Eight in Ten UK Gambling Sites May Be Breaking Privacy Law, Study Finds

Key points

• 86% of licensed British gambling websites appear to be breaching GDPR, the UK's main data privacy law, according to new research.
• Sites are accused of harvesting tracking data from visitors before those visitors click "accept" on cookie banners.
• GDPR, which came into force in May 2018, requires organisations to obtain clear consent before collecting most categories of personal data.
• Researchers describe the practice as "data surveillance" of customers.
• The findings raise questions about regulatory enforcement at a time when the UK Gambling Commission and the Information Commissioner's Office both claim oversight of the sector.

Most of us have clicked past a cookie banner without reading it. It turns out that, for many gambling websites, that click may already be too late.

New research, first reported by The Guardian, examined licensed British online bookmakers and casinos and found that roughly 86% of them appear to be collecting tracking data, meaning small files that follow your activity across the web, before the visitor has given any consent at all. Under GDPR (the General Data Protection Regulation, the strict EU-derived law the UK kept after Brexit that governs how companies gather, store and use personal information), that collection is not lawful.

What exactly is the problem?

The core rule is straightforward. GDPR Article 7 requires that consent be "freely given, specific, informed and unambiguous" before personal data is processed. Collecting tracking data the moment someone lands on a page, before they have touched the consent banner, violates that standard on its face.

Researchers found that many sites also design their cookie banners to nudge visitors toward accepting everything. Pre-ticked boxes, buried "reject" options, and misleading button colours are among the tactics documented. The UK's data regulator, the Information Commissioner's Office (ICO), issued guidance on exactly these "dark patterns" in 2022, making clear they do not produce valid consent.

What does this mean for people who use these sites?

Practically speaking, it means gambling companies may hold a richer profile of your browsing habits than you agreed to share. That data can be used to personalise advertising, assess your spending patterns, or be sold to third-party data brokers.

If you use online gambling sites, it is worth checking the site's privacy settings after you log in rather than relying on the banner you saw when you first arrived. You can also request a copy of the data a company holds on you under GDPR Article 15, the "right of access", which all UK-based controllers must honour within one calendar month.

Why does enforcement matter here?

The ICO has the power to fine organisations up to £17.5 million or 4% of global annual turnover (whichever is higher) for serious GDPR breaches, under Section 157 of the Data Protection Act 2018. Yet the gambling sector has so far attracted little formal ICO action on cookie compliance specifically.

The study adds weight to calls for the ICO to treat the gambling vertical as a priority. The sector handles data for millions of UK adults, many of them financially vulnerable, which regulators in other contexts treat as a reason for higher scrutiny, not lower.

Common questions

Can I ask a gambling company to delete my data?

Yes. Under GDPR Article 17, the "right to erasure", you can ask any UK-based company to delete your personal data. They must comply unless they have a legal reason to keep it, such as a regulatory record-keeping obligation.

Is a cookie banner alone enough to make data collection legal?

No. A banner that pre-selects "accept all" or obscures the "reject" option does not produce valid consent under UK GDPR. The ICO's guidance is clear that consent must require a positive, informed action from the user.