Eight in Ten UK Gambling Sites May Be Breaking Privacy Law, Study Finds
New research suggests most licensed British bookmakers and online casinos collect personal data from visitors before those visitors have agreed to it, putting them at odds with GDPR rules.
Key points
- 86% of licensed British gambling websites appear to be breaching GDPR, the UK's main data privacy law, according to new research.
- Sites are accused of harvesting tracking data from visitors before those visitors click "accept" on cookie banners.
- GDPR, which came into force in May 2018, requires organisations to obtain clear, unambiguous consent before collecting most categories of personal data.
- Researchers describe the practice as "data surveillance" of customers.
- The findings raise questions about regulatory enforcement when both the UK Gambling Commission and the Information Commissioner's Office claim oversight of the sector.
For many gambling websites, that cookie banner click may already be too late.
New research, first reported by The Guardian, examined licensed British online bookmakers and casinos and found that roughly 86% of them appear to collect tracking data before the visitor has given any consent. Tracking data means small files that follow your activity across the web. Under GDPR (the General Data Protection Regulation, the EU-derived law the UK kept after Brexit governing how companies gather and use personal information), that collection isn't lawful.
What exactly is the problem?
The core rule is simple. GDPR Article 7 requires that consent be freely given and unambiguous before personal data is processed. Collecting tracking data the moment someone lands on a page, before they've touched a consent banner, violates that on its face.
Many sites also design their banners to nudge visitors toward accepting everything. Pre-ticked boxes, buried "reject" options, and misleading button colours are among the tactics documented. The ICO (the Information Commissioner's Office, the UK's data regulator) issued guidance on exactly these "dark patterns" in 2022, making clear they don't produce valid consent. We first covered cookie consent practices on 22 July 2026, and a privacy engineer's argument from 28 August holds here too: a banner click means nothing if the systems behind the site ignore it.
What does this mean for people who use these sites?
Gambling companies may hold a richer profile of your browsing habits than you agreed to share. That data can personalise advertising, assess your spending patterns, or be passed to third-party data brokers. Check your privacy settings after logging in; don't rely on the banner you saw on arrival.
Why does enforcement matter here?
The ICO holds significant fining powers under UK data protection law, yet the gambling sector has attracted little formal action on cookie compliance specifically. That gap matters because these sites handle data for millions of UK adults, many of them financially vulnerable, a circumstance regulators in other contexts treat as grounds for sharper scrutiny. The study makes that case for priority action hard to dismiss.
Common questions
Can I ask a gambling company to delete my data?
Yes. UK GDPR gives you the right to request erasure of your personal data. A company must comply unless it has a legal reason to retain records, such as a regulatory obligation.
Is a cookie banner alone enough to make data collection legal?
No. A banner that pre-selects "accept all" or obscures the "reject" option doesn't produce valid consent under UK GDPR. The ICO's guidance is clear that consent requires a positive, informed action from the user.
