems range from pre-consent data collection and absent opt-out options to interface designs that complicate user choice. Major operators stand among those identified, and the consistency of the findings across the sample points to systemic challenges in how consent mechanisms are implemented. The data offers regulators and site operators a factual basis for reviewing and refining existing approaches to privacy compliance.