A major study from Swansea University, reported by blog-wizzydigital.org, has placed renewed attention on how UK gambling websites manage cookie consent, behavioural tracking and personal data. The research reviewed 624 licensed gambling websites and found that many consent journeys did not give visitors a clear, equally accessible choice about non-essential tracking.
The findings create a strong opportunity for gambling operators to improve trust, strengthen privacy practices and build digital experiences that put customers in control. In an industry where users increasingly expect transparency, well-designed consent systems can become a meaningful part of a safer, more credible online service.
Researchers found that 86% of cookie banners used at least one dark pattern, while only 14% of sites met all assessed GDPR requirements. The audit also reported that 24% of websites offered no option to reject tracking and that 67% processed personally identifiable information before users had provided consent.
What the Swansea University research examined
The research was conducted by academics connected with Swansea University’s Gambling Research, Education and Treatment Centre. It combined a large-scale website audit with an experiment involving 615 participants.
The audit focused on licensed UK gambling websites and assessed how their cookie banners presented choices around analytics, advertising and other non-essential tracking technologies. It did not suggest that all cookies are problematic. Some cookies are necessary to support functions such as account login, security, fraud prevention and core site operation.
The central question was whether people were given a genuine, informed and freely made choice before non-essential data collection began. Under UK data-protection expectations, consent for non-essential cookies and similar tracking technologies should be meaningful rather than assumed, pressured or obtained after tracking has already started.
Key findings from the gambling website audit
The study identified several recurring issues that may prevent users from making a fully informed privacy choice. The figures underline why consent design deserves the same attention as account security, responsible gambling tools and customer support.
| Finding | What it indicates |
|---|---|
| 86% of banners used at least one dark pattern | Many banners included design features that could steer visitors toward accepting tracking. |
| 14% met all assessed GDPR requirements | Only a relatively small share of audited sites satisfied every privacy requirement measured by the researchers. |
| 24% offered no rejection option | Some users could not refuse non-essential tracking through the available consent interface. |
| 67% processed identifiable information before consent | Pre-consent data processing was widespread across the audited websites. |
These results are particularly significant because gambling activity can reveal detailed behavioural patterns. Visits to a betting or casino platform, frequency of play, time spent browsing, responses to promotions and movement between products may contribute to a profile that is more sensitive than ordinary retail browsing data.
Why dark patterns matter in cookie consent banners
A dark pattern is a user-interface design that makes one outcome easier, more visible or more convenient than another. In a cookie banner, this might include a large, brightly coloured Accept All button paired with a less prominent rejection option, a refusal process that takes several additional steps, or wording that makes tracking appear unavoidable.
The Swansea experiment indicated that these visual choices can influence behaviour in a meaningful way. Participants exposed to the most common banner format identified in the audit were more likely to accept tracking, even where acceptance did not align with their previously stated privacy preferences.
That result matters because consent is not simply a box to tick. A banner can technically offer a choice while still making one answer feel effortless and the other difficult to find. Strong privacy design removes that imbalance and allows a customer’s decision to reflect what they genuinely want.
Examples of more balanced consent design
- Present Accept All and Reject All options with equal visual prominence.
- Make privacy settings available directly from the first consent layer.
- Use clear, plain-language descriptions of necessary, analytics, personalisation and advertising technologies.
- Ensure that rejecting optional tracking takes no more effort than accepting it.
- Keep consent choices easy to revisit and change at any time.
- Block non-essential cookies and similar technologies until valid permission has been recorded.
These practices can make consent journeys simpler for users while helping businesses demonstrate that their privacy promises are practical, not merely procedural.
Why gambling data requires particular care
Privacy is important across every type of online service, but gambling platforms create especially high stakes for consent design. Gambling-related browsing and gameplay information may reveal habits, routines and potential vulnerabilities. Even where individual data points appear limited, they can become more revealing when combined with advertising, analytics or profiling systems.
For this reason, a privacy-first approach offers more than regulatory value. It can support customer confidence and reinforce wider commitments to player protection. When users can easily understand what is collected, why it is collected and how to decline non-essential tracking, they are better positioned to make informed choices.
Responsible gambling measures and responsible data practices also complement one another. Both rely on treating customers fairly, reducing avoidable pressure and ensuring that systems are designed around informed decision-making.
A practical path to stronger consent compliance
The study points to a clear improvement route for operators, technology providers and marketing partners. Rather than viewing consent as an obstacle, businesses can treat it as a chance to deliver a clearer and more trustworthy digital experience.
1. Audit all tracking technologies
Operators can begin by identifying every cookie, tag, software development kit and third-party script that runs across their websites and apps. This includes analytics tools, advertising pixels, affiliate technologies, social media integrations and customer-experience platforms.
A full inventory helps teams distinguish genuinely essential services from optional tracking. It also makes it easier to verify whether personal data begins flowing before a user has made a valid choice.
2. Prevent pre-consent non-essential data collection
One of the most important actions is to ensure that non-essential analytics and advertising tools do not activate before consent. Consent-management platforms should be configured to block these technologies by default and release them only after the user has positively opted in.
This approach can reduce compliance risk while giving customers a straightforward assurance: their optional tracking preferences are respected from the moment they arrive.
3. Make refusal as easy as acceptance
Equal-choice design is a practical test of whether a consent process is fair. If accepting all cookies is available with one click, rejecting all optional cookies should be similarly quick and visually clear.
Businesses benefit when users do not have to search through multiple layers, decode technical language or navigate confusing menus to protect their privacy. A clean, balanced banner can reduce frustration and support a more positive first impression.
4. Improve transparency for third-party sharing
Many users may not realise how often advertising and analytics data is shared with external providers. Clear explanations of data categories, processing purposes and third-party involvement can help make consent meaningful.
Plain language is especially valuable. Instead of relying only on legal terminology, organisations can explain the practical impact of each choice, such as whether data will be used to measure site performance, tailor promotions or support advertising activity.
5. Test the user experience, not only the legal wording
Privacy teams, designers and compliance specialists can work together to test whether real people understand the available choices. User testing can reveal whether one button attracts disproportionate attention, whether refusal options are difficult to locate or whether wording creates unnecessary pressure.
This type of testing can turn compliance into a stronger customer experience. It helps organisations build interfaces that are both easier to use and more aligned with the principles of genuine consent.
The role of enforcement and clearer standards
The researchers have called for stronger enforcement and clearer standards around cookie-banner design. The Information Commissioner’s Office has previously taken action involving gambling operators where advertising cookies processed personal information before users had an opportunity to accept or reject them.
The Swansea findings suggest that the issue may be widespread enough to require continued regulatory attention. Clearer expectations could help responsible operators compete on a more level playing field, particularly where some businesses have already invested in privacy-friendly systems while others continue to rely on more persuasive or confusing consent journeys.
Effective enforcement can also benefit consumers by making privacy protections more consistent across the market. When users know that a rejection option will be visible, functional and respected, they can engage with digital services with greater confidence.
Privacy-first design can strengthen customer trust
The most constructive takeaway from the research is that consent design can be improved. The technology needed to manage preferences, block optional scripts and document consent is already available. What matters is applying it in a way that prioritises clarity, fairness and user control.
For gambling websites, this creates an opportunity to lead with responsible digital practices. A transparent cookie banner, clear privacy controls and properly configured tracking systems can help demonstrate respect for customers at the earliest stage of their journey.
Meaningful consent is not just about displaying a banner. It is about giving people a real choice before non-essential data collection begins.
As expectations around online privacy continue to rise, operators that invest in balanced consent experiences can create benefits that extend beyond compliance. They can reduce customer friction, support responsible gambling commitments and build a stronger foundation of trust in a highly data-driven sector.
Conclusion: A clear opportunity for better online privacy
The Swansea University audit of 624 licensed UK gambling websites highlights important shortcomings in cookie consent and pre-consent data processing. With 86% of reviewed banners containing at least one dark pattern and only 14% meeting all assessed GDPR requirements, the research makes a compelling case for faster improvement.
For operators, the path forward is practical: prevent non-essential tracking before permission, provide equally visible acceptance and rejection choices, explain data use clearly and regularly test the real customer experience. These steps can help turn privacy from a compliance burden into a valuable part of a fairer, more trusted gambling environment.
